@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+const ProjectsQuery = require("../../model/queries/project/ProjectsQuery.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("otpauth");
+class AuthPolicyQueryResolver {
+  constructor(authPolicyManager) {
+    this.authPolicyManager = authPolicyManager;
+  }
+  async authPolicies(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CONFIGURE,
+      message: "You are not allowed to view auth policies"
+    });
+    const [rows, projects] = await Promise.all([
+      this.authPolicyManager.listPolicies(context.db),
+      context.db.queryHandler.fetch(new ProjectsQuery.ProjectsQuery())
+    ]);
+    const slugById = new Map(projects.map((p) => [p.id, p.slug]));
+    return rows.map((row) => ({
+      id: row.id,
+      scope: row.scope,
+      project: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,
+      roles: row.roles,
+      mfaRequired: row.mfa_required,
+      // IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.
+      tokenExpiration: row.token_expiration,
+      idleTimeout: row.idle_timeout,
+      mfaGraceDuration: row.grace_duration,
+      rememberMeAllowed: row.remember_me_allowed
+    }));
+  }
+}
+exports.AuthPolicyQueryResolver = AuthPolicyQueryResolver;
+//# sourceMappingURL=AuthPolicyQueryResolver.cjs.map

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectsQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.js

@@ -0,0 +1,55 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import { ProjectsQuery } from "../../model/queries/project/ProjectsQuery.js";
+import "../../model/authorization/CustomRolePermissions.js";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "otpauth";
+class AuthPolicyQueryResolver {
+  constructor(authPolicyManager) {
+    this.authPolicyManager = authPolicyManager;
+  }
+  async authPolicies(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CONFIGURE,
+      message: "You are not allowed to view auth policies"
+    });
+    const [rows, projects] = await Promise.all([
+      this.authPolicyManager.listPolicies(context.db),
+      context.db.queryHandler.fetch(new ProjectsQuery())
+    ]);
+    const slugById = new Map(projects.map((p) => [p.id, p.slug]));
+    return rows.map((row) => ({
+      id: row.id,
+      scope: row.scope,
+      project: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,
+      roles: row.roles,
+      mfaRequired: row.mfa_required,
+      // IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.
+      tokenExpiration: row.token_expiration,
+      idleTimeout: row.idle_timeout,
+      mfaGraceDuration: row.grace_duration,
+      rememberMeAllowed: row.remember_me_allowed
+    }));
+  }
+}
+export {
+  AuthPolicyQueryResolver
+};
+//# sourceMappingURL=AuthPolicyQueryResolver.js.map

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAI,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;"}

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.cjs

@@ -2,22 +2,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../model/queries/configuration/ConfigurationQuery.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class ConfigurationQueryResolver {
   constructor(configurationManager) {
@@ -28,7 +32,7 @@ class ConfigurationQueryResolver {
       action: PermissionActions.PermissionActions.CONFIG_VIEW,
       message: "You are not allowed to view configuration"
     });
-    return await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    return await context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
   }
 }
 exports.ConfigurationQueryResolver = ConfigurationQueryResolver;

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema'\nimport { ConfigurationQuery, PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAAA,EACpE;AACD;;"}
+{"version":3,"file":"ConfigurationQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;;"}

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.js

@@ -1,21 +1,25 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../model/queries/configuration/ConfigurationQuery.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class ConfigurationQueryResolver {
   constructor(configurationManager) {
@@ -26,7 +30,7 @@ class ConfigurationQueryResolver {
       action: PermissionActions.CONFIG_VIEW,
       message: "You are not allowed to view configuration"
     });
-    return await context.db.queryHandler.fetch(new ConfigurationQuery());
+    return await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
   }
 }
 export {

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema'\nimport { ConfigurationQuery, PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery())\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AAAA,EACpE;AACD;"}
+{"version":3,"file":"ConfigurationQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;"}

package/dist/development/src/resolvers/query/CustomRoleQueryResolver.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+const CustomRolePermissions = require("../../model/authorization/CustomRolePermissions.cjs");
+require("../../model/authorization/PermissionContext.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../model/service/AuthLogService.cjs");
+require("otpauth");
+class CustomRoleQueryResolver {
+  constructor(customRoleManager) {
+    this.customRoleManager = customRoleManager;
+  }
+  async customRoles(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CUSTOM_ROLE_VIEW,
+      message: "You are not allowed to view custom roles"
+    });
+    const rows = await this.customRoleManager.listRoles(context.db);
+    return rows.map((row) => ({
+      slug: row.slug,
+      description: row.description,
+      grants: row.grants
+    }));
+  }
+  async customRolePermissions(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CUSTOM_ROLE_VIEW,
+      message: "You are not allowed to view custom role permissions"
+    });
+    return [...CustomRolePermissions.getGrantablePermissions().values()].sort((left, right) => left.name.localeCompare(right.name)).map((definition) => ({
+      name: definition.name,
+      configurationKind: definition.configurationKind,
+      configurationRequired: CustomRolePermissions.isConfigurationRequired(definition),
+      defaultConfig: definition.defaultConfig
+    }));
+  }
+}
+exports.CustomRoleQueryResolver = CustomRoleQueryResolver;
+//# sourceMappingURL=CustomRoleQueryResolver.cjs.map

package/dist/development/src/resolvers/query/CustomRoleQueryResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/CustomRoleQueryResolver.ts"],"sourcesContent":["import { CustomRole, CustomRolePermissionDefinition, QueryResolvers } from '../../schema/index.js'\nimport { CustomRoleManager, PermissionActions } from '../../model/index.js'\nimport { getGrantablePermissions, isConfigurationRequired } from '../../model/authorization/CustomRolePermissions.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\n/** Lists custom roles and the grantable permission vocabulary. Gated by `customRole:view`. */\nexport class CustomRoleQueryResolver implements Pick<QueryResolvers, 'customRoles' | 'customRolePermissions'> {\n\tconstructor(\n\t\tprivate readonly customRoleManager: CustomRoleManager,\n\t) {}\n\n\tasync customRoles(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRole[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_VIEW,\n\t\t\tmessage: 'You are not allowed to view custom roles',\n\t\t})\n\n\t\tconst rows = await this.customRoleManager.listRoles(context.db)\n\t\treturn rows.map((row): CustomRole => ({\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: row.grants,\n\t\t}))\n\t}\n\n\tasync customRolePermissions(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRolePermissionDefinition[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_VIEW,\n\t\t\tmessage: 'You are not allowed to view custom role permissions',\n\t\t})\n\n\t\treturn [...getGrantablePermissions().values()]\n\t\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t\t.map(definition => ({\n\t\t\t\tname: definition.name,\n\t\t\t\tconfigurationKind: definition.configurationKind,\n\t\t\t\tconfigurationRequired: isConfigurationRequired(definition),\n\t\t\t\tdefaultConfig: definition.defaultConfig,\n\t\t\t}))\n\t}\n}\n"],"names":["PermissionActions","getGrantablePermissions","isConfigurationRequired"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAiG;AAAA,EAC7G,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,YAAY,QAAiB,MAAe,SAAgE;AACjH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,OAAO,MAAM,KAAK,kBAAkB,UAAU,QAAQ,EAAE;AAC9D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQ,IAAI;AAAA,IAAA,EACX;AAAA,EACH;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAoF;AAC/I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,CAAC,GAAGC,sBAAAA,0BAA0B,OAAA,CAAQ,EAC3C,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,EACzD,IAAI,CAAA,gBAAe;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,mBAAmB,WAAW;AAAA,MAC9B,uBAAuBC,sBAAAA,wBAAwB,UAAU;AAAA,MACzD,eAAe,WAAW;AAAA,IAAA,EACzB;AAAA,EACJ;AACD;;"}

package/dist/development/src/resolvers/query/CustomRoleQueryResolver.js

@@ -0,0 +1,55 @@
+import { PermissionActions } from "../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import { getGrantablePermissions, isConfigurationRequired } from "../../model/authorization/CustomRolePermissions.js";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../model/service/idp/providers/FacebookProvider.js";
+import "../../model/service/AuthLogService.js";
+import "otpauth";
+class CustomRoleQueryResolver {
+  constructor(customRoleManager) {
+    this.customRoleManager = customRoleManager;
+  }
+  async customRoles(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CUSTOM_ROLE_VIEW,
+      message: "You are not allowed to view custom roles"
+    });
+    const rows = await this.customRoleManager.listRoles(context.db);
+    return rows.map((row) => ({
+      slug: row.slug,
+      description: row.description,
+      grants: row.grants
+    }));
+  }
+  async customRolePermissions(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CUSTOM_ROLE_VIEW,
+      message: "You are not allowed to view custom role permissions"
+    });
+    return [...getGrantablePermissions().values()].sort((left, right) => left.name.localeCompare(right.name)).map((definition) => ({
+      name: definition.name,
+      configurationKind: definition.configurationKind,
+      configurationRequired: isConfigurationRequired(definition),
+      defaultConfig: definition.defaultConfig
+    }));
+  }
+}
+export {
+  CustomRoleQueryResolver
+};
+//# sourceMappingURL=CustomRoleQueryResolver.js.map

package/dist/development/src/resolvers/query/CustomRoleQueryResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/CustomRoleQueryResolver.ts"],"sourcesContent":["import { CustomRole, CustomRolePermissionDefinition, QueryResolvers } from '../../schema/index.js'\nimport { CustomRoleManager, PermissionActions } from '../../model/index.js'\nimport { getGrantablePermissions, isConfigurationRequired } from '../../model/authorization/CustomRolePermissions.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\n/** Lists custom roles and the grantable permission vocabulary. Gated by `customRole:view`. */\nexport class CustomRoleQueryResolver implements Pick<QueryResolvers, 'customRoles' | 'customRolePermissions'> {\n\tconstructor(\n\t\tprivate readonly customRoleManager: CustomRoleManager,\n\t) {}\n\n\tasync customRoles(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRole[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_VIEW,\n\t\t\tmessage: 'You are not allowed to view custom roles',\n\t\t})\n\n\t\tconst rows = await this.customRoleManager.listRoles(context.db)\n\t\treturn rows.map((row): CustomRole => ({\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: row.grants,\n\t\t}))\n\t}\n\n\tasync customRolePermissions(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRolePermissionDefinition[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_VIEW,\n\t\t\tmessage: 'You are not allowed to view custom role permissions',\n\t\t})\n\n\t\treturn [...getGrantablePermissions().values()]\n\t\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t\t.map(definition => ({\n\t\t\t\tname: definition.name,\n\t\t\t\tconfigurationKind: definition.configurationKind,\n\t\t\t\tconfigurationRequired: isConfigurationRequired(definition),\n\t\t\t\tdefaultConfig: definition.defaultConfig,\n\t\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAiG;AAAA,EAC7G,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,YAAY,QAAiB,MAAe,SAAgE;AACjH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,OAAO,MAAM,KAAK,kBAAkB,UAAU,QAAQ,EAAE;AAC9D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQ,IAAI;AAAA,IAAA,EACX;AAAA,EACH;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAoF;AAC/I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,CAAC,GAAG,0BAA0B,OAAA,CAAQ,EAC3C,KAAK,CAAC,MAAM,UAAU,KAAK,KAAK,cAAc,MAAM,IAAI,CAAC,EACzD,IAAI,CAAA,gBAAe;AAAA,MACnB,MAAM,WAAW;AAAA,MACjB,mBAAmB,WAAW;AAAA,MAC9B,uBAAuB,wBAAwB,UAAU;AAAA,MACzD,eAAe,WAAW;AAAA,IAAA,EACzB;AAAA,EACJ;AACD;"}

package/dist/development/src/resolvers/query/IDPQueryResolver.cjs

@@ -2,21 +2,25 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class IDPQueryResolver {
   constructor(idpManager) {

package/dist/development/src/resolvers/query/IDPQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema'\nimport { PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { IDPManager } from '../../model/service/idp/IDPManager'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;;"}
+{"version":3,"file":"IDPQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;;"}

package/dist/development/src/resolvers/query/IDPQueryResolver.js

@@ -1,20 +1,24 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class IDPQueryResolver {
   constructor(idpManager) {

package/dist/development/src/resolvers/query/IDPQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema'\nimport { PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\nimport { IDPManager } from '../../model/service/idp/IDPManager'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;"}
+{"version":3,"file":"IDPQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;"}

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.cjs

@@ -2,35 +2,44 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+const MailTemplateListQuery = require("../../model/queries/mailTemplate/MailTemplateListQuery.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
-const MailTemplateListQuery = require("../../model/queries/mailTemplate/MailTemplateListQuery.cjs");
 const type = require("../../model/mailing/type.cjs");
 require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class MailTemplateQueryResolver {
+  /** Filters per row rather than throwing, like the other tenant read fields. */
   async mailTemplates(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST,
-      message: "You are not allowed to list mail templates"
-    });
-    return (await context.db.queryHandler.fetch(new MailTemplateListQuery.MailTemplateListQuery())).map((it) => ({
-      ...it,
-      variant: it.variant || null,
-      type: type.mailTypeFromDbToSchema(it.type)
+    const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery.MailTemplateListQuery());
+    const visible = await Promise.all(rows.map(async (row) => {
+      const type$1 = type.mailTypeFromDbToSchema(row.type);
+      const allowed = await context.isAllowed({
+        action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST({
+          kind: row.projectSlug === null ? "global" : "project",
+          projectSlug: row.projectSlug,
+          type: type$1
+        })
+      });
+      return allowed ? { ...row, variant: row.variant || null, type: type$1 } : null;
     }));
+    return visible.filter((row) => row !== null);
   }
 }
 exports.MailTemplateQueryResolver = MailTemplateQueryResolver;

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","MailTemplateListQuery","mailTypeFromDbToSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAMC,KAAAA,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;;"}
+{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\t/** Filters per row rather than throwing, like the other tenant read fields. */\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tconst rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())\n\t\tconst visible = await Promise.all(rows.map(async row => {\n\t\t\tconst type = mailTypeFromDbToSchema(row.type)\n\t\t\tconst allowed = await context.isAllowed({\n\t\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST({\n\t\t\t\t\tkind: row.projectSlug === null ? 'global' : 'project',\n\t\t\t\t\tprojectSlug: row.projectSlug,\n\t\t\t\t\ttype,\n\t\t\t\t}),\n\t\t\t})\n\t\t\treturn allowed ? { ...row, variant: row.variant || null, type } : null\n\t\t}))\n\t\treturn visible.filter(row => row !== null)\n\t}\n}\n"],"names":["MailTemplateListQuery","type","mailTypeFromDbToSchema","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA;AAAA,EAEhE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIA,sBAAAA,uBAAuB;AAC5E,UAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAM,QAAO;AACvD,YAAMC,SAAOC,KAAAA,uBAAuB,IAAI,IAAI;AAC5C,YAAM,UAAU,MAAM,QAAQ,UAAU;AAAA,QACvC,QAAQC,kBAAAA,kBAAkB,mBAAmB;AAAA,UAC5C,MAAM,IAAI,gBAAgB,OAAO,WAAW;AAAA,UAC5C,aAAa,IAAI;AAAA,UAAA,MACjBF;AAAAA,QAAA,CACA;AAAA,MAAA,CACD;AACD,aAAO,UAAU,EAAE,GAAG,KAAK,SAAS,IAAI,WAAW,YAAMA,OAAA,IAAS;AAAA,IACnE,CAAC,CAAC;AACF,WAAO,QAAQ,OAAO,CAAA,QAAO,QAAQ,IAAI;AAAA,EAC1C;AACD;;"}

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.js

@@ -1,34 +1,43 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import { MailTemplateListQuery } from "../../model/queries/mailTemplate/MailTemplateListQuery.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
-import { MailTemplateListQuery } from "../../model/queries/mailTemplate/MailTemplateListQuery.js";
 import { mailTypeFromDbToSchema } from "../../model/mailing/type.js";
 import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class MailTemplateQueryResolver {
+  /** Filters per row rather than throwing, like the other tenant read fields. */
   async mailTemplates(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.MAIL_TEMPLATE_LIST,
-      message: "You are not allowed to list mail templates"
-    });
-    return (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map((it) => ({
-      ...it,
-      variant: it.variant || null,
-      type: mailTypeFromDbToSchema(it.type)
+    const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery());
+    const visible = await Promise.all(rows.map(async (row) => {
+      const type = mailTypeFromDbToSchema(row.type);
+      const allowed = await context.isAllowed({
+        action: PermissionActions.MAIL_TEMPLATE_LIST({
+          kind: row.projectSlug === null ? "global" : "project",
+          projectSlug: row.projectSlug,
+          type
+        })
+      });
+      return allowed ? { ...row, variant: row.variant || null, type } : null;
     }));
+    return visible.filter((row) => row !== null);
   }
 }
 export {

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model'\nimport { TenantResolverContext } from '../TenantResolverContext'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAM,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;"}
+{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\t/** Filters per row rather than throwing, like the other tenant read fields. */\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tconst rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())\n\t\tconst visible = await Promise.all(rows.map(async row => {\n\t\t\tconst type = mailTypeFromDbToSchema(row.type)\n\t\t\tconst allowed = await context.isAllowed({\n\t\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST({\n\t\t\t\t\tkind: row.projectSlug === null ? 'global' : 'project',\n\t\t\t\t\tprojectSlug: row.projectSlug,\n\t\t\t\t\ttype,\n\t\t\t\t}),\n\t\t\t})\n\t\t\treturn allowed ? { ...row, variant: row.variant || null, type } : null\n\t\t}))\n\t\treturn visible.filter(row => row !== null)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA;AAAA,EAEhE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB;AAC5E,UAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAM,QAAO;AACvD,YAAM,OAAO,uBAAuB,IAAI,IAAI;AAC5C,YAAM,UAAU,MAAM,QAAQ,UAAU;AAAA,QACvC,QAAQ,kBAAkB,mBAAmB;AAAA,UAC5C,MAAM,IAAI,gBAAgB,OAAO,WAAW;AAAA,UAC5C,aAAa,IAAI;AAAA,UACjB;AAAA,QAAA,CACA;AAAA,MAAA,CACD;AACD,aAAO,UAAU,EAAE,GAAG,KAAK,SAAS,IAAI,WAAW,MAAM,KAAA,IAAS;AAAA,IACnE,CAAC,CAAC;AACF,WAAO,QAAQ,OAAO,CAAA,QAAO,QAAQ,IAAI;AAAA,EAC1C;AACD;"}

package/dist/development/src/resolvers/query/MeQueryResolver.cjs

@@ -5,6 +5,7 @@ class MeQueryResolver {
     return {
       id: context.identity.id,
       projects: [],
+      sessions: [],
       person: null
     };
   }

package/dist/development/src/resolvers/query/MeQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MeQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MeQueryResolver.ts"],"sourcesContent":["import { Identity, QueryResolvers } from '../../schema'\nimport { TenantResolverContext } from '../TenantResolverContext'\n\nexport class MeQueryResolver implements QueryResolvers {\n\tme(parent: unknown, args: unknown, context: TenantResolverContext): Identity {\n\t\treturn {\n\t\t\tid: context.identity.id,\n\t\t\tprojects: [],\n\t\t\tperson: null,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,gBAA0C;AAAA,EACtD,GAAG,QAAiB,MAAe,SAA0C;AAC5E,WAAO;AAAA,MACN,IAAI,QAAQ,SAAS;AAAA,MACrB,UAAU,CAAA;AAAA,MACV,QAAQ;AAAA,IAAA;AAAA,EAEV;AACD;;"}
+{"version":3,"file":"MeQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MeQueryResolver.ts"],"sourcesContent":["import { Identity, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MeQueryResolver implements QueryResolvers {\n\tme(parent: unknown, args: unknown, context: TenantResolverContext): Identity {\n\t\treturn {\n\t\t\tid: context.identity.id,\n\t\t\tprojects: [],\n\t\t\tsessions: [],\n\t\t\tperson: null,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,gBAA0C;AAAA,EACtD,GAAG,QAAiB,MAAe,SAA0C;AAC5E,WAAO;AAAA,MACN,IAAI,QAAQ,SAAS;AAAA,MACrB,UAAU,CAAA;AAAA,MACV,UAAU,CAAA;AAAA,MACV,QAAQ;AAAA,IAAA;AAAA,EAEV;AACD;;"}

package/dist/development/src/resolvers/query/MeQueryResolver.js

@@ -3,6 +3,7 @@ class MeQueryResolver {
     return {
       id: context.identity.id,
       projects: [],
+      sessions: [],
       person: null
     };
   }