@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/model/utils/DatabaseContext.ts

@@ -1,8 +1,21 @@
-import { Client, Connection } from '@contember/database'
+import { Client, Connection, retryTransaction } from '@contember/database'
+import { Logger } from '@contember/logger'
 import { Providers } from '../providers.js'
 import { CommandBus } from '../commands/index.js'
 import { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'
 
+export interface TransactionOptions {
+	/**
+	 * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
+	 * repeatable-read level every transaction here runs at.
+	 *
+	 * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside
+	 * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.
+	 */
+	retry?: { logger: Logger }
+	readonly isolation?: 'repeatableRead' | 'readCommitted'
+}
+
 export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	private loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()
 
@@ -20,11 +33,22 @@ export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection
 		return this.client.createQueryHandler()
 	}
 
-	public async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {
-		return await this.client.transaction(async db => {
-			await db.query(Connection.REPEATABLE_READ)
-			return await cb(new DatabaseContext(db, this.providers))
-		})
+	public async transaction<T>(
+		cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>,
+		options: TransactionOptions = {},
+	): Promise<T> {
+		const run = async () =>
+			await this.client.transaction(async db => {
+				if (options.isolation !== 'readCommitted') {
+					await db.query(Connection.REPEATABLE_READ)
+				}
+				return await cb(new DatabaseContext(db, this.providers))
+			})
+		const retry = options.retry
+		if (!retry) {
+			return await run()
+		}
+		return await retryTransaction(run, message => retry.logger.warn(message))
 	}
 
 	public async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {

package/src/model/utils/token.ts

@@ -37,11 +37,10 @@ export const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {
 	return crypto.timingSafeEqual(bufferA, bufferB)
 }
 
-export const validateToken = ({ entry, validationType, token, now }: {
+export const validateToken = ({ entry, validationType, token }: {
 	entry: PersonToken.Row | null
 	validationType: PersonToken.ValidationType
 	token: string
-	now: Date
 }): Response<PersonToken.Row, PersonToken.TokenValidationError> => {
 	if (!entry) {
 		return new ResponseError('TOKEN_NOT_FOUND', 'Token not found')
@@ -72,7 +71,7 @@ export const validateToken = ({ entry, validationType, token, now }: {
 	if (entry.used_at) {
 		return new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())
 	}
-	if (entry.expires_at < now) {
+	if (entry.is_expired) {
 		return new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())
 	}
 	return new ResponseOk(entry)

package/src/resolvers/ResolverFactory.ts

@@ -40,6 +40,7 @@ import { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'
 import { IDPQueryResolver } from './query/IDPQueryResolver.js'
 import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'
 import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'
+import { EnablePersonMutationResolver } from './mutation/person/EnablePersonMutationResolver.js'
 import { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'
 import { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'
 import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'
@@ -47,6 +48,8 @@ import { ConfigurationMutationResolver } from './mutation/configuration/Configur
 import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'
 import { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'
 import { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'
+import { CustomRoleMutationResolver } from './mutation/customRole/CustomRoleMutationResolver.js'
+import { CustomRoleQueryResolver } from './query/CustomRoleQueryResolver.js'
 import { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'
 import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'
 import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'
@@ -78,6 +81,7 @@ class ResolverFactory {
 			passwordlessMutationResolver: PasswordlessMutationResolver
 
 			disablePersonMutationResolver: DisablePersonMutationResolver
+			enablePersonMutationResolver: EnablePersonMutationResolver
 			forceSignOutMutationResolver: ForceSignOutMutationResolver
 			resetPersonMfaMutationResolver: ResetPersonMfaMutationResolver
 			revokeSessionMutationResolver: RevokeSessionMutationResolver
@@ -112,6 +116,9 @@ class ResolverFactory {
 			authPolicyMutationResolver: AuthPolicyMutationResolver
 			authPolicyQueryResolver: AuthPolicyQueryResolver
 
+			customRoleMutationResolver: CustomRoleMutationResolver
+			customRoleQueryResolver: CustomRoleQueryResolver
+
 			authLogQueryResolver: AuthLogQueryResolver
 			apiKeyQueryResolver: ApiKeyQueryResolver
 
@@ -133,12 +140,15 @@ class ResolverFactory {
 			},
 			Person: {
 				identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),
+				passwordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),
+				passwordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver),
 			},
 			Project: {
 				members: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),
 				roles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),
 				apiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),
 				secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),
+				permissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver),
 			},
 			Query: {
 				me: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),
@@ -152,6 +162,8 @@ class ResolverFactory {
 				mailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),
 				configuration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),
 				authPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),
+				customRoles: this.resolvers.customRoleQueryResolver.customRoles.bind(this.resolvers.customRoleQueryResolver),
+				customRolePermissions: this.resolvers.customRoleQueryResolver.customRolePermissions.bind(this.resolvers.customRoleQueryResolver),
 				authLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),
 				checkResetPasswordToken: () => {
 					throw new Error('not implemented')
@@ -188,6 +200,7 @@ class ResolverFactory {
 					this.resolvers.disconnectMyIdentityProviderMutationResolver,
 				),
 				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
+				enablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),
 				forceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),
 				resetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),
 				revokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),
@@ -250,6 +263,10 @@ class ResolverFactory {
 				createAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
 				updateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
 				deleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
+
+				createCustomRole: this.resolvers.customRoleMutationResolver.createCustomRole.bind(this.resolvers.customRoleMutationResolver),
+				updateCustomRole: this.resolvers.customRoleMutationResolver.updateCustomRole.bind(this.resolvers.customRoleMutationResolver),
+				deleteCustomRole: this.resolvers.customRoleMutationResolver.deleteCustomRole.bind(this.resolvers.customRoleMutationResolver),
 			},
 		}
 	}

package/src/resolvers/TenantResolverContext.ts

@@ -18,6 +18,6 @@ export interface TenantResolverContext {
 	readonly requireAccess: PermissionContext['requireAccess']
 	readonly db: DatabaseContext
 	readonly logger: Logger
-	readonly logAuthAction: (entry: AuthLogService.LogArgs) => Promise<void>
+	readonly logAuthAction: (entry: AuthLogService.LogArgs, db?: DatabaseContext) => Promise<void>
 	readonly httpInfo: TenantResolverHttpInfo
 }

package/src/resolvers/TenantResolverContextFactory.ts

@@ -22,13 +22,13 @@ export class TenantResolverContextFactory {
 		private readonly loginRiskAnalyzer: LoginRiskAnalyzer,
 	) {}
 
-	public create(
+	public async create(
 		authContext: { apiKeyId: string; identityId: string; roles: string[]; trustForwardedInfo?: boolean },
 		httpInfo: { ip: string; userAgent?: string; forwarderIp?: string; forwarderUserAgent?: string; geoCountry?: string },
 		db: DatabaseContext,
 		logger: Logger,
-	): TenantResolverContext {
-		const permissionContext = this.permissionContextFactory.create(db, {
+	): Promise<TenantResolverContext> {
+		const permissionContext = await this.permissionContextFactory.createPreloaded(db, {
 			id: authContext.identityId,
 			roles: authContext.roles,
 		})
@@ -37,8 +37,8 @@ export class TenantResolverContextFactory {
 		const deviceFingerprint = this.loginRiskAnalyzer.fingerprint(httpInfo.userAgent) ?? undefined
 		return {
 			...createResolverContext(permissionContext, authContext.apiKeyId, authContext.trustForwardedInfo ?? false),
-			logAuthAction: async data => {
-				await this.authLogService.logAuthAction(db, {
+			logAuthAction: async (data, transaction) => {
+				await this.authLogService.logAuthAction(transaction ?? db, {
 					identityId: authContext.identityId,
 					userAgent: httpInfo.userAgent,
 					clientIp: httpInfo.ip,

package/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts

@@ -9,7 +9,7 @@ import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
 import { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'
 import { createMembershipValidationErrorResult } from '../../membershipUtils.js'
-import { createProjectNotFoundResponse } from '../../errorUtils.js'
+import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
 import { UserInputError } from '@contember/graphql-utils'
 import { ResponseOk } from '../../../model/utils/Response.js'
 import { Acl, JSONValue } from '@contember/schema'
@@ -28,9 +28,10 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
 		const project = await this.projectManager.getProjectBySlug(context.db, projectSlug)
+		const trustForwardedClientInfo = options?.trustForwardedClientInfo === true
 		await context.requireAccess({
 			scope: await context.permissionContext.createProjectScope(project),
-			action: PermissionActions.API_KEY_CREATE,
+			action: PermissionActions.API_KEY_CREATE({ trustForwardedClientInfo }),
 			message: 'You are not allowed to create an API key for this project',
 		})
 		if (!project) {
@@ -55,8 +56,11 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 			memberships,
 			description,
 			tokenHash ?? undefined,
-			options?.trustForwardedClientInfo === true,
+			trustForwardedClientInfo,
 		)
+		if (!result.ok) {
+			return createErrorResponse(result)
+		}
 
 		await context.logAuthAction({
 			type: 'api_key_create',
@@ -87,8 +91,9 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
 		roles ??= []
+		const trustForwardedClientInfo = options?.trustForwardedClientInfo === true
 		await context.requireAccess({
-			action: PermissionActions.API_KEY_CREATE_GLOBAL(roles),
+			action: PermissionActions.API_KEY_CREATE_GLOBAL({ requestedRoles: roles, trustForwardedClientInfo }),
 			message: 'You are not allowed to create a global API key',
 		})
 		if (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {
@@ -99,8 +104,11 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 			description,
 			roles,
 			tokenHash ?? undefined,
-			options?.trustForwardedClientInfo === true,
+			trustForwardedClientInfo,
 		)
+		if (!result.ok) {
+			return createErrorResponse(result)
+		}
 
 		await context.logAuthAction({
 			type: 'api_key_create',

package/src/resolvers/mutation/customRole/CustomRoleMutationResolver.ts

@@ -0,0 +1,125 @@
+import {
+	CreateCustomRoleResponse,
+	DeleteCustomRoleResponse,
+	MutationCreateCustomRoleArgs,
+	MutationDeleteCustomRoleArgs,
+	MutationResolvers,
+	MutationUpdateCustomRoleArgs,
+	UpdateCustomRoleResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { CustomRoleManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+
+/**
+ * CRUD over `custom_role` (runtime-defined global roles). Gated by `customRole:manage`,
+ * which is deliberately NOT grantable to a custom role — by default only SUPER_ADMIN
+ * (via the wildcard grant) can manage role definitions.
+ */
+export class CustomRoleMutationResolver implements Pick<MutationResolvers, 'createCustomRole' | 'updateCustomRole' | 'deleteCustomRole'> {
+	constructor(
+		private readonly customRoleManager: CustomRoleManager,
+	) {}
+
+	async createCustomRole(parent: any, args: MutationCreateCustomRoleArgs, context: TenantResolverContext): Promise<CreateCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		// the conflict is caught out here: a unique violation aborts the transaction, so
+		// mapping it inside would return normally and then fail on COMMIT
+		let result
+		try {
+			result = await context.db.transaction(async db => {
+				const result = await this.customRoleManager.createRole(db, {
+					slug: args.slug,
+					description: args.description ?? null,
+					grants: args.grants,
+				})
+				if (result.ok) {
+					await context.logAuthAction({
+						type: 'custom_role_change',
+						response: new ResponseOk(null),
+						eventData: {
+							operation: 'create',
+							after: result.result.role,
+						},
+					}, db)
+				}
+				return result
+			}, { isolation: 'readCommitted' })
+		} catch (error) {
+			if (CustomRoleManager.isSlugConflict(error)) {
+				return createErrorResponse('SLUG_ALREADY_EXISTS', `Custom role ${args.slug} already exists`)
+			}
+			throw error
+		}
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+
+	async updateCustomRole(parent: any, args: MutationUpdateCustomRoleArgs, context: TenantResolverContext): Promise<UpdateCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		const result = await context.db.transaction(async db => {
+			const result = await this.customRoleManager.updateRole(db, args.slug, {
+				description: args.description,
+				grants: args.grants,
+			})
+			if (result.ok) {
+				await context.logAuthAction({
+					type: 'custom_role_change',
+					response: new ResponseOk(null),
+					eventData: {
+						operation: 'update',
+						before: result.result.before,
+						after: result.result.after,
+					},
+				}, db)
+			}
+			return result
+		}, { isolation: 'readCommitted' })
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+
+	async deleteCustomRole(parent: any, args: MutationDeleteCustomRoleArgs, context: TenantResolverContext): Promise<DeleteCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		const result = await context.db.transaction(async db => {
+			const result = await this.customRoleManager.deleteRole(db, args.slug)
+			if (result.ok) {
+				await context.logAuthAction({
+					type: 'custom_role_change',
+					response: new ResponseOk(null),
+					eventData: {
+						operation: 'delete',
+						before: result.result.before,
+						removedAssignments: result.result.removedAssignments,
+						removedAssignmentIdentityIds: [...result.result.removedAssignmentIdentityIds],
+					},
+				}, db)
+			}
+			return result
+		}, { isolation: 'readCommitted' })
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+}

package/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts

@@ -7,7 +7,7 @@ import {
 } from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { PermissionActions, RolesManager } from '../../../model/index.js'
+import { createTargetIdentityPermissionTarget, PermissionActions, RolesManager } from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'
 import { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'
@@ -25,19 +25,31 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<AddGlobalIdentityRolesResponse> {
+		// cheap gate first, so a caller holding the permission in no form cannot probe identity existence
 		await context.requireAccess({
-			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
+			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),
 			message: 'You are not allowed to add global roles',
 		})
 
 		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
-		const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)
+		if (before === undefined) {
+			return createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
+		}
+		await context.requireAccess({
+			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({
+				requestedRoles: roles,
+				target: await createTargetIdentityPermissionTarget(context.db, before),
+				self: identityId === context.identity.id,
+			}),
+			message: 'You are not allowed to add these global roles',
+		})
 
+		const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
-		await this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])
+		await this.logRolesChange(context, identityId, 'global_role_grant', before.roles)
 
 		return {
 			ok: true,
@@ -54,18 +66,29 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 		info: GraphQLResolveInfo,
 	): Promise<RemoveGlobalIdentityRolesResponse> {
 		await context.requireAccess({
-			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
+			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),
 			message: 'You are not allowed to remove global roles',
 		})
 
 		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
-		const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)
+		if (before === undefined) {
+			return createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
+		}
+		await context.requireAccess({
+			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({
+				requestedRoles: roles,
+				target: await createTargetIdentityPermissionTarget(context.db, before),
+				self: identityId === context.identity.id,
+			}),
+			message: 'You are not allowed to remove these global roles',
+		})
 
+		const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
-		await this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])
+		await this.logRolesChange(context, identityId, 'global_role_revoke', before.roles)
 
 		return {
 			ok: true,

package/src/resolvers/mutation/idp/AddIDPMutationResolver.ts

@@ -26,6 +26,7 @@ export class AddIDPMutationResolver implements MutationResolvers {
 				initReturnsConfig: args.options?.initReturnsConfig ?? false,
 				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
 				assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+				disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,
 			},
 		})
 		if (!result.ok) {

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -26,6 +26,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 				initReturnsConfig: args.options?.initReturnsConfig ?? undefined,
 				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,
 				assumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,
+				disableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,
 			},
 		}, args.mergeConfiguration ?? false)
 		if (!result.ok) {

package/src/resolvers/mutation/idp/audit.ts

@@ -14,6 +14,7 @@ export const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValu
 		initReturnsConfig: row.initReturnsConfig,
 		requireVerifiedEmail: row.requireVerifiedEmail,
 		assumeEmailVerified: row.assumeEmailVerified,
+		disableLocalAuthentication: row.disableLocalAuthentication,
 		configurationKeys: Object.keys(row.configuration).sort(),
 	}
 }

package/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts

@@ -1,15 +1,24 @@
 import {
 	AddMailTemplateResponse,
+	MailType,
 	MutationAddProjectMailTemplateArgs,
 	MutationRemoveProjectMailTemplateArgs,
 	MutationResolvers,
 	RemoveMailTemplateResponse,
 } from '../../../schema/index.js'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'
+import {
+	MailTemplateManager,
+	MailTemplatePermissionMeta,
+	mailTypeFromSchemaToDb,
+	PermissionActions,
+	Project,
+	ProjectManager,
+} from '../../../model/index.js'
 import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
 import { validateEmail } from '../../../model/utils/email.js'
 import { ResponseOk } from '../../../model/utils/Response.js'
+import { Authorizator } from '@contember/authorization'
 
 export class MailTemplateMutationResolver implements MutationResolvers {
 	constructor(
@@ -17,17 +26,41 @@ export class MailTemplateMutationResolver implements MutationResolvers {
 		private readonly mailTemplateManager: MailTemplateManager,
 	) {}
 
+	/** A mail template is either global or project-scoped; both the scope and the permission meta follow from that. */
+	private async requireTemplateAccess(
+		context: TenantResolverContext,
+		projectSlug: string | null | undefined,
+		type: MailType,
+		action: (meta?: MailTemplatePermissionMeta) => Authorizator.Action<MailTemplatePermissionMeta | undefined>,
+		message: string,
+	): Promise<Project | null> {
+		const hasProject = projectSlug !== null && projectSlug !== undefined
+		const project = hasProject ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null
+		await context.requireAccess({
+			// an unknown slug must resolve to the denied project scope, never fall back to global
+			scope: hasProject ? await context.permissionContext.createProjectScope(project) : undefined,
+			action: action({
+				kind: hasProject ? 'project' : 'global',
+				projectSlug: hasProject ? projectSlug : null,
+				type,
+			}),
+			message,
+		})
+		return project
+	}
+
 	async addMailTemplate(
 		parent: any,
 		{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,
 		context: TenantResolverContext,
 	): Promise<AddMailTemplateResponse> {
-		const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null
-		await context.requireAccess({
-			scope: project ? await context.permissionContext.createProjectScope(project) : undefined,
-			action: PermissionActions.MAIL_TEMPLATE_ADD,
-			message: 'You are not allowed to add a mail template',
-		})
+		const project = await this.requireTemplateAccess(
+			context,
+			projectSlug,
+			type,
+			PermissionActions.MAIL_TEMPLATE_ADD,
+			'You are not allowed to add a mail template',
+		)
 		if (projectSlug && !project) {
 			return createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)
 		}
@@ -67,12 +100,13 @@ export class MailTemplateMutationResolver implements MutationResolvers {
 		{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,
 		context: TenantResolverContext,
 	): Promise<RemoveMailTemplateResponse> {
-		const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null
-		await context.requireAccess({
-			scope: project ? await context.permissionContext.createProjectScope(project) : undefined,
-			action: PermissionActions.MAIL_TEMPLATE_REMOVE,
-			message: 'You are not allowed to remove a mail template',
-		})
+		const project = await this.requireTemplateAccess(
+			context,
+			projectSlug,
+			type,
+			PermissionActions.MAIL_TEMPLATE_REMOVE,
+			'You are not allowed to remove a mail template',
+		)
 		if (projectSlug && !project) {
 			return createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)
 		}
@@ -83,7 +117,7 @@ export class MailTemplateMutationResolver implements MutationResolvers {
 			type: mailTypeFromSchemaToDb(type),
 		})
 		if (!removed) {
-			return createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')
+			return createErrorResponse('TEMPLATE_NOT_FOUND', 'Mail template not found')
 		}
 
 		await context.logAuthAction({

package/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts

@@ -7,7 +7,7 @@ import {
 } from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'
+import { createPersonPermissionTarget, IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 
 export class ChangePasswordMutationResolver implements MutationResolvers {
@@ -28,7 +28,7 @@ export class ChangePasswordMutationResolver implements MutationResolvers {
 
 		await context.requireAccess({
 			scope: new IdentityScope(person.identity_id),
-			action: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
+			action: PermissionActions.PERSON_CHANGE_PASSWORD(await createPersonPermissionTarget(context.db, person)),
 			message: 'You are not allowed to change password',
 		})
 		const response = await this.passwordChangeManager.changePassword(context.db, person, args.password)

package/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts

@@ -11,12 +11,14 @@ import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
 import {
 	ConfigurationQuery,
+	createPersonPermissionTarget,
 	EmailChangeManager,
 	IdentityScope,
 	PermissionActions,
 	PermissionContextFactory,
 	PersonManager,
 	PersonQuery,
+	ProfileField,
 } from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { normalizeEmail } from '../../../model/utils/email.js'
@@ -42,9 +44,13 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 			return createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')
 		}
 
+		const fields: ProfileField[] = [
+			...(args.name !== undefined ? ['name' as const] : []),
+			...(args.email !== undefined ? ['email' as const] : []),
+		]
 		await context.requireAccess({
 			scope: new IdentityScope(person.identity_id),
-			action: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+			action: PermissionActions.PERSON_CHANGE_PROFILE(await createPersonPermissionTarget(context.db, person), fields),
 			message: 'You are not allowed to change a profile',
 		})
 		const result = await this.personManager.changeProfile(context.db, person, {
@@ -105,10 +111,10 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 		// via the direct path and inherit the old verified status, defeating the sign-in
 		// gate. signup verification ⇒ change verification, regardless of the change flag.
 		if (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {
-			const permissionContext = await this.permissionContextFactory.create(context.db, {
+			const permissionContext = this.permissionContextFactory.create(context.db, {
 				id: person.identity_id,
 				roles: person.roles,
-			})
+			}, context.permissionContext.authorizator)
 			const result = await this.emailChangeManager.requestEmailChange(
 				context.db,
 				permissionContext,