@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/index.js

@@ -4,13 +4,16 @@ import { ProjectAwareIdentity, StaticIdentity } from "./src/model/authorization/
 import { IdentityFactory } from "./src/model/authorization/IdentityFactory.js";
 import { IdentityScope } from "./src/model/authorization/IdentityScope.js";
 import { MembershipMatcher } from "./src/model/authorization/MembershipMatcher.js";
+import { CustomRoleAuthorizator, CustomRolePermissionCache } from "./src/model/authorization/CustomRoleAuthorizator.js";
+import { BUILTIN_TENANT_ROLES, CustomRoleGrantValidationError, GLOBALLY_ASSIGNABLE_BUILTIN_ROLES, buildCustomRolePermissions, getGrantablePermissions, isConfigurationRequired, parseCustomRoleGrants, parsePersistedCustomRoleGrants, parsePersistedCustomRoleReferences } from "./src/model/authorization/CustomRolePermissions.js";
 import { PermissionActions } from "./src/model/authorization/PermissionActions.js";
 import { PermissionContext } from "./src/model/authorization/PermissionContext.js";
 import { PermissionContextFactory } from "./src/model/authorization/PermissionContextFactory.js";
+import { createPersonPermissionTarget, createTargetIdentityPermissionTarget, targetIdentityLoader } from "./src/model/authorization/TargetIdentityPermission.js";
 import { PermissionsFactory } from "./src/model/authorization/PermissionsFactory.js";
 import { ProjectScope } from "./src/model/authorization/ProjectScope.js";
 import { ProjectScopeFactory } from "./src/model/authorization/ProjectScopeFactory.js";
-import { TenantRole } from "./src/model/authorization/Roles.js";
+import { NON_DELEGABLE_TENANT_ROLES, ROLE_SLUG_PATTERN, TenantRole } from "./src/model/authorization/Roles.js";
 import { CreateApiKeyCommand, CreateApiKeyCommandResult } from "./src/model/commands/apiKey/CreateApiKeyCommand.js";
 import { DisableApiKeyCommand } from "./src/model/commands/apiKey/DisableApiKeyCommand.js";
 import { DisableIdentityApiKeysCommand } from "./src/model/commands/apiKey/DisableIdentityApiKeysCommand.js";
@@ -19,6 +22,10 @@ import { PROLONG_THROTTLE_MS, ProlongApiKeyCommand } from "./src/model/commands/
 import { CreateAuthPolicyCommand } from "./src/model/commands/authPolicy/CreateAuthPolicyCommand.js";
 import { UpdateAuthPolicyCommand } from "./src/model/commands/authPolicy/UpdateAuthPolicyCommand.js";
 import { DeleteAuthPolicyCommand } from "./src/model/commands/authPolicy/DeleteAuthPolicyCommand.js";
+import { CreateCustomRoleCommand } from "./src/model/commands/customRole/CreateCustomRoleCommand.js";
+import { DeleteCustomRoleCommand } from "./src/model/commands/customRole/DeleteCustomRoleCommand.js";
+import { RemoveCustomRoleAssignmentsCommand } from "./src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.js";
+import { UpdateCustomRoleCommand } from "./src/model/commands/customRole/UpdateCustomRoleCommand.js";
 import { ConsumeBackupCodeCommand } from "./src/model/commands/backupCode/ConsumeBackupCodeCommand.js";
 import { CreateBackupCodeCommand } from "./src/model/commands/backupCode/CreateBackupCodeCommand.js";
 import { DeleteBackupCodesCommand } from "./src/model/commands/backupCode/DeleteBackupCodesCommand.js";
@@ -42,8 +49,10 @@ import { RemoveMailTemplateCommand } from "./src/model/commands/mailTemplate/Rem
 import { AddProjectMemberCommand } from "./src/model/commands/membership/AddProjectMemberCommand.js";
 import { CreateOrUpdateProjectMembershipCommand } from "./src/model/commands/membership/CreateOrUpdateProjectMembershipCommand.js";
 import { RemoveProjectMemberCommand } from "./src/model/commands/membership/RemoveProjectMemberCommand.js";
+import { RemoveProjectMembershipCommand } from "./src/model/commands/membership/RemoveProjectMembershipCommand.js";
 import { UpdateProjectMemberCommand } from "./src/model/commands/membership/UpdateProjectMemberCommand.js";
 import { PatchProjectMembershipVariablesCommand } from "./src/model/commands/membership/variables/PatchProjectMembershipVariablesCommand.js";
+import { SetProjectMembershipVariableValuesCommand } from "./src/model/commands/membership/variables/SetProjectMembershipVariableValuesCommand.js";
 import { ConfirmOtpCommand } from "./src/model/commands/otp/ConfirmOtpCommand.js";
 import { DisableOtpCommand } from "./src/model/commands/otp/DisableOtpCommand.js";
 import { PrepareOtpCommand } from "./src/model/commands/otp/PrepareOtpCommand.js";
@@ -63,10 +72,12 @@ import { ApiKeyByIdQuery, ApiKeyByTokenQuery } from "./src/model/queries/apiKey/
 import { GlobalApiKeysQuery, ProjectApiKeysQuery } from "./src/model/queries/apiKey/ApiKeyListQuery.js";
 import { ApiKeySessionsByIdentityQuery } from "./src/model/queries/apiKey/ApiKeySessionsQuery.js";
 import { AuthPoliciesQuery } from "./src/model/queries/authPolicy/AuthPoliciesQuery.js";
+import { CustomRolesQuery } from "./src/model/queries/customRole/CustomRolesQuery.js";
 import { ConfigurationQuery } from "./src/model/queries/configuration/ConfigurationQuery.js";
 import { MailTemplateQuery } from "./src/model/queries/mailTemplate/MailTemplateQuery.js";
 import { MailTemplateListQuery } from "./src/model/queries/mailTemplate/MailTemplateListQuery.js";
 import { AllProjectRolesByIdentityQuery } from "./src/model/queries/membership/AllProjectRolesByIdentityQuery.js";
+import { IdentityHasProjectMembershipsQuery } from "./src/model/queries/membership/IdentityHasProjectMembershipsQuery.js";
 import { ProjectMembershipByIdentityQuery } from "./src/model/queries/membership/ProjectMembershipByIdentityQuery.js";
 import { ProjectMembersQuery } from "./src/model/queries/membership/ProjectMembersQuery.js";
 import { ProjectRolesByIdentityQuery } from "./src/model/queries/membership/ProjectRolesByIdentityQuery.js";
@@ -75,11 +86,13 @@ import { PersonByIdPQuery } from "./src/model/queries/person/PersonByIdPQuery.js
 import { PersonQuery } from "./src/model/queries/person/PersonQuery.js";
 import { PersonsQuery } from "./src/model/queries/person/PersonsQuery.js";
 import { IdentityQuery } from "./src/model/queries/identity/IdentityQuery.js";
+import { IdentitiesHoldingRoleCountQuery } from "./src/model/queries/identity/IdentitiesHoldingRoleCountQuery.js";
 import { IdentityProviderBySlugQuery } from "./src/model/queries/idp/IdentityProviderBySlugQuery.js";
 import { IdentityProvidersQuery } from "./src/model/queries/idp/IdentityProvidersQuery.js";
 import { IdpSessionByApiKeyQuery } from "./src/model/queries/idp/IdpSessionByApiKeyQuery.js";
 import { IdpSessionsBySidQuery } from "./src/model/queries/idp/IdpSessionsBySidQuery.js";
 import { IdpSessionsBySubQuery } from "./src/model/queries/idp/IdpSessionsBySubQuery.js";
+import { LocalAuthDisablingIdpsQuery } from "./src/model/queries/idp/LocalAuthDisablingIdpsQuery.js";
 import { PersonIdentityProvidersQuery } from "./src/model/queries/idp/PersonIdentityProvidersQuery.js";
 import { ProjectSecretsQuery } from "./src/model/queries/project/ProjectSecretsQuery.js";
 import { ProjectSecretKeysQuery } from "./src/model/queries/project/ProjectSecretKeysQuery.js";
@@ -92,7 +105,7 @@ import { UserMailer } from "./src/model/mailing/UserMailer.js";
 import { MailType, mailTypeFromDbToSchema, mailTypeFromSchemaToDb } from "./src/model/mailing/type.js";
 import { ApiKeyManager, VerifyErrorCode, VerifyResult } from "./src/model/service/apiKey/ApiKeyManager.js";
 import { ApiKeyService, CreateApiKeyResult } from "./src/model/service/apiKey/ApiKeyService.js";
-import { UNPERSISTED_ROOT_IDENTITY_ID, UnpersistedApiKeyManager } from "./src/model/service/apiKey/UnpersistedApiKeyManager.js";
+import { UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_ROOT_IDENTITY_ID, UnpersistedApiKeyManager, createUnpersistedLoginVerifyResult, isUnpersistedIdentityId } from "./src/model/service/apiKey/UnpersistedApiKeyManager.js";
 import { CaptchaValidator } from "./src/model/service/captcha/CaptchaValidator.js";
 import { HCaptchaProvider } from "./src/model/service/captcha/HCaptchaProvider.js";
 import { RecaptchaV3Provider } from "./src/model/service/captcha/RecaptchaV3Provider.js";
@@ -104,6 +117,10 @@ import { BackchannelLogoutManager } from "./src/model/service/idp/BackchannelLog
 import { IDPRevalidationConfig, REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from "./src/model/service/idp/IDPRevalidation.js";
 import { IDPManager } from "./src/model/service/idp/IDPManager.js";
 import { PersonIdentityProviderManager } from "./src/model/service/idp/PersonIdentityProviderManager.js";
+import { ClaimMapping, ClaimMappingMembership, ClaimMappingRule, ClaimMappingVariable, ClaimValueSource, DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED, findClaimMappingShapeErrors, findRemovedRuleKeys, isRecord, parseClaimMapping } from "./src/model/service/idp/ClaimMapping.js";
+import { evaluateClaimMapping, extractClaimValues, resolveVariableValues } from "./src/model/service/idp/ClaimMappingEvaluator.js";
+import { ClaimMappingMembershipErrorType, validateClaimMappingMembership } from "./src/model/service/idp/ClaimMappingValidation.js";
+import { IDPClaimSyncService } from "./src/model/service/idp/IDPClaimSyncService.js";
 import { IDPResponseError } from "./src/model/service/idp/IDPResponseError.js";
 import { IDPValidationError } from "./src/model/service/idp/IDPValidationError.js";
 import { InvalidIDPConfigurationError } from "./src/model/service/idp/InvalidIDPConfigurationError.js";
@@ -112,6 +129,8 @@ import { OIDCProvider } from "./src/model/service/idp/providers/OIDCProvider.js"
 import { FacebookProvider } from "./src/model/service/idp/providers/FacebookProvider.js";
 import { AuthLogService } from "./src/model/service/AuthLogService.js";
 import { AuthPolicyManager } from "./src/model/service/AuthPolicyManager.js";
+import { CustomRoleManager } from "./src/model/service/CustomRoleManager.js";
+import { GlobalRoleValidator } from "./src/model/service/GlobalRoleValidator.js";
 import { AuthPolicyResolver } from "./src/model/service/AuthPolicyResolver.js";
 import { BackupCodeManager } from "./src/model/service/BackupCodeManager.js";
 import { EmailChangeManager } from "./src/model/service/EmailChangeManager.js";
@@ -125,6 +144,7 @@ import { MailTemplateManager } from "./src/model/service/MailTemplateManager.js"
 import { MembershipValidator } from "./src/model/service/MembershipValidator.js";
 import { OtpAuthenticator } from "./src/model/service/OtpAuthenticator.js";
 import { OtpError, OtpManager } from "./src/model/service/OtpManager.js";
+import { PanelAccessResolver } from "./src/model/service/PanelAccessResolver.js";
 import { PasswordChangeManager } from "./src/model/service/PasswordChangeManager.js";
 import { PasswordResetManager } from "./src/model/service/PasswordResetManager.js";
 import { PersonAccessManager } from "./src/model/service/PersonAccessManager.js";
@@ -206,13 +226,20 @@ export {
   AuthPolicyManager,
   AuthPolicyResolver,
   BASELINE_SIGN_IN_TYPES,
+  BUILTIN_TENANT_ROLES,
   BackchannelLogoutManager,
   BackupCodeManager,
   CaptchaValidator,
   ChangePasswordCommand,
   ChangePasswordMutationResolver,
   ChangeProfileMutationResolver,
+  ClaimMapping,
+  ClaimMappingMembership,
+  ClaimMappingMembershipErrorType,
+  ClaimMappingRule,
+  ClaimMappingVariable,
   ClaimOtpAttemptCommand,
+  ClaimValueSource,
   CommandBus,
   ConfigurationQuery,
   ConfirmOtpCommand,
@@ -223,6 +250,7 @@ export {
   CreateApiKeyResult,
   CreateAuthPolicyCommand,
   CreateBackupCodeCommand,
+  CreateCustomRoleCommand,
   CreateIdentityCommand,
   CreateOrUpdateProjectMembershipCommand,
   CreatePersonCommand,
@@ -231,9 +259,17 @@ export {
   CreateProjectCommand,
   CreateProjectMutationResolver,
   CreateProjectResult,
+  CustomRoleAuthorizator,
+  CustomRoleGrantValidationError,
+  CustomRoleManager,
+  CustomRolePermissionCache,
+  CustomRolesQuery,
+  DEFAULT_SYNC_POLICY,
+  DEFAULT_UNMATCHED,
   DatabaseContext,
   DeleteAuthPolicyCommand,
   DeleteBackupCodesCommand,
+  DeleteCustomRoleCommand,
   DisableApiKeyCommand,
   DisableApiKeyMutationResolver,
   DisableIDPMutationResolver,
@@ -249,8 +285,11 @@ export {
   EmailVerificationMutationResolver,
   EnableIDPMutationResolver,
   FacebookProvider,
+  GLOBALLY_ASSIGNABLE_BUILTIN_ROLES,
   GlobalApiKeysQuery,
+  GlobalRoleValidator,
   HCaptchaProvider,
+  IDPClaimSyncService,
   IDPHandlerRegistry,
   IDPManager,
   IDPMutationResolver,
@@ -258,8 +297,10 @@ export {
   IDPRevalidationConfig,
   IDPSignInManager,
   IDPValidationError,
+  IdentitiesHoldingRoleCountQuery,
   IdentityFactory,
   IdentityGlobalRolesMutationResolver,
+  IdentityHasProjectMembershipsQuery,
   IdentityProviderBySlugQuery,
   IdentityProviderNotFoundError,
   IdentityProvidersQuery,
@@ -277,6 +318,7 @@ export {
   InviteManager,
   InviteMutationResolver,
   InviteResult,
+  LocalAuthDisablingIdpsQuery,
   LoginRiskAnalyzer,
   MAX_OTP_ATTEMPTS,
   MailTemplateListQuery,
@@ -290,6 +332,7 @@ export {
   MembershipValidationError,
   MembershipValidationErrorType,
   MembershipValidator,
+  NON_DELEGABLE_TENANT_ROLES,
   NoPassword,
   NodeMailer,
   OIDCProvider,
@@ -298,6 +341,7 @@ export {
   OtpManager,
   OtpMutationResolver,
   PROLONG_THROTTLE_MS,
+  PanelAccessResolver,
   PasswordChangeManager,
   PasswordHash,
   PasswordPlain,
@@ -342,15 +386,18 @@ export {
   REVALIDATION_DEFAULT_FALLBACK_INTERVAL,
   REVALIDATION_DEFAULT_MIN_INTERVAL,
   REVALIDATION_DEFAULT_SOFT_THRESHOLD,
+  ROLE_SLUG_PATTERN,
   RateLimitCountQuery,
   RateLimiter,
   ReEncryptOtpSecretCommand,
   RecaptchaV3Provider,
   RecordRateLimitEventCommand,
   RegenerateBackupCodesMutationResolver,
+  RemoveCustomRoleAssignmentsCommand,
   RemoveMailTemplateCommand,
   RemoveProjectMemberCommand,
   RemoveProjectMemberMutationResolver,
+  RemoveProjectMembershipCommand,
   ResetPasswordCommand,
   ResetPasswordMutationResolver,
   ResetPersonMfaCommand,
@@ -363,6 +410,7 @@ export {
   SecretsManager,
   SetEmailOtpEnabledCommand,
   SetMfaGraceUntilCommand,
+  SetProjectMembershipVariableValuesCommand,
   SetProjectSecretCommand,
   SetProjectSecretMutationResolver,
   SignInManager,
@@ -380,10 +428,12 @@ export {
   TenantRole,
   TogglePersonPasswordlessCommand,
   TurnstileProvider,
+  UNPERSISTED_LOGIN_IDENTITY_ID,
   UNPERSISTED_ROOT_IDENTITY_ID,
   UnpersistedApiKeyManager,
   UpdateAuthPolicyCommand,
   UpdateConfigurationCommand,
+  UpdateCustomRoleCommand,
   UpdateProjectCommand,
   UpdateProjectMemberCommand,
   UpdateProjectMemberMutationResolver,
@@ -392,16 +442,35 @@ export {
   VerifyErrorCode,
   VerifyResult,
   WebhookMailer,
+  buildCustomRolePermissions,
   computeTokenHash,
   createMailer,
+  createPersonPermissionTarget,
   createResolverContext,
+  createTargetIdentityPermissionTarget,
+  createUnpersistedLoginVerifyResult,
+  evaluateClaimMapping,
+  extractClaimValues,
+  findClaimMappingShapeErrors,
+  findRemovedRuleKeys,
   generateToken,
+  getGrantablePermissions,
   ipPrefix,
+  isConfigurationRequired,
+  isRecord,
   isTokenHash,
+  isUnpersistedIdentityId,
   mailTypeFromDbToSchema,
   mailTypeFromSchemaToDb,
+  parseClaimMapping,
+  parseCustomRoleGrants,
+  parsePersistedCustomRoleGrants,
+  parsePersistedCustomRoleReferences,
+  resolveVariableValues,
+  targetIdentityLoader,
   timingSafeCompareHash,
   default2 as typeDefs,
+  validateClaimMappingMembership,
   validateToken
 };
 //# sourceMappingURL=index.js.map

package/dist/development/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/development/src/TenantContainer.cjs

@@ -4,17 +4,19 @@ const authorization = require("@contember/authorization");
 const dic = require("@contember/dic");
 const AclSchemaAccessNodeFactory = require("./model/authorization/AclSchemaAccessNodeFactory.cjs");
 const IdentityFactory = require("./model/authorization/IdentityFactory.cjs");
+require("./model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("./model/type/ApiKey.cjs");
+require("./model/authorization/CustomRolePermissions.cjs");
 require("./model/authorization/PermissionActions.cjs");
 require("./model/authorization/PermissionContext.cjs");
 const PermissionContextFactory = require("./model/authorization/PermissionContextFactory.cjs");
+require("./model/authorization/TargetIdentityPermission.cjs");
 const PermissionsFactory = require("./model/authorization/PermissionsFactory.cjs");
 require("@contember/schema");
 const ProjectScopeFactory = require("./model/authorization/ProjectScopeFactory.cjs");
-require("./model/type/ApiKey.cjs");
-require("@contember/database");
 const DatabaseContext = require("./model/utils/DatabaseContext.cjs");
 require("node:crypto");
-require("./model/queries/apiKey/ApiKeyQuery.cjs");
 const UserMailer = require("./model/mailing/UserMailer.cjs");
 const ApiKeyManager = require("./model/service/apiKey/ApiKeyManager.cjs");
 const ApiKeyService = require("./model/service/apiKey/ApiKeyService.cjs");
@@ -29,11 +31,16 @@ const BackchannelLogoutManager = require("./model/service/idp/BackchannelLogoutM
 require("./model/service/idp/IDPRevalidation.cjs");
 const IDPManager = require("./model/service/idp/IDPManager.cjs");
 const PersonIdentityProviderManager = require("./model/service/idp/PersonIdentityProviderManager.cjs");
+require("./model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+const IDPClaimSyncService = require("./model/service/idp/IDPClaimSyncService.cjs");
 const AppleProvider = require("./model/service/idp/providers/AppleProvider.cjs");
 const OIDCProvider = require("./model/service/idp/providers/OIDCProvider.cjs");
 const FacebookProvider = require("./model/service/idp/providers/FacebookProvider.cjs");
 const AuthLogService = require("./model/service/AuthLogService.cjs");
 const AuthPolicyManager = require("./model/service/AuthPolicyManager.cjs");
+const CustomRoleManager = require("./model/service/CustomRoleManager.cjs");
+const GlobalRoleValidator = require("./model/service/GlobalRoleValidator.cjs");
 const AuthPolicyResolver = require("./model/service/AuthPolicyResolver.cjs");
 const BackupCodeManager = require("./model/service/BackupCodeManager.cjs");
 const EmailChangeManager = require("./model/service/EmailChangeManager.cjs");
@@ -47,6 +54,7 @@ const MailTemplateManager = require("./model/service/MailTemplateManager.cjs");
 const MembershipValidator = require("./model/service/MembershipValidator.cjs");
 const OtpAuthenticator = require("./model/service/OtpAuthenticator.cjs");
 const OtpManager = require("./model/service/OtpManager.cjs");
+const PanelAccessResolver = require("./model/service/PanelAccessResolver.cjs");
 const PasswordChangeManager = require("./model/service/PasswordChangeManager.cjs");
 const PasswordResetManager = require("./model/service/PasswordResetManager.cjs");
 const PersonAccessManager = require("./model/service/PersonAccessManager.cjs");
@@ -105,6 +113,7 @@ const IDPQueryResolver = require("./resolvers/query/IDPQueryResolver.cjs");
 const UpdateIDPMutationResolver = require("./resolvers/mutation/idp/UpdateIDPMutationResolver.cjs");
 const runner = require("./migrations/runner.cjs");
 const DisablePersonMutationResolver = require("./resolvers/mutation/person/DisablePersonMutationResolver.cjs");
+const EnablePersonMutationResolver = require("./resolvers/mutation/person/EnablePersonMutationResolver.cjs");
 const ForceSignOutMutationResolver = require("./resolvers/mutation/person/ForceSignOutMutationResolver.cjs");
 const RevokeSessionMutationResolver = require("./resolvers/mutation/person/RevokeSessionMutationResolver.cjs");
 const MailTemplateQueryResolver = require("./resolvers/query/MailTemplateQueryResolver.cjs");
@@ -112,6 +121,8 @@ const ConfigurationManager = require("./model/service/ConfigurationManager.cjs")
 const ConfigurationMutationResolver = require("./resolvers/mutation/configuration/ConfigurationMutationResolver.cjs");
 const ConfigurationQueryResolver = require("./resolvers/query/ConfigurationQueryResolver.cjs");
 const AuthPolicyMutationResolver = require("./resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs");
+const CustomRoleMutationResolver = require("./resolvers/mutation/customRole/CustomRoleMutationResolver.cjs");
+const CustomRoleQueryResolver = require("./resolvers/query/CustomRoleQueryResolver.cjs");
 const AuthPolicyQueryResolver = require("./resolvers/query/AuthPolicyQueryResolver.cjs");
 const ResetPersonMfaMutationResolver = require("./resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs");
 const PasswordlessMutationResolver = require("./resolvers/mutation/person/PasswordlessMutationResolver.cjs");
@@ -128,9 +139,11 @@ class TenantContainerFactory {
       "backchannelLogoutManager",
       "projectMemberManager",
       "projectManager",
+      "panelAccessResolver",
       "signUpManager",
       "resolvers",
       "authorizator",
+      "permissionContextFactory",
       "resolverContextFactory",
       "identityFetcher",
       "databaseContext",
@@ -141,25 +154,35 @@ class TenantContainerFactory {
     );
   }
   createBuilder(args) {
-    return new dic.Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => Mailer.createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer.TemplateRenderer()).addService("accessEvaluator", ({}) => new authorization.AccessEvaluator.PermissionEvaluator(new PermissionsFactory.PermissionsFactory().create())).addService("authorizator", ({ accessEvaluator }) => new authorization.Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer.UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService.ApiKeyService()).addService("authPolicyResolver", () => new AuthPolicyResolver.AuthPolicyResolver()).addService("authLogService", () => new AuthLogService.AuthLogService()).addService("loginRiskAnalyzer", ({ providers }) => new LoginRiskAnalyzer.LoginRiskAnalyzer(providers.hash)).addService("idpRegistry", () => {
+    return new dic.Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => Mailer.createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer.TemplateRenderer()).addService("permissions", () => new PermissionsFactory.PermissionsFactory().create()).addService("accessEvaluator", ({ permissions }) => new authorization.AccessEvaluator.PermissionEvaluator(permissions)).addService("authorizator", ({ accessEvaluator }) => new authorization.Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer.UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService.ApiKeyService()).addService("authPolicyResolver", () => new AuthPolicyResolver.AuthPolicyResolver()).addService("panelAccessResolver", ({ providers }) => new PanelAccessResolver.PanelAccessResolver(providers)).addService("authLogService", () => new AuthLogService.AuthLogService()).addService("globalRoleValidator", () => new GlobalRoleValidator.GlobalRoleValidator()).addService("loginRiskAnalyzer", ({ providers }) => new LoginRiskAnalyzer.LoginRiskAnalyzer(providers.hash)).addService("idpRegistry", () => {
       const idpRegistry = new IDPHandlerRegistry.IDPHandlerRegistry();
       idpRegistry.registerHandler("oidc", new OIDCProvider.OIDCProvider());
       idpRegistry.registerHandler("facebook", new FacebookProvider.FacebookProvider());
       idpRegistry.registerHandler("apple", new AppleProvider.AppleProvider());
       return idpRegistry;
-    }).addService("idpSessionRevalidator", ({ idpRegistry }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
+    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService.IDPClaimSyncService(projectSchemaResolver)).addService(
+      "idpSessionRevalidator",
+      ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger)
+    ).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
       tokens: args.tenantCredentials.rootTokens,
       tokenHashes: args.tenantCredentials.rootTokenHashes
     })).addService(
       "apiKeyManager",
-      ({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) => new ApiKeyManager.ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator)
+      ({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator, globalRoleValidator }) => new ApiKeyManager.ApiKeyManager(
+        apiKeyService,
+        authPolicyResolver,
+        authLogService,
+        unpersistedApiKeyManager,
+        idpSessionRevalidator,
+        globalRoleValidator
+      )
     ).addService("signOutManager", ({ apiKeyManager, idpRegistry }) => new SignOutManager.SignOutManager(apiKeyManager, idpRegistry)).addService("emailValidator", () => new EmailValidator.EmailValidator()).addService("hibpChecker", () => new HibpChecker.HttpHibpChecker()).addService("noopHibpChecker", () => new HibpChecker.NoopHibpChecker()).addService("passwordStrengthValidator", ({ hibpChecker }) => new PasswordStrengthValidator.PasswordStrengthValidator(hibpChecker)).addService("captchaValidator", () => new CaptchaValidator.CaptchaValidator({
       turnstile: new TurnstileProvider.TurnstileProvider(),
       hcaptcha: new HCaptchaProvider.HCaptchaProvider(),
       recaptchaV3: new RecaptchaV3Provider.RecaptchaV3Provider()
     })).addService("rateLimiter", ({ providers }) => new RateLimiter.RateLimiter(providers)).addService(
       "signUpManager",
-      ({ emailValidator, passwordStrengthValidator }) => new SignUpManager.SignUpManager(emailValidator, passwordStrengthValidator)
+      ({ emailValidator, passwordStrengthValidator, globalRoleValidator }) => new SignUpManager.SignUpManager(emailValidator, passwordStrengthValidator, globalRoleValidator)
     ).addService("passwordChangeManager", ({ providers, passwordStrengthValidator }) => new PasswordChangeManager.PasswordChangeManager(providers, passwordStrengthValidator)).addService("projectMemberManager", () => new ProjectMemberManager.ProjectMemberManager()).addService("identityFactory", ({ projectMemberManager }) => new IdentityFactory.IdentityFactory(projectMemberManager)).addService("projectScopeFactory", () => new ProjectScopeFactory.ProjectScopeFactory(new AclSchemaAccessNodeFactory.AclSchemaAccessNodeFactory())).addService(
       "permissionContextFactory",
       ({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) => new PermissionContextFactory.PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver)
@@ -172,7 +195,10 @@ class TenantContainerFactory {
     ).addService(
       "emailChangeManager",
       ({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) => new EmailChangeManager.EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory)
-    ).addService("idpSignInManager", ({ apiKeyManager, idpRegistry }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry)).addService("idpManager", ({ idpRegistry }) => new IDPManager.IDPManager(idpRegistry)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager.PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator.OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager.OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager.BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager.EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager.AuthPolicyManager(projectManager)).addService(
+    ).addService(
+      "idpSignInManager",
+      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger)
+    ).addService("idpManager", ({ idpRegistry, projectSchemaResolver }) => new IDPManager.IDPManager(idpRegistry, projectSchemaResolver)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager.PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator.OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager.OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager.BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager.EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager.AuthPolicyManager(projectManager)).addService("customRoleManager", ({ globalRoleValidator }) => new CustomRoleManager.CustomRoleManager(globalRoleValidator)).addService(
       "signInManager",
       ({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) => new SignInManager.SignInManager(
         apiKeyManager,
@@ -184,7 +210,7 @@ class TenantContainerFactory {
         loginRiskAnalyzer,
         userMailer
       )
-    ).addService("membershipValidator", ({ projectSchemaResolver }) => new MembershipValidator.MembershipValidator(projectSchemaResolver)).addService("inviteManager", ({ providers, userMailer, projectSchemaResolver }) => new InviteManager.InviteManager(providers, userMailer, projectSchemaResolver)).addService("mailTemplateManager", () => new MailTemplateManager.MailTemplateManager()).addService("rolesManager", () => new RolesManager.RolesManager()).addService("configurationManager", () => new ConfigurationManager.ConfigurationManager()).addService(
+    ).addService("membershipValidator", ({ projectSchemaResolver }) => new MembershipValidator.MembershipValidator(projectSchemaResolver)).addService("inviteManager", ({ providers, userMailer, projectSchemaResolver }) => new InviteManager.InviteManager(providers, userMailer, projectSchemaResolver)).addService("mailTemplateManager", () => new MailTemplateManager.MailTemplateManager()).addService("rolesManager", ({ globalRoleValidator }) => new RolesManager.RolesManager(globalRoleValidator)).addService("configurationManager", () => new ConfigurationManager.ConfigurationManager()).addService(
       "passwordlessSignInManager",
       ({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) => new PasswordlessSignInManager.PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager)
     ).addService(
@@ -253,6 +279,9 @@ class TenantContainerFactory {
     ).addService("createProjectMutationResolver", ({ projectManager }) => new CreateProjectMutationResolver.CreateProjectMutationResolver(projectManager)).addService(
       "disablePersonMutationResolver",
       ({ personAccessManager, personManager }) => new DisablePersonMutationResolver.DisablePersonMutationResolver(personAccessManager, personManager)
+    ).addService(
+      "enablePersonMutationResolver",
+      ({ personAccessManager, personManager }) => new EnablePersonMutationResolver.EnablePersonMutationResolver(personAccessManager, personManager)
     ).addService(
       "forceSignOutMutationResolver",
       ({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver.ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer)
@@ -265,7 +294,7 @@ class TenantContainerFactory {
     ).addService("updateProjectMutationResolver", ({ projectManager }) => new UpdateProjectMutationResolver.UpdateProjectMutationResolver(projectManager)).addService(
       "setProjectSecretMutationResolver",
       ({ projectManager, secretManager }) => new SetProjectSecretMutationResolver.SetProjectSecretMutationResolver(projectManager, secretManager)
-    ).addService("identityGlobalRolesMutationResolver", ({ rolesManager }) => new GlobalRolesMutationResolver.IdentityGlobalRolesMutationResolver(rolesManager)).addService("configurationMutationResolver", ({ configurationManager }) => new ConfigurationMutationResolver.ConfigurationMutationResolver(configurationManager)).addService("configurationQueryResolver", ({ configurationManager }) => new ConfigurationQueryResolver.ConfigurationQueryResolver(configurationManager)).addService("authPolicyMutationResolver", ({ authPolicyManager }) => new AuthPolicyMutationResolver.AuthPolicyMutationResolver(authPolicyManager)).addService("authPolicyQueryResolver", ({ authPolicyManager }) => new AuthPolicyQueryResolver.AuthPolicyQueryResolver(authPolicyManager)).addService("authLogQueryResolver", () => new AuthLogQueryResolver.AuthLogQueryResolver()).addService("apiKeyQueryResolver", () => new ApiKeyQueryResolver.ApiKeyQueryResolver()).addService(
+    ).addService("identityGlobalRolesMutationResolver", ({ rolesManager }) => new GlobalRolesMutationResolver.IdentityGlobalRolesMutationResolver(rolesManager)).addService("configurationMutationResolver", ({ configurationManager }) => new ConfigurationMutationResolver.ConfigurationMutationResolver(configurationManager)).addService("configurationQueryResolver", ({ configurationManager }) => new ConfigurationQueryResolver.ConfigurationQueryResolver(configurationManager)).addService("authPolicyMutationResolver", ({ authPolicyManager }) => new AuthPolicyMutationResolver.AuthPolicyMutationResolver(authPolicyManager)).addService("authPolicyQueryResolver", ({ authPolicyManager }) => new AuthPolicyQueryResolver.AuthPolicyQueryResolver(authPolicyManager)).addService("customRoleMutationResolver", ({ customRoleManager }) => new CustomRoleMutationResolver.CustomRoleMutationResolver(customRoleManager)).addService("customRoleQueryResolver", ({ customRoleManager }) => new CustomRoleQueryResolver.CustomRoleQueryResolver(customRoleManager)).addService("authLogQueryResolver", () => new AuthLogQueryResolver.AuthLogQueryResolver()).addService("apiKeyQueryResolver", () => new ApiKeyQueryResolver.ApiKeyQueryResolver()).addService(
       "passwordlessMutationResolver",
       ({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) => new PasswordlessMutationResolver.PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter)
     ).addService(