@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/resolvers/query/MailTemplateQueryResolver.cjs

@@ -2,17 +2,20 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+const MailTemplateListQuery = require("../../model/queries/mailTemplate/MailTemplateListQuery.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
-const MailTemplateListQuery = require("../../model/queries/mailTemplate/MailTemplateListQuery.cjs");
 const type = require("../../model/mailing/type.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,19 +23,23 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class MailTemplateQueryResolver {
+  /** Filters per row rather than throwing, like the other tenant read fields. */
   async mailTemplates(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST,
-      message: "You are not allowed to list mail templates"
-    });
-    return (await context.db.queryHandler.fetch(new MailTemplateListQuery.MailTemplateListQuery())).map((it) => ({
-      ...it,
-      variant: it.variant || null,
-      type: type.mailTypeFromDbToSchema(it.type)
+    const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery.MailTemplateListQuery());
+    const visible = await Promise.all(rows.map(async (row) => {
+      const type$1 = type.mailTypeFromDbToSchema(row.type);
+      const allowed = await context.isAllowed({
+        action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST({
+          kind: row.projectSlug === null ? "global" : "project",
+          projectSlug: row.projectSlug,
+          type: type$1
+        })
+      });
+      return allowed ? { ...row, variant: row.variant || null, type: type$1 } : null;
     }));
+    return visible.filter((row) => row !== null);
   }
 }
 exports.MailTemplateQueryResolver = MailTemplateQueryResolver;

package/dist/production/src/resolvers/query/MailTemplateQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","MailTemplateListQuery","mailTypeFromDbToSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAMC,KAAAA,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;;"}
+{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\t/** Filters per row rather than throwing, like the other tenant read fields. */\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tconst rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())\n\t\tconst visible = await Promise.all(rows.map(async row => {\n\t\t\tconst type = mailTypeFromDbToSchema(row.type)\n\t\t\tconst allowed = await context.isAllowed({\n\t\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST({\n\t\t\t\t\tkind: row.projectSlug === null ? 'global' : 'project',\n\t\t\t\t\tprojectSlug: row.projectSlug,\n\t\t\t\t\ttype,\n\t\t\t\t}),\n\t\t\t})\n\t\t\treturn allowed ? { ...row, variant: row.variant || null, type } : null\n\t\t}))\n\t\treturn visible.filter(row => row !== null)\n\t}\n}\n"],"names":["MailTemplateListQuery","type","mailTypeFromDbToSchema","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA;AAAA,EAEhE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIA,sBAAAA,uBAAuB;AAC5E,UAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAM,QAAO;AACvD,YAAMC,SAAOC,KAAAA,uBAAuB,IAAI,IAAI;AAC5C,YAAM,UAAU,MAAM,QAAQ,UAAU;AAAA,QACvC,QAAQC,kBAAAA,kBAAkB,mBAAmB;AAAA,UAC5C,MAAM,IAAI,gBAAgB,OAAO,WAAW;AAAA,UAC5C,aAAa,IAAI;AAAA,UAAA,MACjBF;AAAAA,QAAA,CACA;AAAA,MAAA,CACD;AACD,aAAO,UAAU,EAAE,GAAG,KAAK,SAAS,IAAI,WAAW,YAAMA,OAAA,IAAS;AAAA,IACnE,CAAC,CAAC;AACF,WAAO,QAAQ,OAAO,CAAA,QAAO,QAAQ,IAAI;AAAA,EAC1C;AACD;;"}

package/dist/production/src/resolvers/query/MailTemplateQueryResolver.js

@@ -1,16 +1,19 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import { MailTemplateListQuery } from "../../model/queries/mailTemplate/MailTemplateListQuery.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
-import { MailTemplateListQuery } from "../../model/queries/mailTemplate/MailTemplateListQuery.js";
 import { mailTypeFromDbToSchema } from "../../model/mailing/type.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,19 +21,23 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class MailTemplateQueryResolver {
+  /** Filters per row rather than throwing, like the other tenant read fields. */
   async mailTemplates(parent, args, context) {
-    await context.requireAccess({
-      action: PermissionActions.MAIL_TEMPLATE_LIST,
-      message: "You are not allowed to list mail templates"
-    });
-    return (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map((it) => ({
-      ...it,
-      variant: it.variant || null,
-      type: mailTypeFromDbToSchema(it.type)
+    const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery());
+    const visible = await Promise.all(rows.map(async (row) => {
+      const type = mailTypeFromDbToSchema(row.type);
+      const allowed = await context.isAllowed({
+        action: PermissionActions.MAIL_TEMPLATE_LIST({
+          kind: row.projectSlug === null ? "global" : "project",
+          projectSlug: row.projectSlug,
+          type
+        })
+      });
+      return allowed ? { ...row, variant: row.variant || null, type } : null;
     }));
+    return visible.filter((row) => row !== null);
   }
 }
 export {

package/dist/production/src/resolvers/query/MailTemplateQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAM,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;"}
+{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\t/** Filters per row rather than throwing, like the other tenant read fields. */\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tconst rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())\n\t\tconst visible = await Promise.all(rows.map(async row => {\n\t\t\tconst type = mailTypeFromDbToSchema(row.type)\n\t\t\tconst allowed = await context.isAllowed({\n\t\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST({\n\t\t\t\t\tkind: row.projectSlug === null ? 'global' : 'project',\n\t\t\t\t\tprojectSlug: row.projectSlug,\n\t\t\t\t\ttype,\n\t\t\t\t}),\n\t\t\t})\n\t\t\treturn allowed ? { ...row, variant: row.variant || null, type } : null\n\t\t}))\n\t\treturn visible.filter(row => row !== null)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA;AAAA,EAEhE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB;AAC5E,UAAM,UAAU,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAM,QAAO;AACvD,YAAM,OAAO,uBAAuB,IAAI,IAAI;AAC5C,YAAM,UAAU,MAAM,QAAQ,UAAU;AAAA,QACvC,QAAQ,kBAAkB,mBAAmB;AAAA,UAC5C,MAAM,IAAI,gBAAgB,OAAO,WAAW;AAAA,UAC5C,aAAa,IAAI;AAAA,UACjB;AAAA,QAAA,CACA;AAAA,MAAA,CACD;AACD,aAAO,UAAU,EAAE,GAAG,KAAK,SAAS,IAAI,WAAW,MAAM,KAAA,IAAS;AAAA,IACnE,CAAC,CAAC;AACF,WAAO,QAAQ,OAAO,CAAA,QAAO,QAAQ,IAAI;AAAA,EAC1C;AACD;"}

package/dist/production/src/resolvers/query/PersonQueryResolver.cjs

@@ -2,15 +2,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const PersonResponseFactory = require("../responseHelpers/PersonResponseFactory.cjs");
 class PersonQueryResolver {

package/dist/production/src/resolvers/query/PersonQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["PermissionActions","PersonResponseFactory","rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAMC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQD,kBAAAA,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAME,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAOD,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAASD,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}
+{"version":3,"file":"PersonQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN and PROJECT_ADMIN hold person:list and see every person; so does\n\t\t// a custom role granted it. The check carries no scope, so a *global* project_admin\n\t\t// lists the whole tenant, not just their projects' members.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["PermissionActions","PersonResponseFactory","rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAMC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAM1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQD,kBAAAA,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAME,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAOD,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAASD,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}

package/dist/production/src/resolvers/query/PersonQueryResolver.js

@@ -1,14 +1,17 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { PersonResponseFactory } from "../responseHelpers/PersonResponseFactory.js";
 class PersonQueryResolver {

package/dist/production/src/resolvers/query/PersonQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAM,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAMA,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}
+{"version":3,"file":"PersonQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN and PROJECT_ADMIN hold person:list and see every person; so does\n\t\t// a custom role granted it. The check carries no scope, so a *global* project_admin\n\t\t// lists the whole tenant, not just their projects' members.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAM,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAM1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAMA,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}

package/dist/production/src/resolvers/query/ProjectMembersQueryResolver.cjs

@@ -2,15 +2,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class ProjectMembersQueryResolver {
   constructor(projectManager, projectMemberManager) {

package/dist/production/src/resolvers/query/ProjectMembersQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;;"}
+{"version":3,"file":"ProjectMembersQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;;"}

package/dist/production/src/resolvers/query/ProjectMembersQueryResolver.js

@@ -1,14 +1,17 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class ProjectMembersQueryResolver {
   constructor(projectManager, projectMemberManager) {

package/dist/production/src/resolvers/query/ProjectMembersQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;"}
+{"version":3,"file":"ProjectMembersQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;"}

package/dist/production/src/resolvers/query/ProjectQueryResolver.cjs

@@ -2,15 +2,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PermissionActions = require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,15 +21,15 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
+const ProjectResponseFactory = require("../responseHelpers/ProjectResponseFactory.cjs");
 class ProjectQueryResolver {
   constructor(projectManager) {
     this.projectManager = projectManager;
   }
   async projects(parent, args, context) {
     return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-      (it) => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] })
+      ProjectResponseFactory.ProjectResponseFactory.createProjectResponse
     );
   }
   async projectBySlug(parent, args, context) {
@@ -37,7 +40,7 @@ class ProjectQueryResolver {
     })) {
       return null;
     }
-    return { ...project, members: [], roles: [], apiKeys: [], secrets: [] };
+    return ProjectResponseFactory.ProjectResponseFactory.createProjectResponse(project);
   }
 }
 exports.ProjectQueryResolver = ProjectQueryResolver;

package/dist/production/src/resolvers/query/ProjectQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tit => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [] }\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,CAAA,QAAO,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,IAAE;AAAA,EAEnE;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,EAAE,GAAG,SAAS,SAAS,IAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,GAAC;AAAA,EACrE;AACD;;"}
+{"version":3,"file":"ProjectQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tProjectResponseFactory.createProjectResponse,\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn ProjectResponseFactory.createProjectResponse(project)\n\t}\n}\n"],"names":["ProjectResponseFactory","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpHA,8CAAuB;AAAA,IAAA;AAAA,EAEzB;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAOD,uBAAAA,uBAAuB,sBAAsB,OAAO;AAAA,EAC5D;AACD;;"}

package/dist/production/src/resolvers/query/ProjectQueryResolver.js

@@ -1,14 +1,17 @@
 import { PermissionActions } from "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,15 +19,15 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
+import { ProjectResponseFactory } from "../responseHelpers/ProjectResponseFactory.js";
 class ProjectQueryResolver {
   constructor(projectManager) {
     this.projectManager = projectManager;
   }
   async projects(parent, args, context) {
     return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-      (it) => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] })
+      ProjectResponseFactory.createProjectResponse
     );
   }
   async projectBySlug(parent, args, context) {
@@ -35,7 +38,7 @@ class ProjectQueryResolver {
     })) {
       return null;
     }
-    return { ...project, members: [], roles: [], apiKeys: [], secrets: [] };
+    return ProjectResponseFactory.createProjectResponse(project);
   }
 }
 export {

package/dist/production/src/resolvers/query/ProjectQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tit => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,CAAA,QAAO,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,IAAE;AAAA,EAEnE;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,EAAE,GAAG,SAAS,SAAS,IAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,GAAC;AAAA,EACrE;AACD;"}
+{"version":3,"file":"ProjectQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tProjectResponseFactory.createProjectResponse,\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn ProjectResponseFactory.createProjectResponse(project)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,uBAAuB;AAAA,IAAA;AAAA,EAEzB;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,uBAAuB,sBAAsB,OAAO;AAAA,EAC5D;AACD;"}

package/dist/production/src/resolvers/responseHelpers/ApiKeyResponseFactory.cjs

@@ -2,15 +2,18 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const ApiKey = require("../../model/type/ApiKey.cjs");
+require("../../model/authorization/CustomRolePermissions.cjs");
 require("../../model/authorization/PermissionContext.cjs");
-require("../../model/authorization/PermissionsFactory.cjs");
+require("../../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-const ApiKey = require("../../model/type/ApiKey.cjs");
-require("@contember/database");
 require("node:crypto");
-require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const apiKeyTypeToSchema = (type) => {
   switch (type) {

package/dist/production/src/resolvers/responseHelpers/ApiKeyResponseFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ApiKeyResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;;"}

package/dist/production/src/resolvers/responseHelpers/ApiKeyResponseFactory.js

@@ -1,14 +1,17 @@
 import "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { ApiKey } from "../../model/type/ApiKey.js";
+import "../../model/authorization/CustomRolePermissions.js";
 import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
+import "../../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import { ApiKey } from "../../model/type/ApiKey.js";
-import "@contember/database";
 import "node:crypto";
-import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 const apiKeyTypeToSchema = (type) => {
   switch (type) {

package/dist/production/src/resolvers/responseHelpers/ApiKeyResponseFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ApiKeyResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;"}

package/dist/production/src/resolvers/responseHelpers/PersonResponseFactory.cjs

@@ -13,6 +13,11 @@ class PersonResponseFactory {
       emailVerified: !!personRow.email_verified_at,
       name: personRow.name,
       passwordlessEnabled: personRow.passwordless_enabled,
+      // resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+      // non-nullable field types complete
+      passwordlessAvailable: false,
+      passwordlessSelfManaged: false,
+      disabledAt: personRow.disabled_at,
       identity: {
         id: personRow.identity_id,
         projects,

package/dist/production/src/resolvers/responseHelpers/PersonResponseFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA,MAC/B,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;;"}
+{"version":3,"file":"PersonResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\t// resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the\n\t\t\t// non-nullable field types complete\n\t\t\tpasswordlessAvailable: false,\n\t\t\tpasswordlessSelfManaged: false,\n\t\t\tdisabledAt: personRow.disabled_at,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA;AAAA;AAAA,MAG/B,uBAAuB;AAAA,MACvB,yBAAyB;AAAA,MACzB,YAAY,UAAU;AAAA,MACtB,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;;"}

package/dist/production/src/resolvers/responseHelpers/PersonResponseFactory.js

@@ -11,6 +11,11 @@ class PersonResponseFactory {
       emailVerified: !!personRow.email_verified_at,
       name: personRow.name,
       passwordlessEnabled: personRow.passwordless_enabled,
+      // resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+      // non-nullable field types complete
+      passwordlessAvailable: false,
+      passwordlessSelfManaged: false,
+      disabledAt: personRow.disabled_at,
       identity: {
         id: personRow.identity_id,
         projects,