@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}
+{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js

@@ -1,15 +1,18 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}
+{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}
+{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js

@@ -1,15 +1,18 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}
+{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}

package/dist/development/src/resolvers/mutation/customRole/CustomRoleMutationResolver.cjs

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
+require("node:assert");
+require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+require("../../../model/service/idp/providers/AppleProvider.cjs");
+require("openid-client");
+require("@contember/typesafe");
+require("../../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
+require("../../../model/service/idp/providers/FacebookProvider.cjs");
+require("../../../model/service/AuthLogService.cjs");
+const CustomRoleManager = require("../../../model/service/CustomRoleManager.cjs");
+require("otpauth");
+const errorUtils = require("../../errorUtils.cjs");
+class CustomRoleMutationResolver {
+  constructor(customRoleManager) {
+    this.customRoleManager = customRoleManager;
+  }
+  async createCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    let result;
+    try {
+      result = await context.db.transaction(async (db) => {
+        const result2 = await this.customRoleManager.createRole(db, {
+          slug: args.slug,
+          description: args.description ?? null,
+          grants: args.grants
+        });
+        if (result2.ok) {
+          await context.logAuthAction({
+            type: "custom_role_change",
+            response: new Response.ResponseOk(null),
+            eventData: {
+              operation: "create",
+              after: result2.result.role
+            }
+          }, db);
+        }
+        return result2;
+      }, { isolation: "readCommitted" });
+    } catch (error) {
+      if (CustomRoleManager.CustomRoleManager.isSlugConflict(error)) {
+        return errorUtils.createErrorResponse("SLUG_ALREADY_EXISTS", `Custom role ${args.slug} already exists`);
+      }
+      throw error;
+    }
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async updateCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    const result = await context.db.transaction(async (db) => {
+      const result2 = await this.customRoleManager.updateRole(db, args.slug, {
+        description: args.description,
+        grants: args.grants
+      });
+      if (result2.ok) {
+        await context.logAuthAction({
+          type: "custom_role_change",
+          response: new Response.ResponseOk(null),
+          eventData: {
+            operation: "update",
+            before: result2.result.before,
+            after: result2.result.after
+          }
+        }, db);
+      }
+      return result2;
+    }, { isolation: "readCommitted" });
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async deleteCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    const result = await context.db.transaction(async (db) => {
+      const result2 = await this.customRoleManager.deleteRole(db, args.slug);
+      if (result2.ok) {
+        await context.logAuthAction({
+          type: "custom_role_change",
+          response: new Response.ResponseOk(null),
+          eventData: {
+            operation: "delete",
+            before: result2.result.before,
+            removedAssignments: result2.result.removedAssignments,
+            removedAssignmentIdentityIds: [...result2.result.removedAssignmentIdentityIds]
+          }
+        }, db);
+      }
+      return result2;
+    }, { isolation: "readCommitted" });
+    if (!result.ok) {
+      return errorUtils.createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+exports.CustomRoleMutationResolver = CustomRoleMutationResolver;
+//# sourceMappingURL=CustomRoleMutationResolver.cjs.map

package/dist/development/src/resolvers/mutation/customRole/CustomRoleMutationResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/customRole/CustomRoleMutationResolver.ts"],"sourcesContent":["import {\n\tCreateCustomRoleResponse,\n\tDeleteCustomRoleResponse,\n\tMutationCreateCustomRoleArgs,\n\tMutationDeleteCustomRoleArgs,\n\tMutationResolvers,\n\tMutationUpdateCustomRoleArgs,\n\tUpdateCustomRoleResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CustomRoleManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * CRUD over `custom_role` (runtime-defined global roles). Gated by `customRole:manage`,\n * which is deliberately NOT grantable to a custom role — by default only SUPER_ADMIN\n * (via the wildcard grant) can manage role definitions.\n */\nexport class CustomRoleMutationResolver implements Pick<MutationResolvers, 'createCustomRole' | 'updateCustomRole' | 'deleteCustomRole'> {\n\tconstructor(\n\t\tprivate readonly customRoleManager: CustomRoleManager,\n\t) {}\n\n\tasync createCustomRole(parent: any, args: MutationCreateCustomRoleArgs, context: TenantResolverContext): Promise<CreateCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\t// the conflict is caught out here: a unique violation aborts the transaction, so\n\t\t// mapping it inside would return normally and then fail on COMMIT\n\t\tlet result\n\t\ttry {\n\t\t\tresult = await context.db.transaction(async db => {\n\t\t\t\tconst result = await this.customRoleManager.createRole(db, {\n\t\t\t\t\tslug: args.slug,\n\t\t\t\t\tdescription: args.description ?? null,\n\t\t\t\t\tgrants: args.grants,\n\t\t\t\t})\n\t\t\t\tif (result.ok) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\teventData: {\n\t\t\t\t\t\t\toperation: 'create',\n\t\t\t\t\t\t\tafter: result.result.role,\n\t\t\t\t\t\t},\n\t\t\t\t\t}, db)\n\t\t\t\t}\n\t\t\t\treturn result\n\t\t\t}, { isolation: 'readCommitted' })\n\t\t} catch (error) {\n\t\t\tif (CustomRoleManager.isSlugConflict(error)) {\n\t\t\t\treturn createErrorResponse('SLUG_ALREADY_EXISTS', `Custom role ${args.slug} already exists`)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync updateCustomRole(parent: any, args: MutationUpdateCustomRoleArgs, context: TenantResolverContext): Promise<UpdateCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\tconst result = await context.db.transaction(async db => {\n\t\t\tconst result = await this.customRoleManager.updateRole(db, args.slug, {\n\t\t\t\tdescription: args.description,\n\t\t\t\tgrants: args.grants,\n\t\t\t})\n\t\t\tif (result.ok) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\teventData: {\n\t\t\t\t\t\toperation: 'update',\n\t\t\t\t\t\tbefore: result.result.before,\n\t\t\t\t\t\tafter: result.result.after,\n\t\t\t\t\t},\n\t\t\t\t}, db)\n\t\t\t}\n\t\t\treturn result\n\t\t}, { isolation: 'readCommitted' })\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteCustomRole(parent: any, args: MutationDeleteCustomRoleArgs, context: TenantResolverContext): Promise<DeleteCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\tconst result = await context.db.transaction(async db => {\n\t\t\tconst result = await this.customRoleManager.deleteRole(db, args.slug)\n\t\t\tif (result.ok) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\teventData: {\n\t\t\t\t\t\toperation: 'delete',\n\t\t\t\t\t\tbefore: result.result.before,\n\t\t\t\t\t\tremovedAssignments: result.result.removedAssignments,\n\t\t\t\t\t\tremovedAssignmentIdentityIds: [...result.result.removedAssignmentIdentityIds],\n\t\t\t\t\t},\n\t\t\t\t}, db)\n\t\t\t}\n\t\t\treturn result\n\t\t}, { isolation: 'readCommitted' })\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","result","ResponseOk","CustomRoleManager","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAID,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACjD,cAAMC,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI;AAAA,UAC1D,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,QAAQ,KAAK;AAAA,QAAA,CACb;AACD,YAAIA,QAAO,IAAI;AACd,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,WAAW;AAAA,cACV,WAAW;AAAA,cACX,OAAOD,QAAO,OAAO;AAAA,YAAA;AAAA,UACtB,GACE,EAAE;AAAA,QACN;AACA,eAAOA;AAAAA,MACR,GAAG,EAAE,WAAW,iBAAiB;AAAA,IAClC,SAAS,OAAO;AACf,UAAIE,kBAAAA,kBAAkB,eAAe,KAAK,GAAG;AAC5C,eAAOC,WAAAA,oBAAoB,uBAAuB,eAAe,KAAK,IAAI,iBAAiB;AAAA,MAC5F;AACA,YAAM;AAAA,IACP;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQJ,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACvD,YAAMC,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI,KAAK,MAAM;AAAA,QACrE,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,MAAA,CACb;AACD,UAAIA,QAAO,IAAI;AACd,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,UAC7B,WAAW;AAAA,YACV,WAAW;AAAA,YACX,QAAQD,QAAO,OAAO;AAAA,YACtB,OAAOA,QAAO,OAAO;AAAA,UAAA;AAAA,QACtB,GACE,EAAE;AAAA,MACN;AACA,aAAOA;AAAAA,IACR,GAAG,EAAE,WAAW,iBAAiB;AACjC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOG,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQJ,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACvD,YAAMC,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI,KAAK,IAAI;AACpE,UAAIA,QAAO,IAAI;AACd,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,UAC7B,WAAW;AAAA,YACV,WAAW;AAAA,YACX,QAAQD,QAAO,OAAO;AAAA,YACtB,oBAAoBA,QAAO,OAAO;AAAA,YAClC,8BAA8B,CAAC,GAAGA,QAAO,OAAO,4BAA4B;AAAA,UAAA;AAAA,QAC7E,GACE,EAAE;AAAA,MACN;AACA,aAAOA;AAAAA,IACR,GAAG,EAAE,WAAW,iBAAiB;AACjC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOG,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/customRole/CustomRoleMutationResolver.js

@@ -0,0 +1,124 @@
+import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
+import "node:assert";
+import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import "../../../model/service/idp/providers/AppleProvider.js";
+import "openid-client";
+import "@contember/typesafe";
+import "../../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
+import "../../../model/service/idp/providers/FacebookProvider.js";
+import "../../../model/service/AuthLogService.js";
+import { CustomRoleManager } from "../../../model/service/CustomRoleManager.js";
+import "otpauth";
+import { createErrorResponse } from "../../errorUtils.js";
+class CustomRoleMutationResolver {
+  constructor(customRoleManager) {
+    this.customRoleManager = customRoleManager;
+  }
+  async createCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    let result;
+    try {
+      result = await context.db.transaction(async (db) => {
+        const result2 = await this.customRoleManager.createRole(db, {
+          slug: args.slug,
+          description: args.description ?? null,
+          grants: args.grants
+        });
+        if (result2.ok) {
+          await context.logAuthAction({
+            type: "custom_role_change",
+            response: new ResponseOk(null),
+            eventData: {
+              operation: "create",
+              after: result2.result.role
+            }
+          }, db);
+        }
+        return result2;
+      }, { isolation: "readCommitted" });
+    } catch (error) {
+      if (CustomRoleManager.isSlugConflict(error)) {
+        return createErrorResponse("SLUG_ALREADY_EXISTS", `Custom role ${args.slug} already exists`);
+      }
+      throw error;
+    }
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async updateCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    const result = await context.db.transaction(async (db) => {
+      const result2 = await this.customRoleManager.updateRole(db, args.slug, {
+        description: args.description,
+        grants: args.grants
+      });
+      if (result2.ok) {
+        await context.logAuthAction({
+          type: "custom_role_change",
+          response: new ResponseOk(null),
+          eventData: {
+            operation: "update",
+            before: result2.result.before,
+            after: result2.result.after
+          }
+        }, db);
+      }
+      return result2;
+    }, { isolation: "readCommitted" });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+  async deleteCustomRole(parent, args, context) {
+    await context.requireAccess({
+      action: PermissionActions.CUSTOM_ROLE_MANAGE,
+      message: "You are not allowed to manage custom roles"
+    });
+    const result = await context.db.transaction(async (db) => {
+      const result2 = await this.customRoleManager.deleteRole(db, args.slug);
+      if (result2.ok) {
+        await context.logAuthAction({
+          type: "custom_role_change",
+          response: new ResponseOk(null),
+          eventData: {
+            operation: "delete",
+            before: result2.result.before,
+            removedAssignments: result2.result.removedAssignments,
+            removedAssignmentIdentityIds: [...result2.result.removedAssignmentIdentityIds]
+          }
+        }, db);
+      }
+      return result2;
+    }, { isolation: "readCommitted" });
+    if (!result.ok) {
+      return createErrorResponse(result.error, result.errorMessage);
+    }
+    return { ok: true };
+  }
+}
+export {
+  CustomRoleMutationResolver
+};
+//# sourceMappingURL=CustomRoleMutationResolver.js.map

package/dist/development/src/resolvers/mutation/customRole/CustomRoleMutationResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/customRole/CustomRoleMutationResolver.ts"],"sourcesContent":["import {\n\tCreateCustomRoleResponse,\n\tDeleteCustomRoleResponse,\n\tMutationCreateCustomRoleArgs,\n\tMutationDeleteCustomRoleArgs,\n\tMutationResolvers,\n\tMutationUpdateCustomRoleArgs,\n\tUpdateCustomRoleResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CustomRoleManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * CRUD over `custom_role` (runtime-defined global roles). Gated by `customRole:manage`,\n * which is deliberately NOT grantable to a custom role — by default only SUPER_ADMIN\n * (via the wildcard grant) can manage role definitions.\n */\nexport class CustomRoleMutationResolver implements Pick<MutationResolvers, 'createCustomRole' | 'updateCustomRole' | 'deleteCustomRole'> {\n\tconstructor(\n\t\tprivate readonly customRoleManager: CustomRoleManager,\n\t) {}\n\n\tasync createCustomRole(parent: any, args: MutationCreateCustomRoleArgs, context: TenantResolverContext): Promise<CreateCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\t// the conflict is caught out here: a unique violation aborts the transaction, so\n\t\t// mapping it inside would return normally and then fail on COMMIT\n\t\tlet result\n\t\ttry {\n\t\t\tresult = await context.db.transaction(async db => {\n\t\t\t\tconst result = await this.customRoleManager.createRole(db, {\n\t\t\t\t\tslug: args.slug,\n\t\t\t\t\tdescription: args.description ?? null,\n\t\t\t\t\tgrants: args.grants,\n\t\t\t\t})\n\t\t\t\tif (result.ok) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\teventData: {\n\t\t\t\t\t\t\toperation: 'create',\n\t\t\t\t\t\t\tafter: result.result.role,\n\t\t\t\t\t\t},\n\t\t\t\t\t}, db)\n\t\t\t\t}\n\t\t\t\treturn result\n\t\t\t}, { isolation: 'readCommitted' })\n\t\t} catch (error) {\n\t\t\tif (CustomRoleManager.isSlugConflict(error)) {\n\t\t\t\treturn createErrorResponse('SLUG_ALREADY_EXISTS', `Custom role ${args.slug} already exists`)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync updateCustomRole(parent: any, args: MutationUpdateCustomRoleArgs, context: TenantResolverContext): Promise<UpdateCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\tconst result = await context.db.transaction(async db => {\n\t\t\tconst result = await this.customRoleManager.updateRole(db, args.slug, {\n\t\t\t\tdescription: args.description,\n\t\t\t\tgrants: args.grants,\n\t\t\t})\n\t\t\tif (result.ok) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\teventData: {\n\t\t\t\t\t\toperation: 'update',\n\t\t\t\t\t\tbefore: result.result.before,\n\t\t\t\t\t\tafter: result.result.after,\n\t\t\t\t\t},\n\t\t\t\t}, db)\n\t\t\t}\n\t\t\treturn result\n\t\t}, { isolation: 'readCommitted' })\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteCustomRole(parent: any, args: MutationDeleteCustomRoleArgs, context: TenantResolverContext): Promise<DeleteCustomRoleResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CUSTOM_ROLE_MANAGE,\n\t\t\tmessage: 'You are not allowed to manage custom roles',\n\t\t})\n\n\t\tconst result = await context.db.transaction(async db => {\n\t\t\tconst result = await this.customRoleManager.deleteRole(db, args.slug)\n\t\t\tif (result.ok) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'custom_role_change',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\teventData: {\n\t\t\t\t\t\toperation: 'delete',\n\t\t\t\t\t\tbefore: result.result.before,\n\t\t\t\t\t\tremovedAssignments: result.result.removedAssignments,\n\t\t\t\t\t\tremovedAssignmentIdentityIds: [...result.result.removedAssignmentIdentityIds],\n\t\t\t\t\t},\n\t\t\t\t}, db)\n\t\t\t}\n\t\t\treturn result\n\t\t}, { isolation: 'readCommitted' })\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAmBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAID,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACjD,cAAMA,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI;AAAA,UAC1D,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,eAAe;AAAA,UACjC,QAAQ,KAAK;AAAA,QAAA,CACb;AACD,YAAIA,QAAO,IAAI;AACd,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,WAAW;AAAA,cACV,WAAW;AAAA,cACX,OAAOA,QAAO,OAAO;AAAA,YAAA;AAAA,UACtB,GACE,EAAE;AAAA,QACN;AACA,eAAOA;AAAAA,MACR,GAAG,EAAE,WAAW,iBAAiB;AAAA,IAClC,SAAS,OAAO;AACf,UAAI,kBAAkB,eAAe,KAAK,GAAG;AAC5C,eAAO,oBAAoB,uBAAuB,eAAe,KAAK,IAAI,iBAAiB;AAAA,MAC5F;AACA,YAAM;AAAA,IACP;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACvD,YAAMA,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI,KAAK,MAAM;AAAA,QACrE,aAAa,KAAK;AAAA,QAClB,QAAQ,KAAK;AAAA,MAAA,CACb;AACD,UAAIA,QAAO,IAAI;AACd,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAI,WAAW,IAAI;AAAA,UAC7B,WAAW;AAAA,YACV,WAAW;AAAA,YACX,QAAQA,QAAO,OAAO;AAAA,YACtB,OAAOA,QAAO,OAAO;AAAA,UAAA;AAAA,QACtB,GACE,EAAE;AAAA,MACN;AACA,aAAOA;AAAAA,IACR,GAAG,EAAE,WAAW,iBAAiB;AACjC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,MAAoC,SAAmE;AAC1I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,YAAY,OAAM,OAAM;AACvD,YAAMA,UAAS,MAAM,KAAK,kBAAkB,WAAW,IAAI,KAAK,IAAI;AACpE,UAAIA,QAAO,IAAI;AACd,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAI,WAAW,IAAI;AAAA,UAC7B,WAAW;AAAA,YACV,WAAW;AAAA,YACX,QAAQA,QAAO,OAAO;AAAA,YACtB,oBAAoBA,QAAO,OAAO;AAAA,YAClC,8BAA8B,CAAC,GAAGA,QAAO,OAAO,4BAA4B;AAAA,UAAA;AAAA,QAC7E,GACE,EAAE;AAAA,MACN;AACA,aAAOA;AAAAA,IACR,GAAG,EAAE,WAAW,iBAAiB;AACjC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs

@@ -2,18 +2,21 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const PersonByIdentityBatchQuery = require("../../../model/queries/person/PersonByIdentityBatchQuery.cjs");
+const IdentityQuery = require("../../../model/queries/identity/IdentityQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const PersonByIdentityBatchQuery = require("../../../model/queries/person/PersonByIdentityBatchQuery.cjs");
-const IdentityQuery = require("../../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +24,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class IdentityGlobalRolesMutationResolver {
@@ -30,15 +32,26 @@ class IdentityGlobalRolesMutationResolver {
   }
   async addGlobalIdentityRoles(parent, { roles, identityId }, context, info) {
     await context.requireAccess({
-      action: PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
+      action: PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),
       message: "You are not allowed to add global roles"
     });
     const [before] = await context.db.queryHandler.fetch(new IdentityQuery.IdentityQuery([identityId]));
+    if (before === void 0) {
+      return errorUtils.createErrorResponse("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({
+        requestedRoles: roles,
+        target: await TargetIdentityPermission.createTargetIdentityPermissionTarget(context.db, before),
+        self: identityId === context.identity.id
+      }),
+      message: "You are not allowed to add these global roles"
+    });
     const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
-    await this.logRolesChange(context, identityId, "global_role_grant", before?.roles ?? []);
+    await this.logRolesChange(context, identityId, "global_role_grant", before.roles);
     return {
       ok: true,
       result: {
@@ -48,15 +61,26 @@ class IdentityGlobalRolesMutationResolver {
   }
   async removeGlobalIdentityRoles(parent, { roles, identityId }, context, info) {
     await context.requireAccess({
-      action: PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
+      action: PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),
       message: "You are not allowed to remove global roles"
     });
     const [before] = await context.db.queryHandler.fetch(new IdentityQuery.IdentityQuery([identityId]));
+    if (before === void 0) {
+      return errorUtils.createErrorResponse("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    await context.requireAccess({
+      action: PermissionActions.PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({
+        requestedRoles: roles,
+        target: await TargetIdentityPermission.createTargetIdentityPermissionTarget(context.db, before),
+        self: identityId === context.identity.id
+      }),
+      message: "You are not allowed to remove these global roles"
+    });
     const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);
     }
-    await this.logRolesChange(context, identityId, "global_role_revoke", before?.roles ?? []);
+    await this.logRolesChange(context, identityId, "global_role_revoke", before.roles);
     return {
       ok: true,
       result: {