@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/idp/UpdateIDPMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const audit = require("./audit.cjs");
@@ -42,7 +44,8 @@ class UpdateIDPMutationResolver {
         exclusive: args.options?.exclusive ?? void 0,
         initReturnsConfig: args.options?.initReturnsConfig ?? void 0,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? void 0,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? void 0
       }
     }, args.mergeConfiguration ?? false);
     if (!result.ok) {

package/dist/production/src/resolvers/mutation/idp/UpdateIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","IdentityProviderBySlugQuery","createErrorResponse","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQC,MAAAA,sBAAsB,MAAM;AAAA,QACpC,OAAOA,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"UpdateIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","IdentityProviderBySlugQuery","createErrorResponse","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQC,MAAAA,sBAAsB,MAAM;AAAA,QACpC,OAAOA,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/idp/UpdateIDPMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { idpRowToAuditSnapshot } from "./audit.js";
@@ -40,7 +42,8 @@ class UpdateIDPMutationResolver {
         exclusive: args.options?.exclusive ?? void 0,
         initReturnsConfig: args.options?.initReturnsConfig ?? void 0,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? void 0,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? void 0
       }
     }, args.mergeConfiguration ?? false);
     if (!result.ok) {

package/dist/production/src/resolvers/mutation/idp/UpdateIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ,sBAAsB,MAAM;AAAA,QACpC,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"UpdateIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ,sBAAsB,MAAM;AAAA,QACpC,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/idp/audit.cjs

@@ -13,6 +13,7 @@ const idpRowToAuditSnapshot = (row) => {
     initReturnsConfig: row.initReturnsConfig,
     requireVerifiedEmail: row.requireVerifiedEmail,
     assumeEmailVerified: row.assumeEmailVerified,
+    disableLocalAuthentication: row.disableLocalAuthentication,
     configurationKeys: Object.keys(row.configuration).sort()
   };
 };

package/dist/production/src/resolvers/mutation/idp/audit.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"audit.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;;"}
+{"version":3,"file":"audit.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tdisableLocalAuthentication: row.disableLocalAuthentication,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,4BAA4B,IAAI;AAAA,IAChC,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;;"}

package/dist/production/src/resolvers/mutation/idp/audit.js

@@ -11,6 +11,7 @@ const idpRowToAuditSnapshot = (row) => {
     initReturnsConfig: row.initReturnsConfig,
     requireVerifiedEmail: row.requireVerifiedEmail,
     assumeEmailVerified: row.assumeEmailVerified,
+    disableLocalAuthentication: row.disableLocalAuthentication,
     configurationKeys: Object.keys(row.configuration).sort()
   };
 };

package/dist/production/src/resolvers/mutation/idp/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;"}
+{"version":3,"file":"audit.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tdisableLocalAuthentication: row.disableLocalAuthentication,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,4BAA4B,IAAI;AAAA,IAChC,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;"}

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.cjs

@@ -2,18 +2,21 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const email = require("../../../model/utils/email.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-const email = require("../../../model/utils/email.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const type = require("../../../model/mailing/type.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +24,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class MailTemplateMutationResolver {
@@ -29,13 +31,30 @@ class MailTemplateMutationResolver {
     this.projectManager = projectManager;
     this.mailTemplateManager = mailTemplateManager;
   }
-  async addMailTemplate(parent, { template: { content, projectSlug, subject, type: type$1, useLayout, variant, replyTo } }, context) {
-    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
+  /** A mail template is either global or project-scoped; both the scope and the permission meta follow from that. */
+  async requireTemplateAccess(context, projectSlug, type2, action, message) {
+    const hasProject = projectSlug !== null && projectSlug !== void 0;
+    const project = hasProject ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
     await context.requireAccess({
-      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
-      action: PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD,
-      message: "You are not allowed to add a mail template"
+      // an unknown slug must resolve to the denied project scope, never fall back to global
+      scope: hasProject ? await context.permissionContext.createProjectScope(project) : void 0,
+      action: action({
+        kind: hasProject ? "project" : "global",
+        projectSlug: hasProject ? projectSlug : null,
+        type: type2
+      }),
+      message
     });
+    return project;
+  }
+  async addMailTemplate(parent, { template: { content, projectSlug, subject, type: type$1, useLayout, variant, replyTo } }, context) {
+    const project = await this.requireTemplateAccess(
+      context,
+      projectSlug,
+      type$1,
+      PermissionActions.PermissionActions.MAIL_TEMPLATE_ADD,
+      "You are not allowed to add a mail template"
+    );
     if (projectSlug && !project) {
       return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
@@ -67,12 +86,13 @@ class MailTemplateMutationResolver {
     };
   }
   async removeMailTemplate(parent, { templateIdentifier: { projectSlug, type: type$1, variant } }, context) {
-    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
-    await context.requireAccess({
-      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
-      action: PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE,
-      message: "You are not allowed to remove a mail template"
-    });
+    const project = await this.requireTemplateAccess(
+      context,
+      projectSlug,
+      type$1,
+      PermissionActions.PermissionActions.MAIL_TEMPLATE_REMOVE,
+      "You are not allowed to remove a mail template"
+    );
     if (projectSlug && !project) {
       return errorUtils.createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
@@ -82,7 +102,7 @@ class MailTemplateMutationResolver {
       type: type.mailTypeFromSchemaToDb(type$1)
     });
     if (!removed) {
-      return errorUtils.createErrorResponse("PROJECT_NOT_FOUND", "Mail template not found");
+      return errorUtils.createErrorResponse("TEMPLATE_NOT_FOUND", "Mail template not found");
     }
     await context.logAuthAction({
       type: "mail_template_change",

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["type","PermissionActions","createProjectNotFoundResponse","validateEmail","createErrorResponse","mailTypeFromSchemaToDb","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAA,MAASA,QAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAACC,oBAAc,OAAO,GAAG;AACvC,aAAOC,WAAAA,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAMC,KAAAA,uBAAuBL,MAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIM,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAA,MAAaA,QAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAMG,KAAAA,uBAAuBL,MAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAOI,WAAAA,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"MailTemplateMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMailType,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tMailTemplateManager,\n\tMailTemplatePermissionMeta,\n\tmailTypeFromSchemaToDb,\n\tPermissionActions,\n\tProject,\n\tProjectManager,\n} from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Authorizator } from '@contember/authorization'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\t/** A mail template is either global or project-scoped; both the scope and the permission meta follow from that. */\n\tprivate async requireTemplateAccess(\n\t\tcontext: TenantResolverContext,\n\t\tprojectSlug: string | null | undefined,\n\t\ttype: MailType,\n\t\taction: (meta?: MailTemplatePermissionMeta) => Authorizator.Action<MailTemplatePermissionMeta | undefined>,\n\t\tmessage: string,\n\t): Promise<Project | null> {\n\t\tconst hasProject = projectSlug !== null && projectSlug !== undefined\n\t\tconst project = hasProject ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\t// an unknown slug must resolve to the denied project scope, never fall back to global\n\t\t\tscope: hasProject ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: action({\n\t\t\t\tkind: hasProject ? 'project' : 'global',\n\t\t\t\tprojectSlug: hasProject ? projectSlug : null,\n\t\t\t\ttype,\n\t\t\t}),\n\t\t\tmessage,\n\t\t})\n\t\treturn project\n\t}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = await this.requireTemplateAccess(\n\t\t\tcontext,\n\t\t\tprojectSlug,\n\t\t\ttype,\n\t\t\tPermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\t'You are not allowed to add a mail template',\n\t\t)\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = await this.requireTemplateAccess(\n\t\t\tcontext,\n\t\t\tprojectSlug,\n\t\t\ttype,\n\t\t\tPermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\t'You are not allowed to remove a mail template',\n\t\t)\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('TEMPLATE_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["type","PermissionActions","createProjectNotFoundResponse","validateEmail","createErrorResponse","mailTypeFromSchemaToDb","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA;AAAA,EAGH,MAAc,sBACb,SACA,aACAA,OACA,QACA,SAC0B;AAC1B,UAAM,aAAa,gBAAgB,QAAQ,gBAAgB;AAC3D,UAAM,UAAU,aAAa,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACnG,UAAM,QAAQ,cAAc;AAAA;AAAA,MAE3B,OAAO,aAAa,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAClF,QAAQ,OAAO;AAAA,QACd,MAAM,aAAa,YAAY;AAAA,QAC/B,aAAa,aAAa,cAAc;AAAA,QACxC,MAAAA;AAAA,MAAA,CACA;AAAA,MACD;AAAA,IAAA,CACA;AACD,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAA,MAASA,QAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA;AAAA,MACAA;AAAAA,MACAC,kBAAAA,kBAAkB;AAAA,MAClB;AAAA,IAAA;AAED,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAACC,oBAAc,OAAO,GAAG;AACvC,aAAOC,WAAAA,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAMC,KAAAA,uBAAuBL,MAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIM,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAA,MAAaA,QAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA;AAAA,MACAA;AAAAA,MACAC,kBAAAA,kBAAkB;AAAA,MAClB;AAAA,IAAA;AAED,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAMG,KAAAA,uBAAuBL,MAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAOI,WAAAA,oBAAoB,sBAAsB,yBAAyB;AAAA,IAC3E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js

@@ -1,17 +1,20 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { validateEmail } from "../../../model/utils/email.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import { validateEmail } from "../../../model/utils/email.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { mailTypeFromSchemaToDb } from "../../../model/mailing/type.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +22,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
 class MailTemplateMutationResolver {
@@ -27,13 +29,30 @@ class MailTemplateMutationResolver {
     this.projectManager = projectManager;
     this.mailTemplateManager = mailTemplateManager;
   }
-  async addMailTemplate(parent, { template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }, context) {
-    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
+  /** A mail template is either global or project-scoped; both the scope and the permission meta follow from that. */
+  async requireTemplateAccess(context, projectSlug, type, action, message) {
+    const hasProject = projectSlug !== null && projectSlug !== void 0;
+    const project = hasProject ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
     await context.requireAccess({
-      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
-      action: PermissionActions.MAIL_TEMPLATE_ADD,
-      message: "You are not allowed to add a mail template"
+      // an unknown slug must resolve to the denied project scope, never fall back to global
+      scope: hasProject ? await context.permissionContext.createProjectScope(project) : void 0,
+      action: action({
+        kind: hasProject ? "project" : "global",
+        projectSlug: hasProject ? projectSlug : null,
+        type
+      }),
+      message
     });
+    return project;
+  }
+  async addMailTemplate(parent, { template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }, context) {
+    const project = await this.requireTemplateAccess(
+      context,
+      projectSlug,
+      type,
+      PermissionActions.MAIL_TEMPLATE_ADD,
+      "You are not allowed to add a mail template"
+    );
     if (projectSlug && !project) {
       return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
@@ -65,12 +84,13 @@ class MailTemplateMutationResolver {
     };
   }
   async removeMailTemplate(parent, { templateIdentifier: { projectSlug, type, variant } }, context) {
-    const project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null;
-    await context.requireAccess({
-      scope: project ? await context.permissionContext.createProjectScope(project) : void 0,
-      action: PermissionActions.MAIL_TEMPLATE_REMOVE,
-      message: "You are not allowed to remove a mail template"
-    });
+    const project = await this.requireTemplateAccess(
+      context,
+      projectSlug,
+      type,
+      PermissionActions.MAIL_TEMPLATE_REMOVE,
+      "You are not allowed to remove a mail template"
+    );
     if (projectSlug && !project) {
       return createProjectNotFoundResponse("PROJECT_NOT_FOUND", projectSlug);
     }
@@ -80,7 +100,7 @@ class MailTemplateMutationResolver {
       type: mailTypeFromSchemaToDb(type)
     });
     if (!removed) {
-      return createErrorResponse("PROJECT_NOT_FOUND", "Mail template not found");
+      return createErrorResponse("TEMPLATE_NOT_FOUND", "Mail template not found");
     }
     await context.logAuthAction({
       type: "mail_template_change",

package/dist/production/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAS,MAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAAC,cAAc,OAAO,GAAG;AACvC,aAAO,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAa,MAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAO,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"MailTemplateMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMailType,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tMailTemplateManager,\n\tMailTemplatePermissionMeta,\n\tmailTypeFromSchemaToDb,\n\tPermissionActions,\n\tProject,\n\tProjectManager,\n} from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Authorizator } from '@contember/authorization'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\t/** A mail template is either global or project-scoped; both the scope and the permission meta follow from that. */\n\tprivate async requireTemplateAccess(\n\t\tcontext: TenantResolverContext,\n\t\tprojectSlug: string | null | undefined,\n\t\ttype: MailType,\n\t\taction: (meta?: MailTemplatePermissionMeta) => Authorizator.Action<MailTemplatePermissionMeta | undefined>,\n\t\tmessage: string,\n\t): Promise<Project | null> {\n\t\tconst hasProject = projectSlug !== null && projectSlug !== undefined\n\t\tconst project = hasProject ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\t// an unknown slug must resolve to the denied project scope, never fall back to global\n\t\t\tscope: hasProject ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: action({\n\t\t\t\tkind: hasProject ? 'project' : 'global',\n\t\t\t\tprojectSlug: hasProject ? projectSlug : null,\n\t\t\t\ttype,\n\t\t\t}),\n\t\t\tmessage,\n\t\t})\n\t\treturn project\n\t}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = await this.requireTemplateAccess(\n\t\t\tcontext,\n\t\t\tprojectSlug,\n\t\t\ttype,\n\t\t\tPermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\t'You are not allowed to add a mail template',\n\t\t)\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() || null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = await this.requireTemplateAccess(\n\t\t\tcontext,\n\t\t\tprojectSlug,\n\t\t\ttype,\n\t\t\tPermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\t'You are not allowed to remove a mail template',\n\t\t)\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant || '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('TEMPLATE_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant || '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA;AAAA,EAGH,MAAc,sBACb,SACA,aACA,MACA,QACA,SAC0B;AAC1B,UAAM,aAAa,gBAAgB,QAAQ,gBAAgB;AAC3D,UAAM,UAAU,aAAa,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACnG,UAAM,QAAQ,cAAc;AAAA;AAAA,MAE3B,OAAO,aAAa,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAClF,QAAQ,OAAO;AAAA,QACd,MAAM,aAAa,YAAY;AAAA,QAC/B,aAAa,aAAa,cAAc;AAAA,QACxC;AAAA,MAAA,CACA;AAAA,MACD;AAAA,IAAA,CACA;AACD,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAS,MAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB;AAAA,MAClB;AAAA,IAAA;AAED,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAAC,cAAc,OAAO,GAAG;AACvC,aAAO,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAa,MAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,MAAM,KAAK;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB;AAAA,MAClB;AAAA,IAAA;AAED,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAO,oBAAoB,sBAAsB,yBAAyB;AAAA,IAC3E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 const IdentityScope = require("../../../model/authorization/IdentityScope.cjs");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
 require("@contember/authorization");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ChangePasswordMutationResolver {
@@ -34,7 +36,7 @@ class ChangePasswordMutationResolver {
     }
     await context.requireAccess({
       scope: new IdentityScope.IdentityScope(person.identity_id),
-      action: PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_PASSWORD(await TargetIdentityPermission.createPersonPermissionTarget(context.db, person)),
       message: "You are not allowed to change password"
     });
     const response = await this.passwordChangeManager.changePassword(context.db, person, args.password);

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ChangePasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"ChangePasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createPersonPermissionTarget, IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(await createPersonPermissionTarget(context.db, person)),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions","createPersonPermissionTarget"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,uBAAuB,MAAMC,yBAAAA,6BAA6B,QAAQ,IAAI,MAAM,CAAC;AAAA,MACvG,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOH,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import { IdentityScope } from "../../../model/authorization/IdentityScope.js";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
 import "@contember/authorization";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import { createPersonPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ChangePasswordMutationResolver {
@@ -32,7 +34,7 @@ class ChangePasswordMutationResolver {
     }
     await context.requireAccess({
       scope: new IdentityScope(person.identity_id),
-      action: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
+      action: PermissionActions.PERSON_CHANGE_PASSWORD(await createPersonPermissionTarget(context.db, person)),
       message: "You are not allowed to change password"
     });
     const response = await this.passwordChangeManager.changePassword(context.db, person, args.password);

package/dist/production/src/resolvers/mutation/person/ChangePasswordMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ChangePasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"ChangePasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createPersonPermissionTarget, IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(await createPersonPermissionTarget(context.db, person)),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,uBAAuB,MAAM,6BAA6B,QAAQ,IAAI,MAAM,CAAC;AAAA,MACvG,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}