@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs

@@ -2,19 +2,22 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 const IdentityScope = require("../../../model/authorization/IdentityScope.cjs");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
 require("@contember/authorization");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-const email = require("../../../model/utils/email.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const email = require("../../../model/utils/email.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,7 +25,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ChangeProfileMutationResolver {
@@ -39,9 +41,13 @@ class ChangeProfileMutationResolver {
     if (args.email === null) {
       return errorUtils.createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
     }
+    const fields = [
+      ...args.name !== void 0 ? ["name"] : [],
+      ...args.email !== void 0 ? ["email"] : []
+    ];
     await context.requireAccess({
       scope: new IdentityScope.IdentityScope(person.identity_id),
-      action: PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+      action: PermissionActions.PermissionActions.PERSON_CHANGE_PROFILE(await TargetIdentityPermission.createPersonPermissionTarget(context.db, person), fields),
       message: "You are not allowed to change a profile"
     });
     const result = await this.personManager.changeProfile(context.db, person, {
@@ -75,10 +81,10 @@ class ChangeProfileMutationResolver {
     const normalizedNewEmail = args.email ? email.normalizeEmail(args.email) : null;
     const emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email;
     if (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {
-      const permissionContext = await this.permissionContextFactory.create(context.db, {
+      const permissionContext = this.permissionContextFactory.create(context.db, {
         id: person.identity_id,
         roles: person.roles
-      });
+      }, context.permissionContext.authorizator);
       const result2 = await this.emailChangeManager.requestEmailChange(
         context.db,
         permissionContext,

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ChangeProfileMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile' | 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions","ConfigurationQuery","normalizeEmail","result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMC,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAOL,WAAAA,oBAAoBK,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOL,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"ChangeProfileMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tcreatePersonPermissionTarget,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n\tProfileField,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile' | 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tconst fields: ProfileField[] = [\n\t\t\t...(args.name !== undefined ? ['name' as const] : []),\n\t\t\t...(args.email !== undefined ? ['email' as const] : []),\n\t\t]\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(await createPersonPermissionTarget(context.db, person), fields),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {\n\t\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t}, context.permissionContext.authorizator)\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions","createPersonPermissionTarget","ConfigurationQuery","normalizeEmail","result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,SAAyB;AAAA,MAC9B,GAAI,KAAK,SAAS,SAAY,CAAC,MAAe,IAAI,CAAA;AAAA,MAClD,GAAI,KAAK,UAAU,SAAY,CAAC,OAAgB,IAAI,CAAA;AAAA,IAAC;AAEtD,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,sBAAsB,MAAMC,yBAAAA,6BAA6B,QAAQ,IAAI,MAAM,GAAG,MAAM;AAAA,MAC9G,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOH,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAC1E,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,YAAMC,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAON,WAAAA,oBAAoBM,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAON,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js

@@ -1,18 +1,21 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import { IdentityScope } from "../../../model/authorization/IdentityScope.js";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
 import "@contember/authorization";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import { normalizeEmail } from "../../../model/utils/email.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
 import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import { createPersonPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { normalizeEmail } from "../../../model/utils/email.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,7 +23,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ChangeProfileMutationResolver {
@@ -37,9 +39,13 @@ class ChangeProfileMutationResolver {
     if (args.email === null) {
       return createErrorResponse("INVALID_EMAIL_FORMAT", "E-mail address cannot be null.");
     }
+    const fields = [
+      ...args.name !== void 0 ? ["name"] : [],
+      ...args.email !== void 0 ? ["email"] : []
+    ];
     await context.requireAccess({
       scope: new IdentityScope(person.identity_id),
-      action: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),
+      action: PermissionActions.PERSON_CHANGE_PROFILE(await createPersonPermissionTarget(context.db, person), fields),
       message: "You are not allowed to change a profile"
     });
     const result = await this.personManager.changeProfile(context.db, person, {
@@ -73,10 +79,10 @@ class ChangeProfileMutationResolver {
     const normalizedNewEmail = args.email ? normalizeEmail(args.email) : null;
     const emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email;
     if (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {
-      const permissionContext = await this.permissionContextFactory.create(context.db, {
+      const permissionContext = this.permissionContextFactory.create(context.db, {
         id: person.identity_id,
         roles: person.roles
-      });
+      }, context.permissionContext.authorizator);
       const result2 = await this.emailChangeManager.requestEmailChange(
         context.db,
         permissionContext,

package/dist/production/src/resolvers/mutation/person/ChangeProfileMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile' | 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQ,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMA,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAO,oBAAoBA,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tcreatePersonPermissionTarget,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n\tProfileField,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile' | 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tconst fields: ProfileField[] = [\n\t\t\t...(args.name !== undefined ? ['name' as const] : []),\n\t\t\t...(args.email !== undefined ? ['email' as const] : []),\n\t\t]\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(await createPersonPermissionTarget(context.db, person), fields),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification || person.email_verification_required)) {\n\t\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t}, context.permissionContext.authorizator)\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,SAAyB;AAAA,MAC9B,GAAI,KAAK,SAAS,SAAY,CAAC,MAAe,IAAI,CAAA;AAAA,MAClD,GAAI,KAAK,UAAU,SAAY,CAAC,OAAgB,IAAI,CAAA;AAAA,IAAC;AAEtD,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,MAAM,6BAA6B,QAAQ,IAAI,MAAM,GAAG,MAAM;AAAA,MAC9G,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQ,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAC1E,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,YAAMA,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAO,oBAAoBA,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs

@@ -2,15 +2,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisablePersonMutationResolver {
@@ -38,14 +40,14 @@ class DisablePersonMutationResolver {
       };
     }
     await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      action: PermissionActions.PermissionActions.PERSON_DISABLE(await TargetIdentityPermission.createPersonPermissionTarget(context.db, targetPerson)),
       message: "You are not allowed to disable person account"
     });
-    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger);
     await context.logAuthAction({
       type: "person_disable",
       response: result,
-      personId: targetPerson.id
+      targetPersonId: targetPerson.id
     });
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\tpersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,YAAY;AACpF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IAAA,CACvB;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}
+{"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createPersonPermissionTarget, PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: unknown,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(await createPersonPermissionTarget(context.db, targetPerson)),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createPersonPermissionTarget","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,MAAMC,yBAAAA,6BAA6B,QAAQ,IAAI,YAAY,CAAC;AAAA,MACrG,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,cAAc,QAAQ,MAAM;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js

@@ -1,14 +1,17 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import { createPersonPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisablePersonMutationResolver {
@@ -36,14 +38,14 @@ class DisablePersonMutationResolver {
       };
     }
     await context.requireAccess({
-      action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
+      action: PermissionActions.PERSON_DISABLE(await createPersonPermissionTarget(context.db, targetPerson)),
       message: "You are not allowed to disable person account"
     });
-    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger);
     await context.logAuthAction({
       type: "person_disable",
       response: result,
-      personId: targetPerson.id
+      targetPersonId: targetPerson.id
     });
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);

package/dist/production/src/resolvers/mutation/person/DisablePersonMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: any,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\tpersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,YAAY;AACpF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU,aAAa;AAAA,IAAA,CACvB;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}
+{"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { createPersonPermissionTarget, PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: unknown,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(await createPersonPermissionTarget(context.db, targetPerson)),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,MAAM,6BAA6B,QAAQ,IAAI,YAAY,CAAC;AAAA,MACrG,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,cAAc,QAAQ,MAAM;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}

package/dist/production/src/resolvers/mutation/person/EmailOtpMutationResolver.cjs

@@ -2,20 +2,23 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const exceptions = require("../../../exceptions.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-const exceptions = require("../../../exceptions.cjs");
 const Response = require("../../../model/utils/Response.cjs");
 const SetEmailOtpEnabledCommand = require("../../../model/commands/otp/SetEmailOtpEnabledCommand.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -23,7 +26,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class EmailOtpMutationResolver {

package/dist/production/src/resolvers/mutation/person/EmailOtpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailOtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailOtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmEmailOtpResponse,\n\tDisableEmailOtpResponse,\n\tInitEmailOtpResponse,\n\tMutationConfirmEmailOtpArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tAuthPolicyResolver,\n\tBackupCodeManager,\n\tConfigurationQuery,\n\tEmailOtpManager,\n\tPermissionActions,\n\tPersonQuery,\n\tPersonRow,\n} from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { SetEmailOtpEnabledCommand } from '../../../model/commands/index.js'\n\nexport class EmailOtpMutationResolver implements Pick<MutationResolvers, 'initEmailOtp' | 'confirmEmailOtp' | 'disableEmailOtp'> {\n\tconstructor(\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync initEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<InitEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email) {\n\t\t\treturn createErrorResponse('NO_EMAIL', 'Person has no email address to send the code to.')\n\t\t}\n\t\t// Send a confirmation code; enabling happens only after confirmEmailOtp.\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tconst decision = await this.emailOtpManager.sendCode(context.db, person, config)\n\t\tif (!decision.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMITED', `Too many codes requested. Retry after ${decision.retryAfterSeconds}s.`)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tasync confirmEmailOtp(parent: any, args: MutationConfirmEmailOtpArgs, context: TenantResolverContext): Promise<ConfirmEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!await this.emailOtpManager.verifyAndConsume(context.db, person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided code is not correct.')\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, true))\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Enrolling a factor (re)issues the backup-code set, like confirmOtp.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email_otp_enabled) {\n\t\t\treturn createErrorResponse('EMAIL_OTP_NOT_ACTIVE', 'Email OTP is not active, you cannot disable it.')\n\t\t}\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\tif (!hasActiveTotp) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, false))\n\t\t// If no MFA factor remains (no active TOTP, email OTP now off), drop backup codes.\n\t\tif (!hasActiveTotp) {\n\t\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\t}\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ConfigurationQuery","SetEmailOtpEnabledCommand","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,yBAAoH;AAAA,EAChI,YACkB,iBACA,mBACA,oBAChB;AAHgB,SAAA,kBAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAa,MAAU,SAA+D;AACxG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,OAAO;AAClB,aAAOA,WAAAA,oBAAoB,YAAY,kDAAkD;AAAA,IAC1F;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAC/F,UAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,QAAQ,IAAI,QAAQ,MAAM;AAC/E,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOD,WAAAA,oBAAoB,gBAAgB,yCAAyC,SAAS,iBAAiB,IAAI;AAAA,IACnH;AACA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAmC,SAAkE;AACvI,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,QAAQ,GAAG;AACpF,aAAOA,WAAAA,oBAAoB,qBAAqB,+BAA+B;AAAA,IAChF;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIE,0BAAAA,0BAA0B,OAAO,IAAI,IAAI,CAAC;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAU,SAAkE;AAC9G,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,mBAAmB;AAC9B,aAAOH,WAAAA,oBAAoB,wBAAwB,iDAAiD;AAAA,IACrG;AACA,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAE1E,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAOA,WAAAA,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIE,0BAAAA,0BAA0B,OAAO,IAAI,KAAK,CAAC;AAEnF,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAAA,IACnE;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"EmailOtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailOtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmEmailOtpResponse,\n\tDisableEmailOtpResponse,\n\tInitEmailOtpResponse,\n\tMutationConfirmEmailOtpArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tAuthPolicyResolver,\n\tBackupCodeManager,\n\tConfigurationQuery,\n\tEmailOtpManager,\n\tPermissionActions,\n\tPersonQuery,\n\tPersonRow,\n} from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { SetEmailOtpEnabledCommand } from '../../../model/commands/index.js'\n\nexport class EmailOtpMutationResolver implements Pick<MutationResolvers, 'initEmailOtp' | 'confirmEmailOtp' | 'disableEmailOtp'> {\n\tconstructor(\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync initEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<InitEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email) {\n\t\t\treturn createErrorResponse('NO_EMAIL', 'Person has no email address to send the code to.')\n\t\t}\n\t\t// Send a confirmation code; enabling happens only after confirmEmailOtp.\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tconst decision = await this.emailOtpManager.sendCode(context.db, person, config)\n\t\tif (!decision.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMITED', `Too many codes requested. Retry after ${decision.retryAfterSeconds}s.`)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tasync confirmEmailOtp(parent: any, args: MutationConfirmEmailOtpArgs, context: TenantResolverContext): Promise<ConfirmEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!await this.emailOtpManager.verifyAndConsume(context.db, person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided code is not correct.')\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, true))\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Enrolling a factor (re)issues the backup-code set, like confirmOtp.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email_otp_enabled) {\n\t\t\treturn createErrorResponse('EMAIL_OTP_NOT_ACTIVE', 'Email OTP is not active, you cannot disable it.')\n\t\t}\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\tif (!hasActiveTotp) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, false))\n\t\t// If no MFA factor remains (no active TOTP, email OTP now off), drop backup codes.\n\t\tif (!hasActiveTotp) {\n\t\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\t}\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ConfigurationQuery","SetEmailOtpEnabledCommand","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,yBAAoH;AAAA,EAChI,YACkB,iBACA,mBACA,oBAChB;AAHgB,SAAA,kBAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAa,MAAU,SAA+D;AACxG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,OAAO;AAClB,aAAOA,WAAAA,oBAAoB,YAAY,kDAAkD;AAAA,IAC1F;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAC/F,UAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,QAAQ,IAAI,QAAQ,MAAM;AAC/E,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOD,WAAAA,oBAAoB,gBAAgB,yCAAyC,SAAS,iBAAiB,IAAI;AAAA,IACnH;AACA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAmC,SAAkE;AACvI,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,QAAQ,GAAG;AACpF,aAAOA,WAAAA,oBAAoB,qBAAqB,+BAA+B;AAAA,IAChF;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIE,0BAAAA,0BAA0B,OAAO,IAAI,IAAI,CAAC;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAU,SAAkE;AAC9G,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,mBAAmB;AAC9B,aAAOH,WAAAA,oBAAoB,wBAAwB,iDAAiD;AAAA,IACrG;AACA,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAE1E,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAOA,WAAAA,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIE,0BAAAA,0BAA0B,OAAO,IAAI,KAAK,CAAC;AAEnF,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAAA,IACnE;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/resolvers/mutation/person/EmailOtpMutationResolver.js

@@ -1,19 +1,22 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { ImplementationException } from "../../../exceptions.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import { ImplementationException } from "../../../exceptions.js";
 import { ResponseOk } from "../../../model/utils/Response.js";
 import { SetEmailOtpEnabledCommand } from "../../../model/commands/otp/SetEmailOtpEnabledCommand.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -21,7 +24,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class EmailOtpMutationResolver {

package/dist/production/src/resolvers/mutation/person/EmailOtpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailOtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailOtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmEmailOtpResponse,\n\tDisableEmailOtpResponse,\n\tInitEmailOtpResponse,\n\tMutationConfirmEmailOtpArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tAuthPolicyResolver,\n\tBackupCodeManager,\n\tConfigurationQuery,\n\tEmailOtpManager,\n\tPermissionActions,\n\tPersonQuery,\n\tPersonRow,\n} from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { SetEmailOtpEnabledCommand } from '../../../model/commands/index.js'\n\nexport class EmailOtpMutationResolver implements Pick<MutationResolvers, 'initEmailOtp' | 'confirmEmailOtp' | 'disableEmailOtp'> {\n\tconstructor(\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync initEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<InitEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email) {\n\t\t\treturn createErrorResponse('NO_EMAIL', 'Person has no email address to send the code to.')\n\t\t}\n\t\t// Send a confirmation code; enabling happens only after confirmEmailOtp.\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tconst decision = await this.emailOtpManager.sendCode(context.db, person, config)\n\t\tif (!decision.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMITED', `Too many codes requested. Retry after ${decision.retryAfterSeconds}s.`)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tasync confirmEmailOtp(parent: any, args: MutationConfirmEmailOtpArgs, context: TenantResolverContext): Promise<ConfirmEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!await this.emailOtpManager.verifyAndConsume(context.db, person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided code is not correct.')\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, true))\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Enrolling a factor (re)issues the backup-code set, like confirmOtp.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email_otp_enabled) {\n\t\t\treturn createErrorResponse('EMAIL_OTP_NOT_ACTIVE', 'Email OTP is not active, you cannot disable it.')\n\t\t}\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\tif (!hasActiveTotp) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, false))\n\t\t// If no MFA factor remains (no active TOTP, email OTP now off), drop backup codes.\n\t\tif (!hasActiveTotp) {\n\t\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\t}\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,yBAAoH;AAAA,EAChI,YACkB,iBACA,mBACA,oBAChB;AAHgB,SAAA,kBAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAa,MAAU,SAA+D;AACxG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,OAAO;AAClB,aAAO,oBAAoB,YAAY,kDAAkD;AAAA,IAC1F;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAC/F,UAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,QAAQ,IAAI,QAAQ,MAAM;AAC/E,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,gBAAgB,yCAAyC,SAAS,iBAAiB,IAAI;AAAA,IACnH;AACA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAmC,SAAkE;AACvI,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,QAAQ,GAAG;AACpF,aAAO,oBAAoB,qBAAqB,+BAA+B;AAAA,IAChF;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,0BAA0B,OAAO,IAAI,IAAI,CAAC;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAU,SAAkE;AAC9G,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,mBAAmB;AAC9B,aAAO,oBAAoB,wBAAwB,iDAAiD;AAAA,IACrG;AACA,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAE1E,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAO,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,0BAA0B,OAAO,IAAI,KAAK,CAAC;AAEnF,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAAA,IACnE;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"EmailOtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailOtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmEmailOtpResponse,\n\tDisableEmailOtpResponse,\n\tInitEmailOtpResponse,\n\tMutationConfirmEmailOtpArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tAuthPolicyResolver,\n\tBackupCodeManager,\n\tConfigurationQuery,\n\tEmailOtpManager,\n\tPermissionActions,\n\tPersonQuery,\n\tPersonRow,\n} from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { SetEmailOtpEnabledCommand } from '../../../model/commands/index.js'\n\nexport class EmailOtpMutationResolver implements Pick<MutationResolvers, 'initEmailOtp' | 'confirmEmailOtp' | 'disableEmailOtp'> {\n\tconstructor(\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync initEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<InitEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email) {\n\t\t\treturn createErrorResponse('NO_EMAIL', 'Person has no email address to send the code to.')\n\t\t}\n\t\t// Send a confirmation code; enabling happens only after confirmEmailOtp.\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tconst decision = await this.emailOtpManager.sendCode(context.db, person, config)\n\t\tif (!decision.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMITED', `Too many codes requested. Retry after ${decision.retryAfterSeconds}s.`)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tasync confirmEmailOtp(parent: any, args: MutationConfirmEmailOtpArgs, context: TenantResolverContext): Promise<ConfirmEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!await this.emailOtpManager.verifyAndConsume(context.db, person, args.otpToken)) {\n\t\t\treturn createErrorResponse('INVALID_OTP_TOKEN', 'Provided code is not correct.')\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, true))\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Enrolling a factor (re)issues the backup-code set, like confirmOtp.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableEmailOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableEmailOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.email_otp_enabled) {\n\t\t\treturn createErrorResponse('EMAIL_OTP_NOT_ACTIVE', 'Email OTP is not active, you cannot disable it.')\n\t\t}\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\tif (!hasActiveTotp) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait context.db.commandBus.execute(new SetEmailOtpEnabledCommand(person.id, false))\n\t\t// If no MFA factor remains (no active TOTP, email OTP now off), drop backup codes.\n\t\tif (!hasActiveTotp) {\n\t\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\t}\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,yBAAoH;AAAA,EAChI,YACkB,iBACA,mBACA,oBAChB;AAHgB,SAAA,kBAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAa,MAAU,SAA+D;AACxG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,OAAO;AAClB,aAAO,oBAAoB,YAAY,kDAAkD;AAAA,IAC1F;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAC/F,UAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,QAAQ,IAAI,QAAQ,MAAM;AAC/E,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,gBAAgB,yCAAyC,SAAS,iBAAiB,IAAI;AAAA,IACnH;AACA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAmC,SAAkE;AACvI,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,QAAQ,GAAG;AACpF,aAAO,oBAAoB,qBAAqB,+BAA+B;AAAA,IAChF;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,0BAA0B,OAAO,IAAI,IAAI,CAAC;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,gBAAgB,QAAa,MAAU,SAAkE;AAC9G,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,mBAAmB;AAC9B,aAAO,oBAAoB,wBAAwB,iDAAiD;AAAA,IACrG;AACA,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAE1E,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAO,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,0BAA0B,OAAO,IAAI,KAAK,CAAC;AAEnF,QAAI,CAAC,eAAe;AACnB,YAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAAA,IACnE;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/resolvers/mutation/person/EmailVerificationMutationResolver.cjs

@@ -2,18 +2,21 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +24,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class EmailVerificationMutationResolver {
@@ -57,7 +59,7 @@ class EmailVerificationMutationResolver {
       const permissionContext = await this.permissionContextFactory.create(context.db, {
         id: person.identity_id,
         roles: person.roles
-      });
+      }, context.permissionContext.authorizator);
       const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, person, {
         mailVariant: args.options?.mailVariant || void 0,
         project: args.options?.mailProject || void 0

package/dist/production/src/resolvers/mutation/person/EmailVerificationMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailVerificationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailVerificationMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRequestEmailVerificationArgs,\n\tMutationResolvers,\n\tMutationVerifyEmailArgs,\n\tRequestEmailVerificationResponse,\n\tVerifyEmailResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EmailVerificationMutationResolver implements Pick<MutationResolvers, 'requestEmailVerification' | 'verifyEmail'> {\n\tconstructor(\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync requestEmailVerification(\n\t\tparent: unknown,\n\t\targs: MutationRequestEmailVerificationArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RequestEmailVerificationResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to request e-mail verification',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\t// Per-IP rate limit + captcha mirror createResetPasswordRequest: this is\n\t\t// an unauthenticated email-sending endpoint, so gate abuse before the\n\t\t// (always-ok) anti-enumeration response below can be used as a mail bomb.\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'email_verification_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many e-mail verification requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'emailVerification')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\t// Always report ok regardless of whether the address exists or is\n\t\t// already verified — same anti-enumeration stance as password reset.\n\t\tif (person?.email && person.email_verified_at === null) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, person, {\n\t\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\t\tproject: args.options?.mailProject || undefined,\n\t\t\t})\n\t\t\tif (sent) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: args.email,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t\treturn { ok: true }\n\t}\n\n\tasync verifyEmail(\n\t\tparent: unknown,\n\t\targs: MutationVerifyEmailArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<VerifyEmailResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to verify an e-mail address',\n\t\t})\n\n\t\tconst result = await this.emailVerificationManager.verifyEmail(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_verify_complete',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","PersonQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,kCAAiH;AAAA,EAC7H,YACkB,0BACA,0BACA,kBACA,aAChB;AAJgB,SAAA,2BAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,yBACL,QACA,MACA,SACA,MAC4C;AAC5C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAKtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,6BAA6B,QAAQ,SAAS,IAAI,aAAa;AACrH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,sDAAsD,GAAG,iBAAiB,IAAI;AAAA,IACjI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,mBAAmB,GAAG;AAC3E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAGlF,QAAI,QAAQ,SAAS,OAAO,sBAAsB,MAAM;AACvD,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,QAC7G,aAAa,KAAK,SAAS,eAAe;AAAA,QAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,MAAA,CACtC;AACD,UAAI,MAAM;AACT,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,UAC7B,UAAU,OAAO;AAAA,UACjB,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MACF;AAAA,IACD;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,YACL,QACA,MACA,SACA,MAC+B;AAC/B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQJ,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,yBAAyB,YAAY,QAAQ,IAAI,KAAK,KAAK;AACrF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"EmailVerificationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/EmailVerificationMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRequestEmailVerificationArgs,\n\tMutationResolvers,\n\tMutationVerifyEmailArgs,\n\tRequestEmailVerificationResponse,\n\tVerifyEmailResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EmailVerificationMutationResolver implements Pick<MutationResolvers, 'requestEmailVerification' | 'verifyEmail'> {\n\tconstructor(\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync requestEmailVerification(\n\t\tparent: unknown,\n\t\targs: MutationRequestEmailVerificationArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RequestEmailVerificationResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to request e-mail verification',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\t// Per-IP rate limit + captcha mirror createResetPasswordRequest: this is\n\t\t// an unauthenticated email-sending endpoint, so gate abuse before the\n\t\t// (always-ok) anti-enumeration response below can be used as a mail bomb.\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'email_verification_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many e-mail verification requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'emailVerification')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\t// Always report ok regardless of whether the address exists or is\n\t\t// already verified — same anti-enumeration stance as password reset.\n\t\tif (person?.email && person.email_verified_at === null) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t}, context.permissionContext.authorizator)\n\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, person, {\n\t\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\t\tproject: args.options?.mailProject || undefined,\n\t\t\t})\n\t\t\tif (sent) {\n\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: args.email,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t\treturn { ok: true }\n\t}\n\n\tasync verifyEmail(\n\t\tparent: unknown,\n\t\targs: MutationVerifyEmailArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<VerifyEmailResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to verify an e-mail address',\n\t\t})\n\n\t\tconst result = await this.emailVerificationManager.verifyEmail(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_verify_complete',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","PersonQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,kCAAiH;AAAA,EAC7H,YACkB,0BACA,0BACA,kBACA,aAChB;AAJgB,SAAA,2BAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,yBACL,QACA,MACA,SACA,MAC4C;AAC5C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAKtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,6BAA6B,QAAQ,SAAS,IAAI,aAAa;AACrH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,sDAAsD,GAAG,iBAAiB,IAAI;AAAA,IACjI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,mBAAmB,GAAG;AAC3E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAGlF,QAAI,QAAQ,SAAS,OAAO,sBAAsB,MAAM;AACvD,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,YAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,QAC7G,aAAa,KAAK,SAAS,eAAe;AAAA,QAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,MAAA,CACtC;AACD,UAAI,MAAM;AACT,cAAM,QAAQ,cAAc;AAAA,UAC3B,MAAM;AAAA,UACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,UAC7B,UAAU,OAAO;AAAA,UACjB,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MACF;AAAA,IACD;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,YACL,QACA,MACA,SACA,MAC+B;AAC/B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQJ,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,yBAAyB,YAAY,QAAQ,IAAI,KAAK,KAAK;AACrF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}