@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.js

@@ -1,17 +1,20 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +22,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ResetPasswordMutationResolver {
@@ -66,7 +68,7 @@ class ResetPasswordMutationResolver {
     const permissionContext = await this.permissionContextFactory.create(context.db, {
       id: person.identity_id,
       roles: person.roles
-    });
+    }, context.permissionContext.authorizator);
     await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
       mailVariant: args.options?.mailVariant || void 0,
       project: args.options?.mailProject || void 0

package/dist/production/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}
+{"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t}, context.permissionContext.authorizator)\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant || undefined,\n\t\t\tproject: args.options?.mailProject || undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,GACZ,QAAQ,kBAAkB,YAAY;AACzC,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
 const ResetPersonMfaCommand = require("../../../model/commands/person/ResetPersonMfaCommand.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ResetPersonMfaMutationResolver {
@@ -31,7 +33,7 @@ class ResetPersonMfaMutationResolver {
   async resetPersonMfa(parent, args, context) {
     const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
     await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),
+      action: PermissionActions.PermissionActions.PERSON_RESET_MFA(await TargetIdentityPermission.createPersonPermissionTarget(context.db, targetPerson)),
       message: "You are not allowed to reset MFA for this person"
     });
     if (targetPerson === null) {

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPersonMfaMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ResponseError","createErrorResponse","ResetPersonMfaCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"ResetPersonMfaMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, createPersonPermissionTarget, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(await createPersonPermissionTarget(context.db, targetPerson)),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createPersonPermissionTarget","ResponseError","createErrorResponse","ResetPersonMfaCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,iBAAiB,MAAMC,yBAAAA,6BAA6B,QAAQ,IAAI,YAAY,CAAC;AAAA,MACvG,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import { createPersonPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import { ResetPersonMfaCommand } from "../../../model/commands/person/ResetPersonMfaCommand.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ResetPersonMfaMutationResolver {
@@ -29,7 +31,7 @@ class ResetPersonMfaMutationResolver {
   async resetPersonMfa(parent, args, context) {
     const targetPerson = await this.personManager.findPersonById(context.db, args.personId);
     await context.requireAccess({
-      action: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),
+      action: PermissionActions.PERSON_RESET_MFA(await createPersonPermissionTarget(context.db, targetPerson)),
       message: "You are not allowed to reset MFA for this person"
     });
     if (targetPerson === null) {

package/dist/production/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPersonMfaMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,sBAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"ResetPersonMfaMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, createPersonPermissionTarget, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/**\n * Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(await createPersonPermissionTarget(context.db, targetPerson)),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,iBAAiB,MAAM,6BAA6B,QAAQ,IAAI,YAAY,CAAC;AAAA,MACvG,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,sBAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/RevokeSessionMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const ApiKey = require("../../../model/type/ApiKey.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-const ApiKey = require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class RevokeSessionMutationResolver {

package/dist/production/src/resolvers/mutation/person/RevokeSessionMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeSessionMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey || apiKey.identity_id !== context.identity.id || apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","response","ResponseError","createErrorResponse","PermissionActions","ApiKey","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMC,YAAW,IAAIC,uBAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAD,WAAU;AACzE,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAASC,cAAO,KAAK,SAAS;AACjG,YAAMJ,YAAW,IAAIC,uBAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAIK,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"RevokeSessionMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey || apiKey.identity_id !== context.identity.id || apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","response","ResponseError","createErrorResponse","PermissionActions","ApiKey","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMC,YAAW,IAAIC,uBAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAD,WAAU;AACzE,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAASC,cAAO,KAAK,SAAS;AACjG,YAAMJ,YAAW,IAAIC,uBAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAIK,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/RevokeSessionMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { ApiKey } from "../../../model/type/ApiKey.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import { ApiKey } from "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class RevokeSessionMutationResolver {

package/dist/production/src/resolvers/mutation/person/RevokeSessionMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"RevokeSessionMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey || apiKey.identity_id !== context.identity.id || apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMA,YAAW,IAAI,cAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAA,WAAU;AACzE,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAAS,OAAO,KAAK,SAAS;AACjG,YAAMA,YAAW,IAAI,cAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"RevokeSessionMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey || apiKey.identity_id !== context.identity.id || apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMA,YAAW,IAAI,cAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAA,WAAU;AACzE,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAAS,OAAO,KAAK,SAAS;AACjG,YAAMA,YAAW,IAAI,cAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+const TargetIdentityPermission = require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");
@@ -45,11 +47,11 @@ class SignInMutationResolver {
         })
       );
     }
-    const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery.NextLoginAttemptQuery(args.email));
-    if (nextAllowedSignIn > /* @__PURE__ */ new Date()) {
+    const retryAfterSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery.NextLoginAttemptQuery(args.email));
+    if (retryAfterSignIn > 0) {
       return errorUtils.createErrorResponse(
         new Response.ResponseError("RATE_LIMIT_EXCEEDED", `Too many attempts, please try again later.`, {
-          retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1e3)
+          retryAfter: retryAfterSignIn
         })
       );
     }
@@ -110,8 +112,8 @@ class SignInMutationResolver {
     }
     if (!response.ok) {
       const { revealUserExists, revealLoginMethod } = configuration.login;
-      const collapseAll = !revealUserExists && ["NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error);
-      const collapseMethodOnly = revealUserExists && !revealLoginMethod && ["NO_PASSWORD_SET", "INVALID_PASSWORD"].includes(response.error);
+      const collapseAll = !revealUserExists && ["NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL", "IDP_REQUIRED"].includes(response.error);
+      const collapseMethodOnly = revealUserExists && !revealLoginMethod && ["NO_PASSWORD_SET", "INVALID_PASSWORD", "IDP_REQUIRED"].includes(response.error);
       if (collapseAll || collapseMethodOnly) {
         return errorUtils.createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
       }
@@ -133,7 +135,7 @@ class SignInMutationResolver {
   }
   async createSessionToken(parent, args, context) {
     await context.requireAccess({
-      action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(),
+      action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
       message: "You are not allowed to create a session key"
     });
     let identifier;
@@ -144,16 +146,22 @@ class SignInMutationResolver {
     } else {
       throw new graphqlUtils.UserInputError(`Please provide either email or personId`);
     }
+    const trustForwardedClientInfo = args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo;
     const response = await this.signInManager.createSessionToken(
       context.db,
       identifier,
       args.expiration || void 0,
       async (person) => await context.requireAccess({
-        action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+        action: PermissionActions.PermissionActions.PERSON_CREATE_SESSION_KEY({
+          phase: "target",
+          target: await TargetIdentityPermission.createPersonPermissionTarget(context.db, person) ?? void 0,
+          requestedExpirationMinutes: args.expiration ?? null,
+          trustForwardedClientInfo
+        }),
         message: "You are not allowed to create a session key for this person."
       }),
       context.httpInfo,
-      args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo
+      trustForwardedClientInfo
     );
     await context.logAuthAction({
       type: "create_session_token",

package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode || undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll || collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","NextLoginAttemptQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAOF,WAAAA;AAAAA,QACN,IAAIC,uBAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAOD,WAAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAOA,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQL,kBAAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;;"}
+{"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tcreatePersonPermissionTarget,\n\tPermissionActions,\n\tPersonUniqueIdentifier,\n\tRateLimiter,\n\tSignInManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst retryAfterSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (retryAfterSignIn > 0) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: retryAfterSignIn,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode || undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL', 'IDP_REQUIRED'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD', 'IDP_REQUIRED'].includes(response.error)\n\t\t\tif (collapseAll || collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst trustForwardedClientInfo = args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY({\n\t\t\t\t\t\tphase: 'target',\n\t\t\t\t\t\ttarget: await createPersonPermissionTarget(context.db, person) ?? undefined,\n\t\t\t\t\t\trequestedExpirationMinutes: args.expiration ?? null,\n\t\t\t\t\t\ttrustForwardedClientInfo,\n\t\t\t\t\t}),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\ttrustForwardedClientInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","NextLoginAttemptQuery","UserInputError","createPersonPermissionTarget"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,mBAAmB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,KAAK,KAAK,CAAC;AAClG,QAAI,mBAAmB,GAAG;AACzB,aAAOF,WAAAA;AAAAA,QACN,IAAIC,uBAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY;AAAA,QAAA,CACZ;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,iBAAiB,cAAc,EAAE,SAAS,SAAS,KAAK;AACvH,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,oBAAoB,cAAc,EAAE,SAAS,SAAS,KAAK;AACnF,UAAI,eAAe,oBAAoB;AACtC,eAAOD,WAAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAOA,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAC1E,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,2BAA2B,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAC5F,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQL,kBAAAA,kBAAkB,0BAA0B;AAAA,UACnD,OAAO;AAAA,UACP,QAAQ,MAAMM,yBAAAA,6BAA6B,QAAQ,IAAI,MAAM,KAAK;AAAA,UAClE,4BAA4B,KAAK,cAAc;AAAA,UAC/C;AAAA,QAAA,CACA;AAAA,QACD,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IAAA;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import { createPersonPermissionTarget } from "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";
@@ -43,11 +45,11 @@ class SignInMutationResolver {
         })
       );
     }
-    const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email));
-    if (nextAllowedSignIn > /* @__PURE__ */ new Date()) {
+    const retryAfterSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email));
+    if (retryAfterSignIn > 0) {
       return createErrorResponse(
         new ResponseError("RATE_LIMIT_EXCEEDED", `Too many attempts, please try again later.`, {
-          retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1e3)
+          retryAfter: retryAfterSignIn
         })
       );
     }
@@ -108,8 +110,8 @@ class SignInMutationResolver {
     }
     if (!response.ok) {
       const { revealUserExists, revealLoginMethod } = configuration.login;
-      const collapseAll = !revealUserExists && ["NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL"].includes(response.error);
-      const collapseMethodOnly = revealUserExists && !revealLoginMethod && ["NO_PASSWORD_SET", "INVALID_PASSWORD"].includes(response.error);
+      const collapseAll = !revealUserExists && ["NO_PASSWORD_SET", "PERSON_DISABLED", "INVALID_PASSWORD", "UNKNOWN_EMAIL", "IDP_REQUIRED"].includes(response.error);
+      const collapseMethodOnly = revealUserExists && !revealLoginMethod && ["NO_PASSWORD_SET", "INVALID_PASSWORD", "IDP_REQUIRED"].includes(response.error);
       if (collapseAll || collapseMethodOnly) {
         return createErrorResponse("INVALID_CREDENTIALS", "Invalid credentials");
       }
@@ -131,7 +133,7 @@ class SignInMutationResolver {
   }
   async createSessionToken(parent, args, context) {
     await context.requireAccess({
-      action: PermissionActions.PERSON_CREATE_SESSION_KEY(),
+      action: PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: "preflight" }),
       message: "You are not allowed to create a session key"
     });
     let identifier;
@@ -142,16 +144,22 @@ class SignInMutationResolver {
     } else {
       throw new UserInputError(`Please provide either email or personId`);
     }
+    const trustForwardedClientInfo = args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo;
     const response = await this.signInManager.createSessionToken(
       context.db,
       identifier,
       args.expiration || void 0,
       async (person) => await context.requireAccess({
-        action: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+        action: PermissionActions.PERSON_CREATE_SESSION_KEY({
+          phase: "target",
+          target: await createPersonPermissionTarget(context.db, person) ?? void 0,
+          requestedExpirationMinutes: args.expiration ?? null,
+          trustForwardedClientInfo
+        }),
         message: "You are not allowed to create a session key for this person."
       }),
       context.httpInfo,
-      args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo
+      trustForwardedClientInfo
     );
     await context.logAuthAction({
       type: "create_session_token",