@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/service/idp/providers/OIDCHelpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/** Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(acc, key) => (acc != null && typeof acc === 'object' ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec). Then optionally lift a\n\t\t// nested attributes object to the top level so providers that nest their claims (notably\n\t\t// Apereo CAS userinfo, which returns them under `attributes`) map without a code change.\n\t\t// The nested attributes are UNSIGNED, so they must not override a claim already present in\n\t\t// the (signature-verified) ID-token / userInfo merge — spread them UNDER `source`, not over\n\t\t// it, so a signed `sub` / `email_verified` keeps precedence over an attributes-level value.\n\t\tlet source: Record<string, unknown> = { ...claimsWithoutHashes, ...userInfo }\n\t\tconst attributesKey = claimMapping?.attributesKey\n\t\tif (attributesKey) {\n\t\t\tconst nested = source[attributesKey]\n\t\t\tif (nested && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\t\t\tsource = { ...(nested as Record<string, unknown>), ...source }\n\t\t\t}\n\t\t}\n\n\t\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\t\tconst rawEmailVerified = source.email_verified\n\t\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\t\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\t\tlet externalIdentifier: string\n\t\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\t\texternalIdentifier = claims.sub\n\t\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\t\texternalIdentifier = String(mappedSubject)\n\t\t} else {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t\t}\n\t\tif (externalIdentifier === '') {\n\t\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t\t}\n\n\t\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\t\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\t\tconst name = getClaim(source, claimMapping?.name ?? 'name')\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...source,\n\t\t\texternalIdentifier,\n\t\t\temail: typeof email === 'string' ? email : undefined,\n\t\t\tname: typeof name === 'string' ? name : undefined,\n\t\t\temailVerified,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n): Promise<RevalidationResult> => {\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = tokenSet.id_token ? tokenSet.claims() : undefined\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\treturn { status: 'valid', claims: userInfo }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":[],"mappings":";;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAUA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CAAC,KAAK,QAAS,OAAO,QAAQ,OAAO,QAAQ,WAAY,IAAgC,GAAG,IAAI;AAAA,EAChG;AACD;AAEM,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAQ9H,QAAI,SAAkC,EAAE,GAAG,qBAAqB,GAAG,SAAA;AACnE,UAAM,gBAAgB,cAAc;AACpC,QAAI,eAAe;AAClB,YAAM,SAAS,OAAO,aAAa;AACnC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AACnE,iBAAS,EAAE,GAAI,QAAoC,GAAG,OAAA;AAAA,MACvD;AAAA,IACD;AAIA,UAAM,mBAAmB,OAAO;AAChC,UAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,UAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,QAAI;AACJ,QAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,2BAAqB,OAAO;AAAA,IAC7B,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,2BAAqB,OAAO,aAAa;AAAA,IAC1C,OAAO;AACN,YAAM,IAAI,mBAAmB,2DAA2D;AAAA,IACzF;AACA,QAAI,uBAAuB,IAAI;AAC9B,YAAM,IAAI,mBAAmB,gEAAgE;AAAA,IAC9F;AAMA,UAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,UAAM,OAAO,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAE1D,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH;AAAA,MACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,MAC3C,MAAM,OAAO,SAAS,WAAW,OAAO;AAAA,MACxC;AAAA,MACA,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,YACiC;AACjC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,WAAW,SAAS,OAAA,IAAW;AAAA,MAClD,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAA;AAAA,IACnC;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAO,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAI,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAI,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAI,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAI,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAI,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAI,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;"}
+{"version":3,"file":"OIDCHelpers.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCHelpers.ts"],"sourcesContent":["import { Client, custom, errors, generators, Issuer, TokenSet } from 'openid-client'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { OIDCClaimMapping, OIDCResponseData } from './OIDCTypes.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { IDPResponseError } from '../IDPResponseError.js'\nimport {\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\n\n/**\n * Build the persisted session state from an OIDC token set. Stores the tokens needed for\n * later re-validation (refresh/access) and SLO (id_token); the whole `tokens` blob is\n * encrypted at rest by the command layer.\n *\n * `prevTokens` carries the previously stored tokens forward: a refresh-grant response MAY omit\n * the refresh token (RFC 6749 §6 — IdPs that don't rotate just don't re-send it), in which case\n * the client must keep using the old one. Without this fallback a non-rotating IdP would persist\n * a session with no refresh token and be revoked (`no_refresh_token`) on the very next tick.\n */\nexport const tokenSetToSessionState = (tokenSet: TokenSet, sessionId?: string, prevTokens?: Record<string, unknown>): IDPSessionState => {\n\tconst refreshToken = tokenSet.refresh_token ?? (typeof prevTokens?.refresh_token === 'string' ? prevTokens.refresh_token : undefined)\n\tconst idToken = tokenSet.id_token ?? (typeof prevTokens?.id_token === 'string' ? prevTokens.id_token : undefined)\n\treturn {\n\t\tsessionId,\n\t\ttokens: {\n\t\t\t...(refreshToken ? { refresh_token: refreshToken } : {}),\n\t\t\t...(tokenSet.access_token ? { access_token: tokenSet.access_token } : {}),\n\t\t\t...(idToken ? { id_token: idToken } : {}),\n\t\t},\n\t\texpiresAt: tokenSet.expires_at ? new Date(tokenSet.expires_at * 1000) : undefined,\n\t}\n}\n\nexport const initOIDCAuth = async (\n\tclient: Client,\n\t{ redirectUrl, scope, responseMode }: { redirectUrl: string; scope?: string; responseMode?: string },\n): Promise<InitIDPAuthResult> => {\n\tconst nonce = generators.nonce()\n\tconst state = generators.state()\n\tconst url = client.authorizationUrl({\n\t\tredirect_uri: redirectUrl,\n\t\tresponse_mode: responseMode,\n\t\tscope: scope ?? 'openid email',\n\t\tnonce,\n\t\tstate,\n\t})\n\n\treturn {\n\t\tauthUrl: url,\n\t\tsessionData: { nonce, state },\n\t}\n}\n\nexport type HandleOIDCResponseOptions = {\n\tfetchUserInfo?: boolean\n\treturnOIDCResult?: boolean\n\tcaptureSession?: boolean\n\tclaimMapping?: OIDCClaimMapping\n}\n\n/**\n * Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). Own-property only at every\n * segment (mirrors `ClaimMappingEvaluator.resolvePath`): a configured path must never descend into an\n * inherited member, so a `__proto__` / `constructor` segment cannot surface an `Object.prototype` value\n * as the externalIdentifier / email / name.\n */\nconst getClaim = (source: Record<string, unknown>, path: string): unknown =>\n\tpath.split('.').reduce<unknown>(\n\t\t(\n\t\t\tacc,\n\t\t\tkey,\n\t\t) => (acc != null && typeof acc === 'object' && Object.prototype.hasOwnProperty.call(acc, key) ? (acc as Record<string, unknown>)[key] : undefined),\n\t\tsource,\n\t)\n\n/**\n * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the\n * top level so providers that nest their claims map without a code change. The nested attributes are\n * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an\n * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the\n * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an\n * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.\n */\nexport const liftNestedClaims = (source: Record<string, unknown>, attributesKey: string | undefined): Record<string, unknown> => {\n\tif (!attributesKey) {\n\t\treturn source\n\t}\n\tconst nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : undefined\n\tif (nested !== null && typeof nested === 'object' && !Array.isArray(nested)) {\n\t\treturn { ...nested, ...source }\n\t}\n\treturn source\n}\n\ntype NormalizedClaims = Record<string, unknown> & {\n\texternalIdentifier: string\n\temail: string | undefined\n\tname: string | undefined\n\temailVerified: boolean\n}\n\n/**\n * Build the normalized claim surface shared by sign-in ({@link handleOIDCResponse}) and session refresh\n * ({@link revalidateOIDC}): lift any configured nested attributes object to the top level, then layer the\n * mapped identity fields (`externalIdentifier` / `email` / `name` / `emailVerified`) over the raw claims.\n * BOTH paths run this SAME normalization so an A09 claim-mapping rule resolves identically whether it\n * targets a raw provider claim or one of the normalized identity fields — without it the two surfaces\n * diverged (refresh saw the raw claim, sign-in the mapped value).\n *\n * `subFallback` is the signature-verified ID-token `sub`, used when a custom `externalIdentifier` mapping\n * resolves to nothing: at sign-in it is guaranteed present; on refresh it is the refreshed id-token's `sub`\n * (or, for the userinfo method, the userinfo `sub`). Throws (account-takeover guard) when the mapped\n * subject is a non-scalar or resolves empty — the refresh caller catches this and skips the sync.\n */\nconst normalizeClaims = (\n\trawSource: Record<string, unknown>,\n\tclaimMapping: OIDCClaimMapping | undefined,\n\tsubFallback: string | undefined,\n): NormalizedClaims => {\n\tconst source = liftNestedClaims(rawSource, claimMapping?.attributesKey)\n\n\t// The OIDC `email_verified` claim is a boolean per spec, but some providers send the\n\t// string \"true\". userInfo (and any unwrapped attributes) take precedence over the ID token.\n\tconst rawEmailVerified = source.email_verified\n\tconst emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'\n\n\t// `externalIdentifier` is the federation key persisted in `person_identity_provider` and\n\t// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed\n\t// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /\n\t// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail\n\t// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).\n\tconst mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')\n\tlet externalIdentifier: string\n\tif (mappedSubject === undefined || mappedSubject === null) {\n\t\texternalIdentifier = subFallback ?? ''\n\t} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {\n\t\texternalIdentifier = String(mappedSubject)\n\t} else {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)\n\t}\n\tif (externalIdentifier === '') {\n\t\tthrow new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)\n\t}\n\n\t// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail\n\t// account lookup (which crashes on a non-string). `...source` already placed the raw claim\n\t// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is\n\t// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.\n\tconst email = getClaim(source, claimMapping?.email ?? 'email')\n\tconst name = resolveName(source, claimMapping)\n\n\treturn {\n\t\t...source,\n\t\texternalIdentifier,\n\t\temail: typeof email === 'string' ? email : undefined,\n\t\tname,\n\t\temailVerified,\n\t}\n}\n\n/**\n * Resolve the display name, falling back to `given_name` + `family_name` when there is no usable\n * `name` claim.\n *\n * `name` is optional in OIDC core and plenty of providers omit it while sending the parts — Apereo\n * CAS and Entra ID do, and so does Keycloak under its default mappers. Without the fallback,\n * `CreatePersonCommand` lands on its own last-resort default and a federated person ends up named\n * after the local part of their e-mail (`jan.novak`) despite the IdP having reported \"Jan Novák\".\n * A single-path `claimMapping.name` cannot express this: the value has to be composed from two\n * claims, not selected from one.\n *\n * An explicitly configured `claimMapping.name` is honoured as-is, fallback included — mapping a\n * claim is a statement about where the name lives, and quietly substituting a different source\n * would defeat it. A blank claim counts as absent: an empty string is not a display name, and\n * treating it as one would keep the fallback (and `CreatePersonCommand`'s) from ever running.\n */\nconst resolveName = (source: Record<string, unknown>, claimMapping: OIDCClaimMapping | undefined): string | undefined => {\n\tconst mapped = getClaim(source, claimMapping?.name ?? 'name')\n\tif (typeof mapped === 'string' && mapped.trim() !== '') {\n\t\treturn mapped\n\t}\n\tif (claimMapping?.name !== undefined) {\n\t\treturn undefined\n\t}\n\tconst parts = [getClaim(source, 'given_name'), getClaim(source, 'family_name')]\n\t\t.filter((part): part is string => typeof part === 'string' && part.trim() !== '')\n\t\t.map(part => part.trim())\n\treturn parts.length > 0 ? parts.join(' ') : undefined\n}\n\nexport const handleOIDCResponse = async (\n\tclient: Client,\n\t{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,\n\t{ fetchUserInfo, returnOIDCResult, captureSession, claimMapping }: HandleOIDCResponseOptions = {},\n): Promise<IDPResponse> => {\n\tconst params = 'parameters' in otherData ? otherData.parameters : client.callbackParams(otherData.url)\n\tif (params.state && !sessionData?.state) {\n\t\tthrow new IDPValidationError(`state is present in parameters, but missing in session data`)\n\t}\n\ttry {\n\t\tconst result = await client.callback(redirectUrl, params, sessionData)\n\t\tconst claims = result.claims()\n\t\tconst { at_hash, c_hash, nonce, ...claimsWithoutHashes } = claims\n\t\tconst userInfo = result.access_token && fetchUserInfo ? await client.userinfo(result) : {}\n\t\tconst oidcResult = returnOIDCResult ? result : {}\n\t\tconst idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined\n\n\t\t// Merge ID-token claims with userInfo (userInfo wins, per spec), then normalize the surface (lift\n\t\t// nested attributes + map the identity fields). The refresh path runs the SAME normalization, so a\n\t\t// claim mapping resolves identically at sign-in and on refresh. The default `sub` fallback is safe —\n\t\t// openid-client guarantees `sub` is a string.\n\t\tconst normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub)\n\n\t\treturn {\n\t\t\t...oidcResult,\n\t\t\t...normalized,\n\t\t\t...(idpSession ? { idpSession } : {}),\n\t\t}\n\t} catch (e: any) {\n\t\tif (e instanceof errors.RPError) {\n\t\t\tthrow new IDPValidationError(e.message)\n\t\t}\n\t\tif (e instanceof errors.OPError) {\n\t\t\tconst body = e.response?.body as any\n\t\t\tif (typeof body === 'object' && typeof body?.error === 'object' && typeof body.error?.message === 'string') {\n\t\t\t\tthrow new IDPResponseError(body.error.message)\n\t\t\t}\n\t\t\tthrow new IDPResponseError(e.message)\n\t\t}\n\t\tthrow e\n\t}\n}\n\n/** OIDC errors that definitively mean \"this session is no longer valid at the IdP\". */\nconst REVOKED_OIDC_ERRORS = new Set(['invalid_grant', 'invalid_token', 'expired_token'])\n\n/**\n * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive\n * IdP responses (invalid/expired grant or inactive introspection). Transient failures\n * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP\n * downtime must not log everyone out.\n */\nexport const revalidateOIDC = async (\n\tclient: Client,\n\tmethod: 'refresh' | 'userinfo' | 'introspection',\n\tsession: IDPSessionState,\n\toptions: { claimMapping?: OIDCClaimMapping; fetchUserInfo?: boolean } = {},\n): Promise<RevalidationResult> => {\n\tconst { claimMapping, fetchUserInfo } = options\n\tconst tokens = session.tokens ?? {}\n\tconst refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined\n\tconst accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined\n\ttry {\n\t\tif (method === 'refresh') {\n\t\t\tif (!refreshToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_refresh_token' }\n\t\t\t}\n\t\t\tconst tokenSet = await client.refresh(refreshToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\tlet claimsComplete = false\n\t\t\ttry {\n\t\t\t\t// Reconstruct the SAME claim surface sign-in builds (handleOIDCResponse): the refreshed id-token\n\t\t\t\t// claims merged with userInfo when `fetchUserInfo` is set — exactly as at sign-in — then the shared\n\t\t\t\t// normalization (lift nested attributes + map identity fields). An `always` mapping therefore\n\t\t\t\t// reconciles against an identical surface on refresh, so `claimsComplete` lets the caller enable\n\t\t\t\t// `unmatched: \"remove\"` reconciliation here too (see IdpSessionRevalidator).\n\t\t\t\tif (tokenSet.id_token) {\n\t\t\t\t\tconst idClaims = tokenSet.claims()\n\t\t\t\t\tconst userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {}\n\t\t\t\t\tclaims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === 'string' ? idClaims.sub : undefined)\n\t\t\t\t\tclaimsComplete = true\n\t\t\t\t}\n\t\t\t} catch {\n\t\t\t\t// Building the surface failed (userinfo unreachable, a non-scalar `externalIdentifier`, …). The IdP\n\t\t\t\t// already vouched for the session via the successful refresh, so KEEP it — just skip the claim sync\n\t\t\t\t// this tick (no claims → no grant, no removal) and retry on a later refresh. Leaving claimsComplete\n\t\t\t\t// false also guarantees a half-built surface can never drive a removal.\n\t\t\t\tclaims = undefined\n\t\t\t\tclaimsComplete = false\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tstatus: 'valid',\n\t\t\t\tclaims,\n\t\t\t\tclaimsComplete,\n\t\t\t\t// carry the stored tokens forward: a non-rotating IdP omits the refresh token here\n\t\t\t\tidpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),\n\t\t\t}\n\t\t}\n\t\tif (method === 'userinfo') {\n\t\t\tif (!accessToken) {\n\t\t\t\treturn { status: 'revoked', reason: 'no_access_token' }\n\t\t\t}\n\t\t\tconst userInfo = await client.userinfo(accessToken)\n\t\t\tlet claims: Record<string, unknown> | undefined\n\t\t\ttry {\n\t\t\t\tclaims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === 'string' ? userInfo.sub : undefined)\n\t\t\t} catch {\n\t\t\t\tclaims = undefined\n\t\t\t}\n\t\t\t// A userinfo probe carries no id-token claims, so its surface is NARROWER than sign-in's (id-token +\n\t\t\t// userinfo): a rule keyed on an id-token-only claim would miss here. Keep refresh-time sync additive-only\n\t\t\t// (`claimsComplete: false`) so `unmatched: \"remove\"` never strips a membership off this partial surface.\n\t\t\treturn { status: 'valid', claims, claimsComplete: false }\n\t\t}\n\t\t// introspection\n\t\tconst token = accessToken ?? refreshToken\n\t\tif (!token) {\n\t\t\treturn { status: 'revoked', reason: 'no_token' }\n\t\t}\n\t\tconst result = await client.introspect(token, accessToken ? 'access_token' : 'refresh_token')\n\t\tif (!result.active) {\n\t\t\treturn { status: 'revoked', reason: 'inactive' }\n\t\t}\n\t\treturn { status: 'valid' }\n\t} catch (e: any) {\n\t\tif (e instanceof errors.OPError) {\n\t\t\tif (typeof e.error === 'string' && REVOKED_OIDC_ERRORS.has(e.error)) {\n\t\t\t\treturn { status: 'revoked', reason: e.error }\n\t\t\t}\n\t\t\t// The userinfo endpoint signals a rejected access token with a bare HTTP 401 — per\n\t\t\t// RFC 6750 the `WWW-Authenticate` error code is optional, so openid-client may not\n\t\t\t// surface a parseable `error` here. A 401 is still definitive: the token is no\n\t\t\t// longer accepted → revoked. (Introspection is NOT treated this way: it returns 200\n\t\t\t// `{active:false}` for revoked tokens, so a 401/400 there means client-auth/config\n\t\t\t// failure — transient, must not log users out.)\n\t\t\tif (method === 'userinfo' && e.response?.statusCode === 401) {\n\t\t\t\treturn { status: 'revoked', reason: 'userinfo_unauthorized' }\n\t\t\t}\n\t\t}\n\t\t// transient (network / IdP unavailable) — propagate, do not revoke\n\t\tthrow e\n\t}\n}\n\n/**\n * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null\n * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only\n * logout (legacy-IdP graceful fallback). The `id_token_hint` lets the IdP identify and confirm the\n * session to terminate; `post_logout_redirect_uri` is where the IdP returns the browser afterwards.\n */\nexport const buildOIDCLogoutUrl = (client: Client, { idToken, postLogoutRedirectUri }: LogoutUrlRequest): string | null => {\n\tif (!client.issuer.metadata.end_session_endpoint) {\n\t\treturn null\n\t}\n\treturn client.endSessionUrl({\n\t\t...(idToken ? { id_token_hint: idToken } : {}),\n\t\t...(postLogoutRedirectUri ? { post_logout_redirect_uri: postLogoutRedirectUri } : {}),\n\t})\n}\n\n/**\n * The OIDC Back-Channel Logout 1.0 event member that MUST be present in a logout token's `events`\n * claim. Its presence (and the absence of a `nonce`) is what distinguishes a logout token from an\n * ID token — both are signed by the same IdP, so without this check an ID token could be replayed\n * to forcibly log a user out.\n */\nconst BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout'\n\n/**\n * Max accepted age of a back-channel logout token, derived from its `iat`. OIDC Back-Channel Logout\n * tokens are single-use and short-lived; bounding the age (together with requiring `exp`) limits the\n * window in which a captured token could be replayed to force a logout.\n */\nconst LOGOUT_TOKEN_MAX_AGE_SECONDS = 120\nconst LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS = 5\n\n/**\n * Remote JWKS sets keyed by `jwks_uri`. `createRemoteJWKSet` returns a function with its own internal\n * key cache + fetch cooldown, so it MUST be reused across requests — re-creating it per call (as the\n * unauthenticated back-channel endpoint would otherwise do) defeats the cache and turns every request\n * into a potential outbound JWKS fetch. Keyed by URL, so two providers sharing an IdP share the set.\n */\nconst remoteJwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>()\n\nconst getRemoteJwks = (jwksUri: string): ReturnType<typeof createRemoteJWKSet> => {\n\tlet jwks = remoteJwksCache.get(jwksUri)\n\tif (!jwks) {\n\t\tjwks = createRemoteJWKSet(new URL(jwksUri))\n\t\tremoteJwksCache.set(jwksUri, jwks)\n\t}\n\treturn jwks\n}\n\n/**\n * Validate an OIDC back-channel logout token (OIDC Back-Channel Logout 1.0 §2.4–2.6) and extract\n * the targeted `sid` / `sub`. The token is a JWT signed by the IdP; we verify the signature against\n * the issuer's JWKS and enforce the issuer + audience (client_id) the same way ID tokens are\n * verified, pinning the signing algorithm to the provider's configured one, then assert the\n * back-channel-specific claims:\n *   - `iat` is present and recent and `exp` is present (§2.4 requires both) — bounds the replay window;\n *   - `events` contains the back-channel-logout member (it really is a logout token);\n *   - it carries a `sid` and/or `sub` (otherwise there is nothing to act on);\n *   - it does NOT carry a `nonce` (a `nonce` means it is an ID token being replayed).\n * Throws {@link IDPValidationError} on any failure so the caller can answer 400.\n */\nexport const validateOIDCLogoutToken = async (client: Client, issuer: Issuer<Client>, logoutToken: string): Promise<LogoutTokenClaims> => {\n\tconst jwksUri = issuer.metadata.jwks_uri\n\tif (!jwksUri) {\n\t\tthrow new IDPValidationError('IdP has no jwks_uri; cannot verify logout token')\n\t}\n\tconst clientId = client.metadata.client_id\n\tif (typeof clientId !== 'string' || clientId === '') {\n\t\t// The `aud` check is a core anti-token-substitution defence on this unauthenticated endpoint.\n\t\t// jose treats `audience: undefined` as \"skip the aud check entirely\", so a missing client_id\n\t\t// must fail closed (reject the token) rather than fall through and accept any audience.\n\t\tthrow new IDPValidationError('cannot verify logout token audience: client_id is missing')\n\t}\n\tconst expectedAlg = typeof client.metadata.id_token_signed_response_alg === 'string'\n\t\t? client.metadata.id_token_signed_response_alg\n\t\t: 'RS256'\n\tconst jwks = getRemoteJwks(jwksUri)\n\tlet payload: Record<string, unknown>\n\ttry {\n\t\tconst verified = await jwtVerify(logoutToken, jwks, {\n\t\t\tissuer: issuer.metadata.issuer,\n\t\t\taudience: clientId,\n\t\t\t// pin to the provider's configured signing alg so a JWKS containing a symmetric/none key\n\t\t\t// can never be selected (defence-in-depth on top of jose's own key-type check).\n\t\t\talgorithms: [expectedAlg],\n\t\t\t// §2.4: `iat` and `exp` are REQUIRED. `maxTokenAge` makes `iat` required + bounds freshness;\n\t\t\t// `requiredClaims` makes `exp` required (jose only checks `exp` when present).\n\t\t\tmaxTokenAge: LOGOUT_TOKEN_MAX_AGE_SECONDS,\n\t\t\trequiredClaims: ['exp'],\n\t\t\tclockTolerance: LOGOUT_TOKEN_CLOCK_TOLERANCE_SECONDS,\n\t\t})\n\t\tpayload = verified.payload as Record<string, unknown>\n\t} catch (e: any) {\n\t\tthrow new IDPValidationError(`Invalid logout token: ${e?.message ?? 'verification failed'}`)\n\t}\n\n\t// A logout token MUST NOT contain a nonce; its presence means an ID token is being replayed.\n\tif ('nonce' in payload) {\n\t\tthrow new IDPValidationError('Logout token must not contain a nonce')\n\t}\n\n\tconst events = payload.events\n\tconst hasLogoutEvent = typeof events === 'object' && events !== null && BACKCHANNEL_LOGOUT_EVENT in (events as Record<string, unknown>)\n\tif (!hasLogoutEvent) {\n\t\tthrow new IDPValidationError('Logout token is missing the back-channel-logout event')\n\t}\n\n\tconst sid = typeof payload.sid === 'string' ? payload.sid : undefined\n\tconst sub = typeof payload.sub === 'string' ? payload.sub : undefined\n\tif (!sid && !sub) {\n\t\tthrow new IDPValidationError('Logout token must contain a sid or sub claim')\n\t}\n\n\treturn { sid, sub }\n}\n"],"names":[],"mappings":";;;;AAwBO,MAAM,yBAAyB,CAAC,UAAoB,WAAoB,eAA0D;AACxI,QAAM,eAAe,SAAS,kBAAkB,OAAO,YAAY,kBAAkB,WAAW,WAAW,gBAAgB;AAC3H,QAAM,UAAU,SAAS,aAAa,OAAO,YAAY,aAAa,WAAW,WAAW,WAAW;AACvG,SAAO;AAAA,IACN;AAAA,IACA,QAAQ;AAAA,MACP,GAAI,eAAe,EAAE,eAAe,aAAA,IAAiB,CAAA;AAAA,MACrD,GAAI,SAAS,eAAe,EAAE,cAAc,SAAS,aAAA,IAAiB,CAAA;AAAA,MACtE,GAAI,UAAU,EAAE,UAAU,YAAY,CAAA;AAAA,IAAC;AAAA,IAExC,WAAW,SAAS,aAAa,IAAI,KAAK,SAAS,aAAa,GAAI,IAAI;AAAA,EAAA;AAE1E;AAEO,MAAM,eAAe,OAC3B,QACA,EAAE,aAAa,OAAO,mBACU;AAChC,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,QAAQ,WAAW,MAAA;AACzB,QAAM,MAAM,OAAO,iBAAiB;AAAA,IACnC,cAAc;AAAA,IACd,eAAe;AAAA,IACf,OAAO,SAAS;AAAA,IAChB;AAAA,IACA;AAAA,EAAA,CACA;AAED,SAAO;AAAA,IACN,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,MAAA;AAAA,EAAM;AAE9B;AAeA,MAAM,WAAW,CAAC,QAAiC,SAClD,KAAK,MAAM,GAAG,EAAE;AAAA,EACf,CACC,KACA,QACK,OAAO,QAAQ,OAAO,QAAQ,YAAY,OAAO,UAAU,eAAe,KAAK,KAAK,GAAG,IAAK,IAAgC,GAAG,IAAI;AAAA,EACzI;AACD;AAUM,MAAM,mBAAmB,CAAC,QAAiC,kBAA+D;AAChI,MAAI,CAAC,eAAe;AACnB,WAAO;AAAA,EACR;AACA,QAAM,SAAS,OAAO,UAAU,eAAe,KAAK,QAAQ,aAAa,IAAI,OAAO,aAAa,IAAI;AACrG,MAAI,WAAW,QAAQ,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC5E,WAAO,EAAE,GAAG,QAAQ,GAAG,OAAA;AAAA,EACxB;AACA,SAAO;AACR;AAsBA,MAAM,kBAAkB,CACvB,WACA,cACA,gBACsB;AACtB,QAAM,SAAS,iBAAiB,WAAW,cAAc,aAAa;AAItE,QAAM,mBAAmB,OAAO;AAChC,QAAM,gBAAgB,qBAAqB,QAAQ,qBAAqB;AAOxE,QAAM,gBAAgB,SAAS,QAAQ,cAAc,sBAAsB,KAAK;AAChF,MAAI;AACJ,MAAI,kBAAkB,UAAa,kBAAkB,MAAM;AAC1D,yBAAqB,eAAe;AAAA,EACrC,WAAW,OAAO,kBAAkB,YAAY,OAAO,kBAAkB,UAAU;AAClF,yBAAqB,OAAO,aAAa;AAAA,EAC1C,OAAO;AACN,UAAM,IAAI,mBAAmB,2DAA2D;AAAA,EACzF;AACA,MAAI,uBAAuB,IAAI;AAC9B,UAAM,IAAI,mBAAmB,gEAAgE;AAAA,EAC9F;AAMA,QAAM,QAAQ,SAAS,QAAQ,cAAc,SAAS,OAAO;AAC7D,QAAM,OAAO,YAAY,QAAQ,YAAY;AAE7C,SAAO;AAAA,IACN,GAAG;AAAA,IACH;AAAA,IACA,OAAO,OAAO,UAAU,WAAW,QAAQ;AAAA,IAC3C;AAAA,IACA;AAAA,EAAA;AAEF;AAkBA,MAAM,cAAc,CAAC,QAAiC,iBAAmE;AACxH,QAAM,SAAS,SAAS,QAAQ,cAAc,QAAQ,MAAM;AAC5D,MAAI,OAAO,WAAW,YAAY,OAAO,KAAA,MAAW,IAAI;AACvD,WAAO;AAAA,EACR;AACA,MAAI,cAAc,SAAS,QAAW;AACrC,WAAO;AAAA,EACR;AACA,QAAM,QAAQ,CAAC,SAAS,QAAQ,YAAY,GAAG,SAAS,QAAQ,aAAa,CAAC,EAC5E,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,WAAW,EAAE,EAC/E,IAAI,CAAA,SAAQ,KAAK,KAAA,CAAM;AACzB,SAAO,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,IAAI;AAC7C;AAEO,MAAM,qBAAqB,OACjC,QACA,EAAE,aAAa,aAAa,GAAG,aAC/B,EAAE,eAAe,kBAAkB,gBAAgB,aAAA,IAA4C,CAAA,MACrE;AAC1B,QAAM,SAAS,gBAAgB,YAAY,UAAU,aAAa,OAAO,eAAe,UAAU,GAAG;AACrG,MAAI,OAAO,SAAS,CAAC,aAAa,OAAO;AACxC,UAAM,IAAI,mBAAmB,6DAA6D;AAAA,EAC3F;AACA,MAAI;AACH,UAAM,SAAS,MAAM,OAAO,SAAS,aAAa,QAAQ,WAAW;AACrE,UAAM,SAAS,OAAO,OAAA;AACtB,UAAM,EAAE,SAAS,QAAQ,OAAO,GAAG,wBAAwB;AAC3D,UAAM,WAAW,OAAO,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,MAAM,IAAI,CAAA;AACxF,UAAM,aAAa,mBAAmB,SAAS,CAAA;AAC/C,UAAM,aAAa,iBAAiB,uBAAuB,QAAQ,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAS,IAAI;AAM9H,UAAM,aAAa,gBAAgB,EAAE,GAAG,qBAAqB,GAAG,YAAY,cAAc,OAAO,GAAG;AAEpG,WAAO;AAAA,MACN,GAAG;AAAA,MACH,GAAG;AAAA,MACH,GAAI,aAAa,EAAE,eAAe,CAAA;AAAA,IAAC;AAAA,EAErC,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,IAAI,mBAAmB,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,aAAa,OAAO,SAAS;AAChC,YAAM,OAAO,EAAE,UAAU;AACzB,UAAI,OAAO,SAAS,YAAY,OAAO,MAAM,UAAU,YAAY,OAAO,KAAK,OAAO,YAAY,UAAU;AAC3G,cAAM,IAAI,iBAAiB,KAAK,MAAM,OAAO;AAAA,MAC9C;AACA,YAAM,IAAI,iBAAiB,EAAE,OAAO;AAAA,IACrC;AACA,UAAM;AAAA,EACP;AACD;AAGA,MAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,iBAAiB,eAAe,CAAC;AAQhF,MAAM,iBAAiB,OAC7B,QACA,QACA,SACA,UAAwE,CAAA,MACvC;AACjC,QAAM,EAAE,cAAc,cAAA,IAAkB;AACxC,QAAM,SAAS,QAAQ,UAAU,CAAA;AACjC,QAAM,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB;AACvF,QAAM,cAAc,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AACpF,MAAI;AACH,QAAI,WAAW,WAAW;AACzB,UAAI,CAAC,cAAc;AAClB,eAAO,EAAE,QAAQ,WAAW,QAAQ,mBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,QAAQ,YAAY;AAClD,UAAI;AACJ,UAAI,iBAAiB;AACrB,UAAI;AAMH,YAAI,SAAS,UAAU;AACtB,gBAAM,WAAW,SAAS,OAAA;AAC1B,gBAAM,WAAW,SAAS,gBAAgB,gBAAgB,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAA;AAC5F,mBAAS,gBAAgB,EAAE,GAAG,UAAU,GAAG,SAAA,GAAY,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAChI,2BAAiB;AAAA,QAClB;AAAA,MACD,QAAQ;AAKP,iBAAS;AACT,yBAAiB;AAAA,MAClB;AACA,aAAO;AAAA,QACN,QAAQ;AAAA,QACR;AAAA,QACA;AAAA;AAAA,QAEA,YAAY,uBAAuB,UAAU,QAAQ,WAAW,MAAM;AAAA,MAAA;AAAA,IAExE;AACA,QAAI,WAAW,YAAY;AAC1B,UAAI,CAAC,aAAa;AACjB,eAAO,EAAE,QAAQ,WAAW,QAAQ,kBAAA;AAAA,MACrC;AACA,YAAM,WAAW,MAAM,OAAO,SAAS,WAAW;AAClD,UAAI;AACJ,UAAI;AACH,iBAAS,gBAAgB,UAAU,cAAc,OAAO,SAAS,QAAQ,WAAW,SAAS,MAAM,MAAS;AAAA,MAC7G,QAAQ;AACP,iBAAS;AAAA,MACV;AAIA,aAAO,EAAE,QAAQ,SAAS,QAAQ,gBAAgB,MAAA;AAAA,IACnD;AAEA,UAAM,QAAQ,eAAe;AAC7B,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,UAAM,SAAS,MAAM,OAAO,WAAW,OAAO,cAAc,iBAAiB,eAAe;AAC5F,QAAI,CAAC,OAAO,QAAQ;AACnB,aAAO,EAAE,QAAQ,WAAW,QAAQ,WAAA;AAAA,IACrC;AACA,WAAO,EAAE,QAAQ,QAAA;AAAA,EAClB,SAAS,GAAQ;AAChB,QAAI,aAAa,OAAO,SAAS;AAChC,UAAI,OAAO,EAAE,UAAU,YAAY,oBAAoB,IAAI,EAAE,KAAK,GAAG;AACpE,eAAO,EAAE,QAAQ,WAAW,QAAQ,EAAE,MAAA;AAAA,MACvC;AAOA,UAAI,WAAW,cAAc,EAAE,UAAU,eAAe,KAAK;AAC5D,eAAO,EAAE,QAAQ,WAAW,QAAQ,wBAAA;AAAA,MACrC;AAAA,IACD;AAEA,UAAM;AAAA,EACP;AACD;AAQO,MAAM,qBAAqB,CAAC,QAAgB,EAAE,SAAS,4BAA6D;AAC1H,MAAI,CAAC,OAAO,OAAO,SAAS,sBAAsB;AACjD,WAAO;AAAA,EACR;AACA,SAAO,OAAO,cAAc;AAAA,IAC3B,GAAI,UAAU,EAAE,eAAe,QAAA,IAAY,CAAA;AAAA,IAC3C,GAAI,wBAAwB,EAAE,0BAA0B,0BAA0B,CAAA;AAAA,EAAC,CACnF;AACF;AAQA,MAAM,2BAA2B;AAOjC,MAAM,+BAA+B;AACrC,MAAM,uCAAuC;AAQ7C,MAAM,sCAAsB,IAAA;AAE5B,MAAM,gBAAgB,CAAC,YAA2D;AACjF,MAAI,OAAO,gBAAgB,IAAI,OAAO;AACtC,MAAI,CAAC,MAAM;AACV,WAAO,mBAAmB,IAAI,IAAI,OAAO,CAAC;AAC1C,oBAAgB,IAAI,SAAS,IAAI;AAAA,EAClC;AACA,SAAO;AACR;AAcO,MAAM,0BAA0B,OAAO,QAAgB,QAAwB,gBAAoD;AACzI,QAAM,UAAU,OAAO,SAAS;AAChC,MAAI,CAAC,SAAS;AACb,UAAM,IAAI,mBAAmB,iDAAiD;AAAA,EAC/E;AACA,QAAM,WAAW,OAAO,SAAS;AACjC,MAAI,OAAO,aAAa,YAAY,aAAa,IAAI;AAIpD,UAAM,IAAI,mBAAmB,2DAA2D;AAAA,EACzF;AACA,QAAM,cAAc,OAAO,OAAO,SAAS,iCAAiC,WACzE,OAAO,SAAS,+BAChB;AACH,QAAM,OAAO,cAAc,OAAO;AAClC,MAAI;AACJ,MAAI;AACH,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM;AAAA,MACnD,QAAQ,OAAO,SAAS;AAAA,MACxB,UAAU;AAAA;AAAA;AAAA,MAGV,YAAY,CAAC,WAAW;AAAA;AAAA;AAAA,MAGxB,aAAa;AAAA,MACb,gBAAgB,CAAC,KAAK;AAAA,MACtB,gBAAgB;AAAA,IAAA,CAChB;AACD,cAAU,SAAS;AAAA,EACpB,SAAS,GAAQ;AAChB,UAAM,IAAI,mBAAmB,yBAAyB,GAAG,WAAW,qBAAqB,EAAE;AAAA,EAC5F;AAGA,MAAI,WAAW,SAAS;AACvB,UAAM,IAAI,mBAAmB,uCAAuC;AAAA,EACrE;AAEA,QAAM,SAAS,QAAQ;AACvB,QAAM,iBAAiB,OAAO,WAAW,YAAY,WAAW,QAAQ,4BAA6B;AACrG,MAAI,CAAC,gBAAgB;AACpB,UAAM,IAAI,mBAAmB,uDAAuD;AAAA,EACrF;AAEA,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,MAAI,CAAC,OAAO,CAAC,KAAK;AACjB,UAAM,IAAI,mBAAmB,8CAA8C;AAAA,EAC5E;AAEA,SAAO,EAAE,KAAK,IAAA;AACf;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs

@@ -40,7 +40,10 @@ class OIDCProvider {
   }
   async revalidate(configuration, session) {
     const client = await this.createOIDCClient(configuration);
-    return await OIDCHelpers.revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session);
+    return await OIDCHelpers.revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session, {
+      claimMapping: configuration.claimMapping,
+      fetchUserInfo: configuration.fetchUserInfo
+    });
   }
   async buildLogoutUrl(configuration, request) {
     const client = await this.createOIDCClient(configuration);

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session)\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","revalidateOIDC","buildOIDCLogoutUrl","validateOIDCLogoutToken","Issuer","custom"],"mappings":";;;;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwBA,QAAAA,cAAcC,UAAAA,mBAAmBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA;AAAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,OAAO;AAAA,EAC7F;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAOC,YAAAA,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAjFnF,QAAA,IAAA;AAkFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAOC,aAAAA,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session, {\n\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t})\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","revalidateOIDC","buildOIDCLogoutUrl","validateOIDCLogoutToken","Issuer","custom"],"mappings":";;;;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwBA,QAAAA,cAAcC,UAAAA,mBAAmBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA;AAAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,SAAS;AAAA,MAC7F,cAAc,cAAc;AAAA,MAC5B,eAAe,cAAc;AAAA,IAAA,CAC7B;AAAA,EACF;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAOC,YAAAA,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AApFnF,QAAA,IAAA;AAqFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAOC,aAAAA,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.js

@@ -38,7 +38,10 @@ class OIDCProvider {
   }
   async revalidate(configuration, session) {
     const client = await this.createOIDCClient(configuration);
-    return await revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session);
+    return await revalidateOIDC(client, configuration.revalidation?.method ?? "refresh", session, {
+      claimMapping: configuration.claimMapping,
+      fetchUserInfo: configuration.fetchUserInfo
+    });
   }
   async buildLogoutUrl(configuration, request) {
     const client = await this.createOIDCClient(configuration);

package/dist/development/src/model/service/idp/providers/OIDCProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session)\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwB,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,OAAO;AAAA,EAC7F;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAjFnF,QAAA,IAAA;AAkFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAO,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, custom, Issuer } from 'openid-client'\nimport {\n\tIdentityProviderHandler,\n\tIDPResponse,\n\tIDPSessionState,\n\tInitIDPAuthResult,\n\tLogoutTokenClaims,\n\tLogoutUrlRequest,\n\tRevalidationResult,\n} from '../IdentityProviderHandler.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { catchTypesafe } from './helpers.js'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes.js'\nimport { buildOIDCLogoutUrl, handleOIDCResponse, initOIDCAuth, revalidateOIDC, validateOIDCLogoutToken } from './OIDCHelpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\n\nconst DEFAULT_OIDC_TIMEOUT = 5000\nconst OFFLINE_ACCESS_SCOPE = 'offline_access'\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: this.resolveScope(configuration),\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(\n\t\t\tclient,\n\t\t\tresponseData,\n\t\t\t{\n\t\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t\t\treturnOIDCResult: configuration.returnOIDCResult,\n\t\t\t\tcaptureSession: configuration.revalidation?.enabled === true,\n\t\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session, {\n\t\t\tclaimMapping: configuration.claimMapping,\n\t\t\tfetchUserInfo: configuration.fetchUserInfo,\n\t\t})\n\t}\n\n\tpublic async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn buildOIDCLogoutUrl(client, request)\n\t}\n\n\tpublic async validateLogoutToken(configuration: OIDCConfiguration, logoutToken: string): Promise<LogoutTokenClaims> {\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await validateOIDCLogoutToken(client, client.issuer, logoutToken)\n\t}\n\n\t/**\n\t * Resolve the requested scope, appending `offline_access` when refresh-token\n\t * re-validation is enabled (so the IdP issues a refresh token to revalidate against).\n\t */\n\tprivate resolveScope(configuration: OIDCConfiguration): string {\n\t\tconst baseScope = configuration.scope ?? configuration.claims ?? 'openid email'\n\t\tconst needsOfflineAccess = configuration.revalidation?.enabled === true\n\t\t\t&& (configuration.revalidation.method ?? 'refresh') === 'refresh'\n\t\tif (needsOfflineAccess && !baseScope.split(/\\s+/).includes(OFFLINE_ACCESS_SCOPE)) {\n\t\t\treturn `${baseScope} ${OFFLINE_ACCESS_SCOPE}`\n\t\t}\n\t\treturn baseScope\n\t}\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\tconst client = new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t\t...(configuration.tokenEndpointAuthMethod ? { token_endpoint_auth_method: configuration.tokenEndpointAuthMethod } : {}),\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\n\t\tclient[custom.http_options] = () => ({ timeout: configuration.timeout ?? DEFAULT_OIDC_TIMEOUT })\n\n\t\treturn client\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAEtB,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,EAAC;AAEvD,kBAAA,MAAA,yBAAwB,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,aAAa,QAAQ;AAAA,MACjC,OAAO,KAAK,aAAa,aAAa;AAAA,MACtC,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAqC;AACnG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,QACC,eAAe,cAAc;AAAA,QAC7B,kBAAkB,cAAc;AAAA,QAChC,gBAAgB,cAAc,cAAc,YAAY;AAAA,QACxD,cAAc,cAAc;AAAA,MAAA;AAAA,IAC7B;AAAA,EAEF;AAAA,EAEA,MAAa,WAAW,eAAkC,SAAuD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,eAAe,QAAQ,cAAc,cAAc,UAAU,WAAW,SAAS;AAAA,MAC7F,cAAc,cAAc;AAAA,MAC5B,eAAe,cAAc;AAAA,IAAA,CAC7B;AAAA,EACF;AAAA,EAEA,MAAa,eAAe,eAAkC,SAAmD;AAChH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,mBAAmB,QAAQ,OAAO;AAAA,EAC1C;AAAA,EAEA,MAAa,oBAAoB,eAAkC,aAAiD;AACnH,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAM,wBAAwB,QAAQ,OAAO,QAAQ,WAAW;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,aAAa,eAA0C;AAC9D,UAAM,YAAY,cAAc,SAAS,cAAc,UAAU;AACjE,UAAM,qBAAqB,cAAc,cAAc,YAAY,SAC9D,cAAc,aAAa,UAAU,eAAe;AACzD,QAAI,sBAAsB,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,oBAAoB,GAAG;AACjF,aAAO,GAAG,SAAS,IAAI,oBAAoB;AAAA,IAC5C;AACA,WAAO;AAAA,EACR;AAAA,EAEA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AApFnF,QAAA,IAAA;AAqFE,KAAA,KAAA,KAAK,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,UAAM,SAAS,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MACtD;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,QACxE,GAAI,cAAc,0BAA0B,EAAE,4BAA4B,cAAc,wBAAA,IAA4B,CAAA;AAAA,MAAC;AAAA,MAEtH;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAGD,WAAO,OAAO,YAAY,IAAI,OAAO,EAAE,SAAS,cAAc,WAAW;AAEzE,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/utils/DatabaseContext.cjs

@@ -20,11 +20,18 @@ class DatabaseContext {
   get queryHandler() {
     return this.client.createQueryHandler();
   }
-  async transaction(cb) {
-    return await this.client.transaction(async (db) => {
-      await db.query(Database.Connection.REPEATABLE_READ);
+  async transaction(cb, options = {}) {
+    const run = async () => await this.client.transaction(async (db) => {
+      if (options.isolation !== "readCommitted") {
+        await db.query(Database.Connection.REPEATABLE_READ);
+      }
       return await cb(new DatabaseContext(db, this.providers));
     });
+    const retry = options.retry;
+    if (!retry) {
+      return await run();
+    }
+    return await Database.retryTransaction(run, (message) => retry.logger.warn(message));
   }
   async scope(cb) {
     return await this.client.scope(async (db) => {

package/dist/development/src/model/utils/DatabaseContext.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":["CommandBus","Connection","initBatchLoader"],"mappings":";;;;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAIA,WAAAA,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAMC,SAAAA,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAYC,WAAAA,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;;"}
+{"version":3,"file":"DatabaseContext.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection, retryTransaction } from '@contember/database'\nimport { Logger } from '@contember/logger'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport interface TransactionOptions {\n\t/**\n\t * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the\n\t * repeatable-read level every transaction here runs at.\n\t *\n\t * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside\n\t * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.\n\t */\n\tretry?: { logger: Logger }\n\treadonly isolation?: 'repeatableRead' | 'readCommitted'\n}\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(\n\t\tcb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>,\n\t\toptions: TransactionOptions = {},\n\t): Promise<T> {\n\t\tconst run = async () =>\n\t\t\tawait this.client.transaction(async db => {\n\t\t\t\tif (options.isolation !== 'readCommitted') {\n\t\t\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\t\t}\n\t\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t\t})\n\t\tconst retry = options.retry\n\t\tif (!retry) {\n\t\t\treturn await run()\n\t\t}\n\t\treturn await retryTransaction(run, message => retry.logger.warn(message))\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":["CommandBus","Connection","retryTransaction","initBatchLoader"],"mappings":";;;;;;;;;;AAkBO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAIA,WAAAA,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YACZ,IACA,UAA8B,IACjB;AACb,UAAM,MAAM,YACX,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AACzC,UAAI,QAAQ,cAAc,iBAAiB;AAC1C,cAAM,GAAG,MAAMC,SAAAA,WAAW,eAAe;AAAA,MAC1C;AACA,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AACF,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,OAAO;AACX,aAAO,MAAM,IAAA;AAAA,IACd;AACA,WAAO,MAAMC,SAAAA,iBAAiB,KAAK,CAAA,YAAW,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,EACzE;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAYC,WAAAA,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;;"}

package/dist/development/src/model/utils/DatabaseContext.js

@@ -1,4 +1,4 @@
-import { Connection } from "@contember/database";
+import { retryTransaction, Connection } from "@contember/database";
 import "../type/ApiKey.js";
 import { initBatchLoader } from "../../utils/batchQuery.js";
 import "node:crypto";
@@ -18,11 +18,18 @@ class DatabaseContext {
   get queryHandler() {
     return this.client.createQueryHandler();
   }
-  async transaction(cb) {
-    return await this.client.transaction(async (db) => {
-      await db.query(Connection.REPEATABLE_READ);
+  async transaction(cb, options = {}) {
+    const run = async () => await this.client.transaction(async (db) => {
+      if (options.isolation !== "readCommitted") {
+        await db.query(Connection.REPEATABLE_READ);
+      }
       return await cb(new DatabaseContext(db, this.providers));
     });
+    const retry = options.retry;
+    if (!retry) {
+      return await run();
+    }
+    return await retryTransaction(run, (message) => retry.logger.warn(message));
   }
   async scope(cb) {
     return await this.client.scope(async (db) => {

package/dist/development/src/model/utils/DatabaseContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.transaction(async db => {\n\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;AAKO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAI,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YAAe,IAAwF;AACnH,WAAO,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AAChD,YAAM,GAAG,MAAM,WAAW,eAAe;AACzC,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAY,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;"}
+{"version":3,"file":"DatabaseContext.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/DatabaseContext.ts"],"sourcesContent":["import { Client, Connection, retryTransaction } from '@contember/database'\nimport { Logger } from '@contember/logger'\nimport { Providers } from '../providers.js'\nimport { CommandBus } from '../commands/index.js'\nimport { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'\n\nexport interface TransactionOptions {\n\t/**\n\t * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the\n\t * repeatable-read level every transaction here runs at.\n\t *\n\t * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside\n\t * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.\n\t */\n\tretry?: { logger: Logger }\n\treadonly isolation?: 'repeatableRead' | 'readCommitted'\n}\n\nexport class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tprivate loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()\n\n\tconstructor(\n\t\tpublic readonly client: Client<Conn>,\n\t\tpublic readonly providers: Providers,\n\t) {\n\t}\n\n\tpublic get commandBus() {\n\t\treturn new CommandBus(this.client, this.providers)\n\t}\n\n\tpublic get queryHandler() {\n\t\treturn this.client.createQueryHandler()\n\t}\n\n\tpublic async transaction<T>(\n\t\tcb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>,\n\t\toptions: TransactionOptions = {},\n\t): Promise<T> {\n\t\tconst run = async () =>\n\t\t\tawait this.client.transaction(async db => {\n\t\t\t\tif (options.isolation !== 'readCommitted') {\n\t\t\t\t\tawait db.query(Connection.REPEATABLE_READ)\n\t\t\t\t}\n\t\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t\t})\n\t\tconst retry = options.retry\n\t\tif (!retry) {\n\t\t\treturn await run()\n\t\t}\n\t\treturn await retryTransaction(run, message => retry.logger.warn(message))\n\t}\n\n\tpublic async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {\n\t\treturn await this.client.scope(async db => {\n\t\t\treturn await cb(new DatabaseContext(db, this.providers))\n\t\t})\n\t}\n\n\tpublic batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item> {\n\t\tconst existing = this.loaders.get(loaderArgs)\n\t\tif (existing) {\n\t\t\treturn existing(arg)\n\t\t}\n\t\tconst newLoader = initBatchLoader(loaderArgs, this)\n\t\tthis.loaders.set(loaderArgs, newLoader)\n\t\treturn newLoader(arg)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;AAkBO,MAAM,gBAAoF;AAAA,EAGhG,YACiB,QACA,WACf;AAFe,SAAA,SAAA;AACA,SAAA,YAAA;AAJjB,kBAAA,MAAQ,+BAAc,IAAA,CAA0D;AAAA,EAMhF;AAAA,EAEA,IAAW,aAAa;AACvB,WAAO,IAAI,WAAW,KAAK,QAAQ,KAAK,SAAS;AAAA,EAClD;AAAA,EAEA,IAAW,eAAe;AACzB,WAAO,KAAK,OAAO,mBAAA;AAAA,EACpB;AAAA,EAEA,MAAa,YACZ,IACA,UAA8B,IACjB;AACb,UAAM,MAAM,YACX,MAAM,KAAK,OAAO,YAAY,OAAM,OAAM;AACzC,UAAI,QAAQ,cAAc,iBAAiB;AAC1C,cAAM,GAAG,MAAM,WAAW,eAAe;AAAA,MAC1C;AACA,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AACF,UAAM,QAAQ,QAAQ;AACtB,QAAI,CAAC,OAAO;AACX,aAAO,MAAM,IAAA;AAAA,IACd;AACA,WAAO,MAAM,iBAAiB,KAAK,CAAA,YAAW,MAAM,OAAO,KAAK,OAAO,CAAC;AAAA,EACzE;AAAA,EAEA,MAAa,MAAS,IAA+F;AACpH,WAAO,MAAM,KAAK,OAAO,MAAM,OAAM,OAAM;AAC1C,aAAO,MAAM,GAAG,IAAI,gBAAgB,IAAI,KAAK,SAAS,CAAC;AAAA,IACxD,CAAC;AAAA,EACF;AAAA,EAEO,UAA6B,YAAgD,KAAyB;AAC5G,UAAM,WAAW,KAAK,QAAQ,IAAI,UAAU;AAC5C,QAAI,UAAU;AACb,aAAO,SAAS,GAAG;AAAA,IACpB;AACA,UAAM,YAAY,gBAAgB,YAAY,IAAI;AAClD,SAAK,QAAQ,IAAI,YAAY,SAAS;AACtC,WAAO,UAAU,GAAG;AAAA,EACrB;AACD;"}

package/dist/development/src/model/utils/token.cjs

@@ -20,7 +20,7 @@ const timingSafeCompareHash = (a, b) => {
   }
   return crypto.timingSafeEqual(bufferA, bufferB);
 };
-const validateToken = ({ entry, validationType, token, now }) => {
+const validateToken = ({ entry, validationType, token }) => {
   if (!entry) {
     return new Response.ResponseError("TOKEN_NOT_FOUND", "Token not found");
   }
@@ -50,7 +50,7 @@ const validateToken = ({ entry, validationType, token, now }) => {
   if (entry.used_at) {
     return new Response.ResponseError("TOKEN_USED", "Token used at " + entry.used_at.toISOString());
   }
-  if (entry.expires_at < now) {
+  if (entry.is_expired) {
     return new Response.ResponseError("TOKEN_EXPIRED", "Token expired at " + entry.expires_at.toISOString());
   }
   return new Response.ResponseOk(entry);

package/dist/development/src/model/utils/token.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"token.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/token.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './hex.js'\nimport { PersonToken } from '../type/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { Response, ResponseError, ResponseOk } from './Response.js'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\nexport const MAX_OTP_ATTEMPTS = 3\n\n/**\n * Constant-time comparison of two token hashes. Both inputs are expected to be\n * 64-character hex strings (sha256). Returns false on any length mismatch\n * without leaking timing information about the matching prefix.\n */\nexport const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {\n\tconst bufferA = Buffer.from(a, 'hex')\n\tconst bufferB = Buffer.from(b, 'hex')\n\tif (bufferA.length !== bufferB.length) {\n\t\treturn false\n\t}\n\treturn crypto.timingSafeEqual(bufferA, bufferB)\n}\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["isFixedLengthHexString","ResponseError","ImplementationException","ResponseOk"],"mappings":";;;;;;AAMO,MAAM,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIO,MAAM,mBAAmB,CAAC,UAA6B;AAC7D,SAAO,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,IAAAA,uBAAuB,OAAO,EAAE;AAE3F,MAAM,mBAAmB;AAOzB,MAAM,wBAAwB,CAAC,GAAc,MAA0B;AAC7E,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO;AAAA,EACR;AACA,SAAO,OAAO,gBAAgB,SAAS,OAAO;AAC/C;AAEO,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACX,WAAO,IAAIC,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AACvE,WAAO,IAAIA,SAAAA,cAAc,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAA;AAAA,IACP,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AACjD,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AAC/C,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAIC,WAAAA,wBAAA;AAAA,EAAwB;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAID,SAAAA,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACA,MAAI,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAIA,SAAAA,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACA,SAAO,IAAIE,SAAAA,WAAW,KAAK;AAC5B;;;;;;;"}
+{"version":3,"file":"token.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/token.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './hex.js'\nimport { PersonToken } from '../type/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { Response, ResponseError, ResponseOk } from './Response.js'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\nexport const MAX_OTP_ATTEMPTS = 3\n\n/**\n * Constant-time comparison of two token hashes. Both inputs are expected to be\n * 64-character hex strings (sha256). Returns false on any length mismatch\n * without leaking timing information about the matching prefix.\n */\nexport const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {\n\tconst bufferA = Buffer.from(a, 'hex')\n\tconst bufferB = Buffer.from(b, 'hex')\n\tif (bufferA.length !== bufferB.length) {\n\t\treturn false\n\t}\n\treturn crypto.timingSafeEqual(bufferA, bufferB)\n}\n\nexport const validateToken = ({ entry, validationType, token }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.is_expired) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["isFixedLengthHexString","ResponseError","ImplementationException","ResponseOk"],"mappings":";;;;;;AAMO,MAAM,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIO,MAAM,mBAAmB,CAAC,UAA6B;AAC7D,SAAO,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,IAAAA,uBAAuB,OAAO,EAAE;AAE3F,MAAM,mBAAmB;AAOzB,MAAM,wBAAwB,CAAC,GAAc,MAA0B;AAC7E,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO;AAAA,EACR;AACA,SAAO,OAAO,gBAAgB,SAAS,OAAO;AAC/C;AAEO,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,YAIY;AAClE,MAAI,CAAC,OAAO;AACX,WAAO,IAAIC,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AACvE,WAAO,IAAIA,SAAAA,cAAc,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAA;AAAA,IACP,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AACjD,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AAC/C,eAAO,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAIC,WAAAA,wBAAA;AAAA,EAAwB;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAID,SAAAA,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACA,MAAI,MAAM,YAAY;AACrB,WAAO,IAAIA,SAAAA,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACA,SAAO,IAAIE,SAAAA,WAAW,KAAK;AAC5B;;;;;;;"}

package/dist/development/src/model/utils/token.js

@@ -18,7 +18,7 @@ const timingSafeCompareHash = (a, b) => {
   }
   return crypto__default.timingSafeEqual(bufferA, bufferB);
 };
-const validateToken = ({ entry, validationType, token, now }) => {
+const validateToken = ({ entry, validationType, token }) => {
   if (!entry) {
     return new ResponseError("TOKEN_NOT_FOUND", "Token not found");
   }
@@ -48,7 +48,7 @@ const validateToken = ({ entry, validationType, token, now }) => {
   if (entry.used_at) {
     return new ResponseError("TOKEN_USED", "Token used at " + entry.used_at.toISOString());
   }
-  if (entry.expires_at < now) {
+  if (entry.is_expired) {
     return new ResponseError("TOKEN_EXPIRED", "Token expired at " + entry.expires_at.toISOString());
   }
   return new ResponseOk(entry);

package/dist/development/src/model/utils/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/token.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './hex.js'\nimport { PersonToken } from '../type/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { Response, ResponseError, ResponseOk } from './Response.js'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\nexport const MAX_OTP_ATTEMPTS = 3\n\n/**\n * Constant-time comparison of two token hashes. Both inputs are expected to be\n * 64-character hex strings (sha256). Returns false on any length mismatch\n * without leaking timing information about the matching prefix.\n */\nexport const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {\n\tconst bufferA = Buffer.from(a, 'hex')\n\tconst bufferB = Buffer.from(b, 'hex')\n\tif (bufferA.length !== bufferB.length) {\n\t\treturn false\n\t}\n\treturn crypto.timingSafeEqual(bufferA, bufferB)\n}\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["crypto"],"mappings":";;;;AAMO,MAAM,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIO,MAAM,mBAAmB,CAAC,UAA6B;AAC7D,SAAOA,gBACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsC,uBAAuB,OAAO,EAAE;AAE3F,MAAM,mBAAmB;AAOzB,MAAM,wBAAwB,CAAC,GAAc,MAA0B;AAC7E,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO;AAAA,EACR;AACA,SAAOA,gBAAO,gBAAgB,SAAS,OAAO;AAC/C;AAEO,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACX,WAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AACvE,WAAO,IAAI,cAAc,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAA;AAAA,IACP,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAI,cAAc,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AACjD,eAAO,IAAI,cAAc,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AAC/C,eAAO,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAI,wBAAA;AAAA,EAAwB;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAI,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACA,MAAI,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAI,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACA,SAAO,IAAI,WAAW,KAAK;AAC5B;"}
+{"version":3,"file":"token.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/token.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './hex.js'\nimport { PersonToken } from '../type/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { Response, ResponseError, ResponseOk } from './Response.js'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\nexport const MAX_OTP_ATTEMPTS = 3\n\n/**\n * Constant-time comparison of two token hashes. Both inputs are expected to be\n * 64-character hex strings (sha256). Returns false on any length mismatch\n * without leaking timing information about the matching prefix.\n */\nexport const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {\n\tconst bufferA = Buffer.from(a, 'hex')\n\tconst bufferB = Buffer.from(b, 'hex')\n\tif (bufferA.length !== bufferB.length) {\n\t\treturn false\n\t}\n\treturn crypto.timingSafeEqual(bufferA, bufferB)\n}\n\nexport const validateToken = ({ entry, validationType, token }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.is_expired) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["crypto"],"mappings":";;;;AAMO,MAAM,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIO,MAAM,mBAAmB,CAAC,UAA6B;AAC7D,SAAOA,gBACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsC,uBAAuB,OAAO,EAAE;AAE3F,MAAM,mBAAmB;AAOzB,MAAM,wBAAwB,CAAC,GAAc,MAA0B;AAC7E,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,QAAM,UAAU,OAAO,KAAK,GAAG,KAAK;AACpC,MAAI,QAAQ,WAAW,QAAQ,QAAQ;AACtC,WAAO;AAAA,EACR;AACA,SAAOA,gBAAO,gBAAgB,SAAS,OAAO;AAC/C;AAEO,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,YAIY;AAClE,MAAI,CAAC,OAAO;AACX,WAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AACvE,WAAO,IAAI,cAAc,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAA;AAAA,IACP,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAI,cAAc,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AACjD,eAAO,IAAI,cAAc,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACJ,UAAI,MAAM,aAAa,MAAM;AAC5B,eAAO,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AAC/C,eAAO,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAI,wBAAA;AAAA,EAAwB;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAI,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACA,MAAI,MAAM,YAAY;AACrB,WAAO,IAAI,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACA,SAAO,IAAI,WAAW,KAAK;AAC5B;"}

package/dist/development/src/resolvers/ResolverFactory.cjs

@@ -18,13 +18,16 @@ class ResolverFactory {
         sessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver)
       },
       Person: {
-        identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver)
+        identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),
+        passwordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),
+        passwordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver)
       },
       Project: {
         members: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),
         roles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),
         apiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),
-        secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver)
+        secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),
+        permissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver)
       },
       Query: {
         me: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),
@@ -38,6 +41,8 @@ class ResolverFactory {
         mailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),
         configuration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),
         authPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),
+        customRoles: this.resolvers.customRoleQueryResolver.customRoles.bind(this.resolvers.customRoleQueryResolver),
+        customRolePermissions: this.resolvers.customRoleQueryResolver.customRolePermissions.bind(this.resolvers.customRoleQueryResolver),
         authLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),
         checkResetPasswordToken: () => {
           throw new Error("not implemented");
@@ -71,6 +76,7 @@ class ResolverFactory {
           this.resolvers.disconnectMyIdentityProviderMutationResolver
         ),
         disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
+        enablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),
         forceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),
         resetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),
         revokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),
@@ -120,7 +126,10 @@ class ResolverFactory {
         configure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),
         createAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
         updateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
-        deleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver)
+        deleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
+        createCustomRole: this.resolvers.customRoleMutationResolver.createCustomRole.bind(this.resolvers.customRoleMutationResolver),
+        updateCustomRole: this.resolvers.customRoleMutationResolver.updateCustomRole.bind(this.resolvers.customRoleMutationResolver),
+        deleteCustomRole: this.resolvers.customRoleMutationResolver.deleteCustomRole.bind(this.resolvers.customRoleMutationResolver)
       }
     };
   }

package/dist/development/src/resolvers/ResolverFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResolverFactory.cjs","sources":["../../../../../packages/engine-tenant-api/src/resolvers/ResolverFactory.ts"],"sourcesContent":["import {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tEmailOtpMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tOtpMutationResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './mutation/index.js'\n\nimport { Resolvers } from '../schema/index.js'\nimport {\n\tApiKeyQueryResolver,\n\tAuthLogQueryResolver,\n\tMeQueryResolver,\n\tPersonQueryResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n} from './query/index.js'\nimport { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js'\nimport { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js'\nimport { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'\nimport { IDPQueryResolver } from './query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'\nimport { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'\nimport { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'\nimport { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'\nimport { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'\nimport { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js'\n\nclass ResolverFactory {\n\tpublic constructor(\n\t\tprivate readonly resolvers: {\n\t\t\tmeQueryResolver: MeQueryResolver\n\t\t\tpersonQueryResolver: PersonQueryResolver\n\t\t\tprojectQueryResolver: ProjectQueryResolver\n\t\t\tprojectMembersQueryResolver: ProjectMembersQueryResolver\n\t\t\tidpQueryResolver: IDPQueryResolver\n\t\t\tmailTemplateQueryResolver: MailTemplateQueryResolver\n\n\t\t\tsignUpMutationResolver: SignUpMutationResolver\n\t\t\tsignInMutationResolver: SignInMutationResolver\n\t\t\tsignOutMutationResolver: SignOutMutationResolver\n\t\t\tchangeProfileMutationResolver: ChangeProfileMutationResolver\n\t\t\tchangePasswordMutationResolver: ChangePasswordMutationResolver\n\t\t\tresetPasswordMutationResolver: ResetPasswordMutationResolver\n\t\t\temailVerificationMutationResolver: EmailVerificationMutationResolver\n\t\t\tidpMutationResolver: IDPMutationResolver\n\t\t\tregisterIdpMutationResolver: AddIDPMutationResolver\n\t\t\tdisableIdpMutationResolver: DisableIDPMutationResolver\n\t\t\tenableIdpMutationResolver: EnableIDPMutationResolver\n\t\t\tupdateIdpMutationResolver: UpdateIDPMutationResolver\n\t\t\tdisconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver\n\t\t\tpasswordlessMutationResolver: PasswordlessMutationResolver\n\n\t\t\tdisablePersonMutationResolver: DisablePersonMutationResolver\n\t\t\tforceSignOutMutationResolver: ForceSignOutMutationResolver\n\t\t\tresetPersonMfaMutationResolver: ResetPersonMfaMutationResolver\n\t\t\trevokeSessionMutationResolver: RevokeSessionMutationResolver\n\n\t\t\tinviteMutationResolver: InviteMutationResolver\n\t\t\taddProjectMemberMutationResolver: AddProjectMemberMutationResolver\n\t\t\tupdateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver\n\t\t\tremoveProjectMemberMutationResolver: RemoveProjectMemberMutationResolver\n\n\t\t\tcreateApiKeyMutationResolver: CreateApiKeyMutationResolver\n\t\t\tdisableApiKeyMutationResolver: DisableApiKeyMutationResolver\n\n\t\t\totpMutationResolver: OtpMutationResolver\n\t\t\temailOtpMutationResolver: EmailOtpMutationResolver\n\t\t\tregenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver\n\n\t\t\tmailTemplateMutationResolver: MailTemplateMutationResolver\n\n\t\t\tcreateProjectMutationResolver: CreateProjectMutationResolver\n\t\t\tsetProjectSecretMutationResolver: SetProjectSecretMutationResolver\n\t\t\tupdateProjectMutationResolver: UpdateProjectMutationResolver\n\n\t\t\tidentityTypeResolver: IdentityTypeResolver\n\t\t\tpersonTypeResolver: PersonTypeResolver\n\t\t\tprojectTypeResolver: ProjectTypeResolver\n\n\t\t\tidentityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver\n\n\t\t\tconfigurationMutationResolver: ConfigurationMutationResolver\n\t\t\tconfigurationQueryResolver: ConfigurationQueryResolver\n\n\t\t\tauthPolicyMutationResolver: AuthPolicyMutationResolver\n\t\t\tauthPolicyQueryResolver: AuthPolicyQueryResolver\n\n\t\t\tauthLogQueryResolver: AuthLogQueryResolver\n\t\t\tapiKeyQueryResolver: ApiKeyQueryResolver\n\n\t\t\ttogglePasswordlessMutationResolver: TogglePasswordlessMutationResolver\n\t\t},\n\t) {}\n\n\tcreate(): Resolvers & { Mutation: Required<Resolvers['Mutation']> } & { Query: Required<Resolvers['Query']> } {\n\t\treturn {\n\t\t\tJson: JSONType,\n\t\t\tDateTime: DateTimeType,\n\t\t\tInterval: IntervalType,\n\t\t\tIdentity: {\n\t\t\t\tprojects: this.resolvers.identityTypeResolver.projects.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tperson: this.resolvers.identityTypeResolver.person.bind(this.resolvers.identityTypeResolver),\n\t\t\t\troles: this.resolvers.identityTypeResolver.roles.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tpermissions: this.resolvers.identityTypeResolver.permissions.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tsessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver),\n\t\t\t},\n\t\t\tPerson: {\n\t\t\t\tidentityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),\n\t\t\t},\n\t\t\tProject: {\n\t\t\t\tmembers: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),\n\t\t\t\troles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tapiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tsecrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),\n\t\t\t},\n\t\t\tQuery: {\n\t\t\t\tme: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),\n\t\t\t\tpersonById: this.resolvers.personQueryResolver.personById.bind(this.resolvers.personQueryResolver),\n\t\t\t\tpersons: this.resolvers.personQueryResolver.persons.bind(this.resolvers.personQueryResolver),\n\t\t\t\tglobalApiKeys: this.resolvers.apiKeyQueryResolver.globalApiKeys.bind(this.resolvers.apiKeyQueryResolver),\n\t\t\t\tprojectBySlug: this.resolvers.projectQueryResolver.projectBySlug.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojects: this.resolvers.projectQueryResolver.projects.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),\n\t\t\t\tidentityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),\n\t\t\t\tmailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),\n\t\t\t\tconfiguration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),\n\t\t\t\tauthPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),\n\t\t\t\tauthLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),\n\t\t\t\tcheckResetPasswordToken: () => {\n\t\t\t\t\tthrow new Error('not implemented')\n\t\t\t\t},\n\t\t\t},\n\t\t\tMutation: {\n\t\t\t\tsignUp: this.resolvers.signUpMutationResolver.signUp.bind(this.resolvers.signUpMutationResolver),\n\t\t\t\tsignIn: this.resolvers.signInMutationResolver.signIn.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tcreateSessionToken: this.resolvers.signInMutationResolver.createSessionToken.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tsignOut: this.resolvers.signOutMutationResolver.signOut.bind(this.resolvers.signOutMutationResolver),\n\n\t\t\t\tchangeProfile: this.resolvers.changeProfileMutationResolver.changeProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangeMyProfile: this.resolvers.changeProfileMutationResolver.changeMyProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangePassword: this.resolvers.changePasswordMutationResolver.changePassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tchangeMyPassword: this.resolvers.changePasswordMutationResolver.changeMyPassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tcreateResetPasswordRequest: this.resolvers.resetPasswordMutationResolver.createResetPasswordRequest.bind(\n\t\t\t\t\tthis.resolvers.resetPasswordMutationResolver,\n\t\t\t\t),\n\t\t\t\tresetPassword: this.resolvers.resetPasswordMutationResolver.resetPassword.bind(this.resolvers.resetPasswordMutationResolver),\n\n\t\t\t\trequestEmailVerification: this.resolvers.emailVerificationMutationResolver.requestEmailVerification.bind(\n\t\t\t\t\tthis.resolvers.emailVerificationMutationResolver,\n\t\t\t\t),\n\t\t\t\tverifyEmail: this.resolvers.emailVerificationMutationResolver.verifyEmail.bind(this.resolvers.emailVerificationMutationResolver),\n\t\t\t\tconfirmEmailChange: this.resolvers.changeProfileMutationResolver.confirmEmailChange.bind(this.resolvers.changeProfileMutationResolver),\n\n\t\t\t\tinitSignInIDP: this.resolvers.idpMutationResolver.initSignInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\tsignInIDP: this.resolvers.idpMutationResolver.signInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\taddIDP: this.resolvers.registerIdpMutationResolver.addIDP.bind(this.resolvers.registerIdpMutationResolver),\n\t\t\t\tdisableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),\n\t\t\t\tenableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),\n\t\t\t\tupdateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),\n\t\t\t\tdisconnectMyIdentityProvider: this.resolvers.disconnectMyIdentityProviderMutationResolver.disconnectMyIdentityProvider.bind(\n\t\t\t\t\tthis.resolvers.disconnectMyIdentityProviderMutationResolver,\n\t\t\t\t),\n\t\t\t\tdisablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),\n\t\t\t\tforceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),\n\t\t\t\tresetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),\n\t\t\t\trevokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),\n\n\t\t\t\tsignInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tinitSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tactivatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tdisableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\t\t\t\tenableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinvite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),\n\t\t\t\tunmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),\n\n\t\t\t\taddProjectMember: this.resolvers.addProjectMemberMutationResolver.addProjectMember.bind(this.resolvers.addProjectMemberMutationResolver),\n\t\t\t\tupdateProjectMember: this.resolvers.updateProjectMemberMutationResolver.updateProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveProjectMember: this.resolvers.removeProjectMemberMutationResolver.removeProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tcreateApiKey: this.resolvers.createApiKeyMutationResolver.createApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tcreateGlobalApiKey: this.resolvers.createApiKeyMutationResolver.createGlobalApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tdisableApiKey: this.resolvers.disableApiKeyMutationResolver.disableApiKey.bind(this.resolvers.disableApiKeyMutationResolver),\n\n\t\t\t\tprepareOtp: this.resolvers.otpMutationResolver.prepareOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tconfirmOtp: this.resolvers.otpMutationResolver.confirmOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tdisableOtp: this.resolvers.otpMutationResolver.disableOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tregenerateBackupCodes: this.resolvers.regenerateBackupCodesMutationResolver.regenerateBackupCodes.bind(\n\t\t\t\t\tthis.resolvers.regenerateBackupCodesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinitEmailOtp: this.resolvers.emailOtpMutationResolver.initEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tconfirmEmailOtp: this.resolvers.emailOtpMutationResolver.confirmEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tdisableEmailOtp: this.resolvers.emailOtpMutationResolver.disableEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\n\t\t\t\taddMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\taddProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\tcreateProject: this.resolvers.createProjectMutationResolver.createProject.bind(this.resolvers.createProjectMutationResolver),\n\t\t\t\tupdateProject: this.resolvers.updateProjectMutationResolver.updateProject.bind(this.resolvers.updateProjectMutationResolver),\n\t\t\t\tsetProjectSecret: this.resolvers.setProjectSecretMutationResolver.setProjectSecret.bind(this.resolvers.setProjectSecretMutationResolver),\n\n\t\t\t\taddGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tconfigure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),\n\n\t\t\t\tcreateAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tupdateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tdeleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t},\n\t\t}\n\t}\n}\n\nnamespace ResolverFactory {\n\texport type FieldResolverArgs = {\n\t\t[argument: string]: any\n\t}\n}\n\nexport { ResolverFactory }\n"],"names":["JSONType","DateTimeType","IntervalType"],"mappings":";;;AAsDA,MAAM,gBAAgB;AAAA,EACd,YACW,WA+DhB;AA/DgB,SAAA,YAAA;AAAA,EA+Df;AAAA,EAEH,SAA8G;AAC7G,WAAO;AAAA,MACN,MAAMA,aAAAA;AAAAA,MACN,UAAUC,aAAAA;AAAAA,MACV,UAAUC,aAAAA;AAAAA,MACV,UAAU;AAAA,QACT,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,QAAQ,KAAK,UAAU,qBAAqB,OAAO,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC3F,OAAO,KAAK,UAAU,qBAAqB,MAAM,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzF,aAAa,KAAK,UAAU,qBAAqB,YAAY,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACrG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,MAAA;AAAA,MAEhG,QAAQ;AAAA,QACP,mBAAmB,KAAK,UAAU,mBAAmB,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAAA,MAAA;AAAA,MAE9G,SAAS;AAAA,QACR,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,OAAO,KAAK,UAAU,oBAAoB,MAAM,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvF,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,MAAA;AAAA,MAE5F,OAAO;AAAA,QACN,IAAI,KAAK,UAAU,gBAAgB,GAAG,KAAK,KAAK,UAAU,eAAe;AAAA,QACzE,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,eAAe,KAAK,UAAU,qBAAqB,cAAc,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,4BAA4B,mBAAmB,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACjI,mBAAmB,KAAK,UAAU,iBAAiB,kBAAkB,KAAK,KAAK,UAAU,gBAAgB;AAAA,QACzG,eAAe,KAAK,UAAU,0BAA0B,cAAc,KAAK,KAAK,UAAU,yBAAyB;AAAA,QACnH,eAAe,KAAK,UAAU,2BAA2B,cAAc,KAAK,KAAK,UAAU,0BAA0B;AAAA,QACrH,cAAc,KAAK,UAAU,wBAAwB,aAAa,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC7G,SAAS,KAAK,UAAU,qBAAqB,QAAQ,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC7F,yBAAyB,MAAM;AAC9B,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QAClC;AAAA,MAAA;AAAA,MAED,UAAU;AAAA,QACT,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,uBAAuB,mBAAmB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QACvH,SAAS,KAAK,UAAU,wBAAwB,QAAQ,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAEnG,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,iBAAiB,KAAK,UAAU,8BAA8B,gBAAgB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC/H,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,kBAAkB,KAAK,UAAU,+BAA+B,iBAAiB,KAAK,KAAK,UAAU,8BAA8B;AAAA,QACnI,4BAA4B,KAAK,UAAU,8BAA8B,2BAA2B;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,0BAA0B,KAAK,UAAU,kCAAkC,yBAAyB;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,aAAa,KAAK,UAAU,kCAAkC,YAAY,KAAK,KAAK,UAAU,iCAAiC;AAAA,QAC/H,oBAAoB,KAAK,UAAU,8BAA8B,mBAAmB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAErI,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,WAAW,KAAK,UAAU,oBAAoB,UAAU,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC/F,QAAQ,KAAK,UAAU,4BAA4B,OAAO,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACzG,YAAY,KAAK,UAAU,2BAA2B,WAAW,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC/G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,8BAA8B,KAAK,UAAU,6CAA6C,6BAA6B;AAAA,UACtH,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,wBAAwB,KAAK,UAAU,6BAA6B,uBAAuB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC3I,yBAAyB,KAAK,UAAU,6BAA6B,wBAAwB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7I,uBAAuB,KAAK,UAAU,mCAAmC,sBAAsB;AAAA,UAC9F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,sBAAsB,KAAK,UAAU,mCAAmC,qBAAqB;AAAA,UAC5F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,iBAAiB,KAAK,UAAU,uBAAuB,gBAAgB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAEjH,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QACvI,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,uBAAuB,KAAK,UAAU,sCAAsC,sBAAsB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,yBAAyB,aAAa,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAC/G,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QACrH,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAErH,iBAAiB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAEnI,wBAAwB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACpI,2BAA2B,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAE1I,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QAEvI,wBAAwB,KAAK,UAAU,oCAAoC,uBAAuB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,2BAA2B,KAAK,UAAU,oCAAoC,0BAA0B;AAAA,UACvG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,WAAW,KAAK,UAAU,8BAA8B,UAAU,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAEnH,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,MAAA;AAAA,IAC5H;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ResolverFactory.cjs","sources":["../../../../../packages/engine-tenant-api/src/resolvers/ResolverFactory.ts"],"sourcesContent":["import {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tEmailOtpMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tOtpMutationResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './mutation/index.js'\n\nimport { Resolvers } from '../schema/index.js'\nimport {\n\tApiKeyQueryResolver,\n\tAuthLogQueryResolver,\n\tMeQueryResolver,\n\tPersonQueryResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n} from './query/index.js'\nimport { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js'\nimport { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js'\nimport { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'\nimport { IDPQueryResolver } from './query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'\nimport { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'\nimport { EnablePersonMutationResolver } from './mutation/person/EnablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'\nimport { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'\nimport { CustomRoleMutationResolver } from './mutation/customRole/CustomRoleMutationResolver.js'\nimport { CustomRoleQueryResolver } from './query/CustomRoleQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'\nimport { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'\nimport { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'\nimport { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js'\n\nclass ResolverFactory {\n\tpublic constructor(\n\t\tprivate readonly resolvers: {\n\t\t\tmeQueryResolver: MeQueryResolver\n\t\t\tpersonQueryResolver: PersonQueryResolver\n\t\t\tprojectQueryResolver: ProjectQueryResolver\n\t\t\tprojectMembersQueryResolver: ProjectMembersQueryResolver\n\t\t\tidpQueryResolver: IDPQueryResolver\n\t\t\tmailTemplateQueryResolver: MailTemplateQueryResolver\n\n\t\t\tsignUpMutationResolver: SignUpMutationResolver\n\t\t\tsignInMutationResolver: SignInMutationResolver\n\t\t\tsignOutMutationResolver: SignOutMutationResolver\n\t\t\tchangeProfileMutationResolver: ChangeProfileMutationResolver\n\t\t\tchangePasswordMutationResolver: ChangePasswordMutationResolver\n\t\t\tresetPasswordMutationResolver: ResetPasswordMutationResolver\n\t\t\temailVerificationMutationResolver: EmailVerificationMutationResolver\n\t\t\tidpMutationResolver: IDPMutationResolver\n\t\t\tregisterIdpMutationResolver: AddIDPMutationResolver\n\t\t\tdisableIdpMutationResolver: DisableIDPMutationResolver\n\t\t\tenableIdpMutationResolver: EnableIDPMutationResolver\n\t\t\tupdateIdpMutationResolver: UpdateIDPMutationResolver\n\t\t\tdisconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver\n\t\t\tpasswordlessMutationResolver: PasswordlessMutationResolver\n\n\t\t\tdisablePersonMutationResolver: DisablePersonMutationResolver\n\t\t\tenablePersonMutationResolver: EnablePersonMutationResolver\n\t\t\tforceSignOutMutationResolver: ForceSignOutMutationResolver\n\t\t\tresetPersonMfaMutationResolver: ResetPersonMfaMutationResolver\n\t\t\trevokeSessionMutationResolver: RevokeSessionMutationResolver\n\n\t\t\tinviteMutationResolver: InviteMutationResolver\n\t\t\taddProjectMemberMutationResolver: AddProjectMemberMutationResolver\n\t\t\tupdateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver\n\t\t\tremoveProjectMemberMutationResolver: RemoveProjectMemberMutationResolver\n\n\t\t\tcreateApiKeyMutationResolver: CreateApiKeyMutationResolver\n\t\t\tdisableApiKeyMutationResolver: DisableApiKeyMutationResolver\n\n\t\t\totpMutationResolver: OtpMutationResolver\n\t\t\temailOtpMutationResolver: EmailOtpMutationResolver\n\t\t\tregenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver\n\n\t\t\tmailTemplateMutationResolver: MailTemplateMutationResolver\n\n\t\t\tcreateProjectMutationResolver: CreateProjectMutationResolver\n\t\t\tsetProjectSecretMutationResolver: SetProjectSecretMutationResolver\n\t\t\tupdateProjectMutationResolver: UpdateProjectMutationResolver\n\n\t\t\tidentityTypeResolver: IdentityTypeResolver\n\t\t\tpersonTypeResolver: PersonTypeResolver\n\t\t\tprojectTypeResolver: ProjectTypeResolver\n\n\t\t\tidentityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver\n\n\t\t\tconfigurationMutationResolver: ConfigurationMutationResolver\n\t\t\tconfigurationQueryResolver: ConfigurationQueryResolver\n\n\t\t\tauthPolicyMutationResolver: AuthPolicyMutationResolver\n\t\t\tauthPolicyQueryResolver: AuthPolicyQueryResolver\n\n\t\t\tcustomRoleMutationResolver: CustomRoleMutationResolver\n\t\t\tcustomRoleQueryResolver: CustomRoleQueryResolver\n\n\t\t\tauthLogQueryResolver: AuthLogQueryResolver\n\t\t\tapiKeyQueryResolver: ApiKeyQueryResolver\n\n\t\t\ttogglePasswordlessMutationResolver: TogglePasswordlessMutationResolver\n\t\t},\n\t) {}\n\n\tcreate(): Resolvers & { Mutation: Required<Resolvers['Mutation']> } & { Query: Required<Resolvers['Query']> } {\n\t\treturn {\n\t\t\tJson: JSONType,\n\t\t\tDateTime: DateTimeType,\n\t\t\tInterval: IntervalType,\n\t\t\tIdentity: {\n\t\t\t\tprojects: this.resolvers.identityTypeResolver.projects.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tperson: this.resolvers.identityTypeResolver.person.bind(this.resolvers.identityTypeResolver),\n\t\t\t\troles: this.resolvers.identityTypeResolver.roles.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tpermissions: this.resolvers.identityTypeResolver.permissions.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tsessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver),\n\t\t\t},\n\t\t\tPerson: {\n\t\t\t\tidentityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),\n\t\t\t\tpasswordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),\n\t\t\t\tpasswordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver),\n\t\t\t},\n\t\t\tProject: {\n\t\t\t\tmembers: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),\n\t\t\t\troles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tapiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tsecrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tpermissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver),\n\t\t\t},\n\t\t\tQuery: {\n\t\t\t\tme: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),\n\t\t\t\tpersonById: this.resolvers.personQueryResolver.personById.bind(this.resolvers.personQueryResolver),\n\t\t\t\tpersons: this.resolvers.personQueryResolver.persons.bind(this.resolvers.personQueryResolver),\n\t\t\t\tglobalApiKeys: this.resolvers.apiKeyQueryResolver.globalApiKeys.bind(this.resolvers.apiKeyQueryResolver),\n\t\t\t\tprojectBySlug: this.resolvers.projectQueryResolver.projectBySlug.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojects: this.resolvers.projectQueryResolver.projects.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),\n\t\t\t\tidentityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),\n\t\t\t\tmailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),\n\t\t\t\tconfiguration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),\n\t\t\t\tauthPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),\n\t\t\t\tcustomRoles: this.resolvers.customRoleQueryResolver.customRoles.bind(this.resolvers.customRoleQueryResolver),\n\t\t\t\tcustomRolePermissions: this.resolvers.customRoleQueryResolver.customRolePermissions.bind(this.resolvers.customRoleQueryResolver),\n\t\t\t\tauthLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),\n\t\t\t\tcheckResetPasswordToken: () => {\n\t\t\t\t\tthrow new Error('not implemented')\n\t\t\t\t},\n\t\t\t},\n\t\t\tMutation: {\n\t\t\t\tsignUp: this.resolvers.signUpMutationResolver.signUp.bind(this.resolvers.signUpMutationResolver),\n\t\t\t\tsignIn: this.resolvers.signInMutationResolver.signIn.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tcreateSessionToken: this.resolvers.signInMutationResolver.createSessionToken.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tsignOut: this.resolvers.signOutMutationResolver.signOut.bind(this.resolvers.signOutMutationResolver),\n\n\t\t\t\tchangeProfile: this.resolvers.changeProfileMutationResolver.changeProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangeMyProfile: this.resolvers.changeProfileMutationResolver.changeMyProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangePassword: this.resolvers.changePasswordMutationResolver.changePassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tchangeMyPassword: this.resolvers.changePasswordMutationResolver.changeMyPassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tcreateResetPasswordRequest: this.resolvers.resetPasswordMutationResolver.createResetPasswordRequest.bind(\n\t\t\t\t\tthis.resolvers.resetPasswordMutationResolver,\n\t\t\t\t),\n\t\t\t\tresetPassword: this.resolvers.resetPasswordMutationResolver.resetPassword.bind(this.resolvers.resetPasswordMutationResolver),\n\n\t\t\t\trequestEmailVerification: this.resolvers.emailVerificationMutationResolver.requestEmailVerification.bind(\n\t\t\t\t\tthis.resolvers.emailVerificationMutationResolver,\n\t\t\t\t),\n\t\t\t\tverifyEmail: this.resolvers.emailVerificationMutationResolver.verifyEmail.bind(this.resolvers.emailVerificationMutationResolver),\n\t\t\t\tconfirmEmailChange: this.resolvers.changeProfileMutationResolver.confirmEmailChange.bind(this.resolvers.changeProfileMutationResolver),\n\n\t\t\t\tinitSignInIDP: this.resolvers.idpMutationResolver.initSignInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\tsignInIDP: this.resolvers.idpMutationResolver.signInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\taddIDP: this.resolvers.registerIdpMutationResolver.addIDP.bind(this.resolvers.registerIdpMutationResolver),\n\t\t\t\tdisableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),\n\t\t\t\tenableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),\n\t\t\t\tupdateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),\n\t\t\t\tdisconnectMyIdentityProvider: this.resolvers.disconnectMyIdentityProviderMutationResolver.disconnectMyIdentityProvider.bind(\n\t\t\t\t\tthis.resolvers.disconnectMyIdentityProviderMutationResolver,\n\t\t\t\t),\n\t\t\t\tdisablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),\n\t\t\t\tenablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),\n\t\t\t\tforceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),\n\t\t\t\tresetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),\n\t\t\t\trevokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),\n\n\t\t\t\tsignInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tinitSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tactivatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tdisableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\t\t\t\tenableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinvite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),\n\t\t\t\tunmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),\n\n\t\t\t\taddProjectMember: this.resolvers.addProjectMemberMutationResolver.addProjectMember.bind(this.resolvers.addProjectMemberMutationResolver),\n\t\t\t\tupdateProjectMember: this.resolvers.updateProjectMemberMutationResolver.updateProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveProjectMember: this.resolvers.removeProjectMemberMutationResolver.removeProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tcreateApiKey: this.resolvers.createApiKeyMutationResolver.createApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tcreateGlobalApiKey: this.resolvers.createApiKeyMutationResolver.createGlobalApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tdisableApiKey: this.resolvers.disableApiKeyMutationResolver.disableApiKey.bind(this.resolvers.disableApiKeyMutationResolver),\n\n\t\t\t\tprepareOtp: this.resolvers.otpMutationResolver.prepareOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tconfirmOtp: this.resolvers.otpMutationResolver.confirmOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tdisableOtp: this.resolvers.otpMutationResolver.disableOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tregenerateBackupCodes: this.resolvers.regenerateBackupCodesMutationResolver.regenerateBackupCodes.bind(\n\t\t\t\t\tthis.resolvers.regenerateBackupCodesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinitEmailOtp: this.resolvers.emailOtpMutationResolver.initEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tconfirmEmailOtp: this.resolvers.emailOtpMutationResolver.confirmEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tdisableEmailOtp: this.resolvers.emailOtpMutationResolver.disableEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\n\t\t\t\taddMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\taddProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\tcreateProject: this.resolvers.createProjectMutationResolver.createProject.bind(this.resolvers.createProjectMutationResolver),\n\t\t\t\tupdateProject: this.resolvers.updateProjectMutationResolver.updateProject.bind(this.resolvers.updateProjectMutationResolver),\n\t\t\t\tsetProjectSecret: this.resolvers.setProjectSecretMutationResolver.setProjectSecret.bind(this.resolvers.setProjectSecretMutationResolver),\n\n\t\t\t\taddGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tconfigure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),\n\n\t\t\t\tcreateAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tupdateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tdeleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\n\t\t\t\tcreateCustomRole: this.resolvers.customRoleMutationResolver.createCustomRole.bind(this.resolvers.customRoleMutationResolver),\n\t\t\t\tupdateCustomRole: this.resolvers.customRoleMutationResolver.updateCustomRole.bind(this.resolvers.customRoleMutationResolver),\n\t\t\t\tdeleteCustomRole: this.resolvers.customRoleMutationResolver.deleteCustomRole.bind(this.resolvers.customRoleMutationResolver),\n\t\t\t},\n\t\t}\n\t}\n}\n\nnamespace ResolverFactory {\n\texport type FieldResolverArgs = {\n\t\t[argument: string]: any\n\t}\n}\n\nexport { ResolverFactory }\n"],"names":["JSONType","DateTimeType","IntervalType"],"mappings":";;;AAyDA,MAAM,gBAAgB;AAAA,EACd,YACW,WAmEhB;AAnEgB,SAAA,YAAA;AAAA,EAmEf;AAAA,EAEH,SAA8G;AAC7G,WAAO;AAAA,MACN,MAAMA,aAAAA;AAAAA,MACN,UAAUC,aAAAA;AAAAA,MACV,UAAUC,aAAAA;AAAAA,MACV,UAAU;AAAA,QACT,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,QAAQ,KAAK,UAAU,qBAAqB,OAAO,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC3F,OAAO,KAAK,UAAU,qBAAqB,MAAM,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzF,aAAa,KAAK,UAAU,qBAAqB,YAAY,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACrG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,MAAA;AAAA,MAEhG,QAAQ;AAAA,QACP,mBAAmB,KAAK,UAAU,mBAAmB,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAAA,QAC7G,uBAAuB,KAAK,UAAU,mBAAmB,sBAAsB,KAAK,KAAK,UAAU,kBAAkB;AAAA,QACrH,yBAAyB,KAAK,UAAU,mBAAmB,wBAAwB,KAAK,KAAK,UAAU,kBAAkB;AAAA,MAAA;AAAA,MAE1H,SAAS;AAAA,QACR,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,OAAO,KAAK,UAAU,oBAAoB,MAAM,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvF,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,aAAa,KAAK,UAAU,oBAAoB,YAAY,KAAK,KAAK,UAAU,mBAAmB;AAAA,MAAA;AAAA,MAEpG,OAAO;AAAA,QACN,IAAI,KAAK,UAAU,gBAAgB,GAAG,KAAK,KAAK,UAAU,eAAe;AAAA,QACzE,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,eAAe,KAAK,UAAU,qBAAqB,cAAc,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,4BAA4B,mBAAmB,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACjI,mBAAmB,KAAK,UAAU,iBAAiB,kBAAkB,KAAK,KAAK,UAAU,gBAAgB;AAAA,QACzG,eAAe,KAAK,UAAU,0BAA0B,cAAc,KAAK,KAAK,UAAU,yBAAyB;AAAA,QACnH,eAAe,KAAK,UAAU,2BAA2B,cAAc,KAAK,KAAK,UAAU,0BAA0B;AAAA,QACrH,cAAc,KAAK,UAAU,wBAAwB,aAAa,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC7G,aAAa,KAAK,UAAU,wBAAwB,YAAY,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC3G,uBAAuB,KAAK,UAAU,wBAAwB,sBAAsB,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC/H,SAAS,KAAK,UAAU,qBAAqB,QAAQ,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC7F,yBAAyB,MAAM;AAC9B,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QAClC;AAAA,MAAA;AAAA,MAED,UAAU;AAAA,QACT,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,uBAAuB,mBAAmB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QACvH,SAAS,KAAK,UAAU,wBAAwB,QAAQ,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAEnG,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,iBAAiB,KAAK,UAAU,8BAA8B,gBAAgB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC/H,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,kBAAkB,KAAK,UAAU,+BAA+B,iBAAiB,KAAK,KAAK,UAAU,8BAA8B;AAAA,QACnI,4BAA4B,KAAK,UAAU,8BAA8B,2BAA2B;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,0BAA0B,KAAK,UAAU,kCAAkC,yBAAyB;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,aAAa,KAAK,UAAU,kCAAkC,YAAY,KAAK,KAAK,UAAU,iCAAiC;AAAA,QAC/H,oBAAoB,KAAK,UAAU,8BAA8B,mBAAmB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAErI,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,WAAW,KAAK,UAAU,oBAAoB,UAAU,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC/F,QAAQ,KAAK,UAAU,4BAA4B,OAAO,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACzG,YAAY,KAAK,UAAU,2BAA2B,WAAW,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC/G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,8BAA8B,KAAK,UAAU,6CAA6C,6BAA6B;AAAA,UACtH,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,wBAAwB,KAAK,UAAU,6BAA6B,uBAAuB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC3I,yBAAyB,KAAK,UAAU,6BAA6B,wBAAwB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7I,uBAAuB,KAAK,UAAU,mCAAmC,sBAAsB;AAAA,UAC9F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,sBAAsB,KAAK,UAAU,mCAAmC,qBAAqB;AAAA,UAC5F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,iBAAiB,KAAK,UAAU,uBAAuB,gBAAgB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAEjH,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QACvI,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,uBAAuB,KAAK,UAAU,sCAAsC,sBAAsB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,yBAAyB,aAAa,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAC/G,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QACrH,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAErH,iBAAiB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAEnI,wBAAwB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACpI,2BAA2B,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAE1I,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QAEvI,wBAAwB,KAAK,UAAU,oCAAoC,uBAAuB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,2BAA2B,KAAK,UAAU,oCAAoC,0BAA0B;AAAA,UACvG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,WAAW,KAAK,UAAU,8BAA8B,UAAU,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAEnH,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAE3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,MAAA;AAAA,IAC5H;AAAA,EAEF;AACD;;"}