@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}
+{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createTargetIdentityPermissionTarget, PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\t// cheap gate first, so a caller holding the permission in no form cannot probe identity existence\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tif (before === undefined) {\n\t\t\treturn createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({\n\t\t\t\trequestedRoles: roles,\n\t\t\t\ttarget: await createTargetIdentityPermissionTarget(context.db, before),\n\t\t\t\tself: identityId === context.identity.id,\n\t\t\t}),\n\t\t\tmessage: 'You are not allowed to add these global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before.roles)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tif (before === undefined) {\n\t\t\treturn createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({\n\t\t\t\trequestedRoles: roles,\n\t\t\t\ttarget: await createTargetIdentityPermissionTarget(context.db, before),\n\t\t\t\tself: identityId === context.identity.id,\n\t\t\t}),\n\t\t\tmessage: 'You are not allowed to remove these global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before.roles)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","createTargetIdentityPermissionTarget","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAE1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,QAAI,WAAW,QAAW;AACzB,aAAOC,WAAAA,oBAAoB,sBAAsB,YAAY,UAAU,YAAY;AAAA,IACpF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAA0B;AAAA,QACnD,gBAAgB;AAAA,QAChB,QAAQ,MAAMG,yBAAAA,qCAAqC,QAAQ,IAAI,MAAM;AAAA,QACrE,MAAM,eAAe,QAAQ,SAAS;AAAA,MAAA,CACtC;AAAA,MACD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AACnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOD,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,OAAO,KAAK;AAEhF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,QAAI,WAAW,QAAW;AACzB,aAAOC,WAAAA,oBAAoB,sBAAsB,YAAY,UAAU,YAAY;AAAA,IACpF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B;AAAA,QACtD,gBAAgB;AAAA,QAChB,QAAQ,MAAMG,yBAAAA,qCAAqC,QAAQ,IAAI,MAAM;AAAA,QACrE,MAAM,eAAe,QAAQ,SAAS;AAAA,MAAA,CACtC;AAAA,MACD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AACtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOD,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,OAAO,KAAK;AAEjF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIG,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}

package/dist/production/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js

@@ -1,17 +1,20 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { PersonByIdentityBatchQuery } from "../../../model/queries/person/PersonByIdentityBatchQuery.js";
+import { IdentityQuery } from "../../../model/queries/identity/IdentityQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import { createTargetIdentityPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonByIdentityBatchQuery } from "../../../model/queries/person/PersonByIdentityBatchQuery.js";
-import { IdentityQuery } from "../../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +22,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class IdentityGlobalRolesMutationResolver {
@@ -28,15 +30,26 @@ class IdentityGlobalRolesMutationResolver {
   }
   async addGlobalIdentityRoles(parent, { roles, identityId }, context, info) {
     await context.requireAccess({
-      action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
+      action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),
       message: "You are not allowed to add global roles"
     });
     const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]));
+    if (before === void 0) {
+      return createErrorResponse("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    await context.requireAccess({
+      action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({
+        requestedRoles: roles,
+        target: await createTargetIdentityPermissionTarget(context.db, before),
+        self: identityId === context.identity.id
+      }),
+      message: "You are not allowed to add these global roles"
+    });
     const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
-    await this.logRolesChange(context, identityId, "global_role_grant", before?.roles ?? []);
+    await this.logRolesChange(context, identityId, "global_role_grant", before.roles);
     return {
       ok: true,
       result: {
@@ -46,15 +59,26 @@ class IdentityGlobalRolesMutationResolver {
   }
   async removeGlobalIdentityRoles(parent, { roles, identityId }, context, info) {
     await context.requireAccess({
-      action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
+      action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),
       message: "You are not allowed to remove global roles"
     });
     const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]));
+    if (before === void 0) {
+      return createErrorResponse("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    await context.requireAccess({
+      action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({
+        requestedRoles: roles,
+        target: await createTargetIdentityPermissionTarget(context.db, before),
+        self: identityId === context.identity.id
+      }),
+      message: "You are not allowed to remove these global roles"
+    });
     const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles);
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);
     }
-    await this.logRolesChange(context, identityId, "global_role_revoke", before?.roles ?? []);
+    await this.logRolesChange(context, identityId, "global_role_revoke", before.roles);
     return {
       ok: true,
       result: {

package/dist/production/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}
+{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createTargetIdentityPermissionTarget, PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\t// cheap gate first, so a caller holding the permission in no form cannot probe identity existence\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tif (before === undefined) {\n\t\t\treturn createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({\n\t\t\t\trequestedRoles: roles,\n\t\t\t\ttarget: await createTargetIdentityPermissionTarget(context.db, before),\n\t\t\t\tself: identityId === context.identity.id,\n\t\t\t}),\n\t\t\tmessage: 'You are not allowed to add these global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before.roles)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tif (before === undefined) {\n\t\t\treturn createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({\n\t\t\t\trequestedRoles: roles,\n\t\t\t\ttarget: await createTargetIdentityPermissionTarget(context.db, before),\n\t\t\t\tself: identityId === context.identity.id,\n\t\t\t}),\n\t\t\tmessage: 'You are not allowed to remove these global roles',\n\t\t})\n\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before.roles)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAE1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,QAAI,WAAW,QAAW;AACzB,aAAO,oBAAoB,sBAAsB,YAAY,UAAU,YAAY;AAAA,IACpF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,QACnD,gBAAgB;AAAA,QAChB,QAAQ,MAAM,qCAAqC,QAAQ,IAAI,MAAM;AAAA,QACrE,MAAM,eAAe,QAAQ,SAAS;AAAA,MAAA,CACtC;AAAA,MACD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AACnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,OAAO,KAAK;AAEhF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,QAAI,WAAW,QAAW;AACzB,aAAO,oBAAoB,sBAAsB,YAAY,UAAU,YAAY;AAAA,IACpF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B;AAAA,QACtD,gBAAgB;AAAA,QAChB,QAAQ,MAAM,qCAAqC,QAAQ,IAAI,MAAM;AAAA,QACrE,MAAM,eAAe,QAAQ,SAAS;AAAA,MAAA,CACtC;AAAA,MACD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AACtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,OAAO,KAAK;AAEjF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}

package/dist/production/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const audit = require("./audit.cjs");
@@ -42,7 +44,8 @@ class AddIDPMutationResolver {
         exclusive: args.options?.exclusive ?? false,
         initReturnsConfig: args.options?.initReturnsConfig ?? false,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false
       }
     });
     if (!result.ok) {

package/dist/production/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","IdentityProviderBySlugQuery","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAOC,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","IdentityProviderBySlugQuery","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAOC,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/idp/AddIDPMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { idpRowToAuditSnapshot } from "./audit.js";
@@ -40,7 +42,8 @@ class AddIDPMutationResolver {
         exclusive: args.options?.exclusive ?? false,
         initReturnsConfig: args.options?.initReturnsConfig ?? false,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false
       }
     });
     if (!result.ok) {

package/dist/production/src/resolvers/mutation/idp/AddIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisableIDPMutationResolver {

package/dist/production/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/idp/DisableIDPMutationResolver.js

@@ -1,15 +1,18 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisableIDPMutationResolver {

package/dist/production/src/resolvers/mutation/idp/DisableIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"DisableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisconnectMyIdentityProviderMutationResolver {

package/dist/production/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisconnectMyIdentityProviderMutationResolver {

package/dist/production/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/idp/EnableIDPMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class EnableIDPMutationResolver {

package/dist/production/src/resolvers/mutation/idp/EnableIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EnableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"EnableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/idp/EnableIDPMutationResolver.js

@@ -1,15 +1,18 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class EnableIDPMutationResolver {

package/dist/production/src/resolvers/mutation/idp/EnableIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"EnableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"EnableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}