@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/mutation/person/SignInMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode || undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll || collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAO,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAI,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;"}
+{"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tcreatePersonPermissionTarget,\n\tPermissionActions,\n\tPersonUniqueIdentifier,\n\tRateLimiter,\n\tSignInManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst retryAfterSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (retryAfterSignIn > 0) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: retryAfterSignIn,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration || undefined,\n\t\t\targs.otpToken || undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode || undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL', 'IDP_REQUIRED'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD', 'IDP_REQUIRED'].includes(response.error)\n\t\t\tif (collapseAll || collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst trustForwardedClientInfo = args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration || undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY({\n\t\t\t\t\t\tphase: 'target',\n\t\t\t\t\t\ttarget: await createPersonPermissionTarget(context.db, person) ?? undefined,\n\t\t\t\t\t\trequestedExpirationMinutes: args.expiration ?? null,\n\t\t\t\t\t\ttrustForwardedClientInfo,\n\t\t\t\t\t}),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\ttrustForwardedClientInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,mBAAmB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AAClG,QAAI,mBAAmB,GAAG;AACzB,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY;AAAA,QAAA,CACZ;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,iBAAiB,cAAc,EAAE,SAAS,SAAS,KAAK;AACvH,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,oBAAoB,cAAc,EAAE,SAAS,SAAS,KAAK;AACnF,UAAI,eAAe,oBAAoB;AACtC,eAAO,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAC1E,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAI,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,2BAA2B,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAC5F,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQ,kBAAkB,0BAA0B;AAAA,UACnD,OAAO;AAAA,UACP,QAAQ,MAAM,6BAA6B,QAAQ,IAAI,MAAM,KAAK;AAAA,UAClE,4BAA4B,KAAK,cAAc;AAAA,UAC/C;AAAA,QAAA,CACA;AAAA,QACD,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR;AAAA,IAAA;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;"}

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class SignOutMutationResolver {

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;;"}
+{"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;;"}

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.js

@@ -1,15 +1,18 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class SignOutMutationResolver {

package/dist/production/src/resolvers/mutation/person/SignOutMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;"}
+{"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;"}

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.cjs

@@ -2,19 +2,22 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
+const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
 const Password = require("../../../model/dtos/Password.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
-const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,7 +25,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");
@@ -90,7 +92,7 @@ class SignUpMutationResolver {
         const permissionContext = await this.permissionContextFactory.create(context.db, {
           id: personRow.identity_id,
           roles: personRow.roles
-        });
+        }, context.permissionContext.authorizator);
         const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow);
         if (sent) {
           await context.logAuthAction({

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","PasswordPlain","UserInputError","PasswordHash","NoPassword","PersonQuery","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOD,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIE,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOL,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAMM,YAAAA,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t}, context.permissionContext.authorizator)\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","PasswordPlain","UserInputError","PasswordHash","NoPassword","PersonQuery","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOD,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIE,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOL,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAMM,YAAAA,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,GACf,QAAQ,kBAAkB,YAAY;AACzC,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.js

@@ -1,18 +1,21 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
+import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
 import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import { PasswordPlain, PasswordHash, NoPassword } from "../../../model/dtos/Password.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
-import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,7 +23,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";
@@ -88,7 +90,7 @@ class SignUpMutationResolver {
         const permissionContext = await this.permissionContextFactory.create(context.db, {
           id: personRow.identity_id,
           roles: personRow.roles
-        });
+        }, context.permissionContext.authorizator);
         const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow);
         if (sent) {
           await context.logAuthAction({

package/dist/production/src/resolvers/mutation/person/SignUpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t}, context.permissionContext.authorizator)\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,GACf,QAAQ,kBAAkB,YAAY;AACzC,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
-require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
+require("../../../model/authorization/PermissionContext.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class TogglePasswordlessMutationResolver {

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
-import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
 import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
+import "../../../model/authorization/CustomRolePermissions.js";
+import "../../../model/authorization/PermissionContext.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class TogglePasswordlessMutationResolver {

package/dist/production/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs

@@ -3,16 +3,19 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../../../model/authorization/Roles.cjs");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 const token = require("../../../model/utils/token.cjs");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIK,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIK,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../../../model/authorization/Roles.js";
+import "../../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../../model/type/ApiKey.js";
+import "../../../model/authorization/CustomRolePermissions.js";
 import "../../../model/authorization/PermissionContext.js";
-import "../../../model/authorization/PermissionsFactory.js";
+import "../../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../../model/type/ApiKey.js";
-import "@contember/database";
 import { isTokenHash } from "../../../model/utils/token.js";
 import { ResponseOk } from "../../../model/utils/Response.js";
-import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";

package/dist/production/src/resolvers/mutation/project/CreateProjectMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs

@@ -2,16 +2,19 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../../model/type/ApiKey.cjs");
+require("../../../model/authorization/CustomRolePermissions.cjs");
 require("../../../model/authorization/PermissionContext.cjs");
-require("../../../model/authorization/PermissionsFactory.cjs");
+require("../../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
 const Response = require("../../../model/utils/Response.cjs");
-require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class SetProjectSecretMutationResolver {

package/dist/production/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}