@contember/engine-tenant-api 2.2.0-alpha.2 → 2.2.0-alpha.5

package/dist/development/src/resolvers/query/ProjectQueryResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,15 +20,15 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
+const ProjectResponseFactory = require("../responseHelpers/ProjectResponseFactory.cjs");
 class ProjectQueryResolver {
   constructor(projectManager) {
     this.projectManager = projectManager;
   }
   async projects(parent, args, context) {
     return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-      (it) => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] })
+      ProjectResponseFactory.ProjectResponseFactory.createProjectResponse
     );
   }
   async projectBySlug(parent, args, context) {
@@ -37,7 +39,7 @@ class ProjectQueryResolver {
     })) {
       return null;
     }
-    return { ...project, members: [], roles: [], apiKeys: [], secrets: [] };
+    return ProjectResponseFactory.ProjectResponseFactory.createProjectResponse(project);
   }
 }
 exports.ProjectQueryResolver = ProjectQueryResolver;

package/dist/development/src/resolvers/query/ProjectQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tit => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [] }\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,CAAA,QAAO,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,IAAE;AAAA,EAEnE;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,EAAE,GAAG,SAAS,SAAS,IAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,GAAC;AAAA,EACrE;AACD;;"}
+{"version":3,"file":"ProjectQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tProjectResponseFactory.createProjectResponse,\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn ProjectResponseFactory.createProjectResponse(project)\n\t}\n}\n"],"names":["ProjectResponseFactory","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpHA,8CAAuB;AAAA,IAAA;AAAA,EAEzB;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAOD,uBAAAA,uBAAuB,sBAAsB,OAAO;AAAA,EAC5D;AACD;;"}

package/dist/development/src/resolvers/query/ProjectQueryResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,15 +18,15 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
+import { ProjectResponseFactory } from "../responseHelpers/ProjectResponseFactory.js";
 class ProjectQueryResolver {
   constructor(projectManager) {
     this.projectManager = projectManager;
   }
   async projects(parent, args, context) {
     return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-      (it) => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] })
+      ProjectResponseFactory.createProjectResponse
     );
   }
   async projectBySlug(parent, args, context) {
@@ -35,7 +37,7 @@ class ProjectQueryResolver {
     })) {
       return null;
     }
-    return { ...project, members: [], roles: [], apiKeys: [], secrets: [] };
+    return ProjectResponseFactory.createProjectResponse(project);
   }
 }
 export {

package/dist/development/src/resolvers/query/ProjectQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tit => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [] }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,CAAA,QAAO,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,IAAE;AAAA,EAEnE;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,EAAE,GAAG,SAAS,SAAS,IAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,GAAC;AAAA,EACrE;AACD;"}
+{"version":3,"file":"ProjectQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectQueryResolver.ts"],"sourcesContent":["import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../model/index.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class ProjectQueryResolver implements QueryResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {\n\t\treturn (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(\n\t\t\tProjectResponseFactory.createProjectResponse,\n\t\t)\n\t}\n\n\tasync projectBySlug(\n\t\tparent: unknown,\n\t\targs: QueryProjectBySlugArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Project>> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.slug)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t\t}))\n\t\t) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn ProjectResponseFactory.createProjectResponse(project)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,qBAA+C;AAAA,EAC3D,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,SAAS,QAAiB,MAAe,SAA6D;AAC3G,YAAQ,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB,GAAG;AAAA,MACpH,uBAAuB;AAAA,IAAA;AAAA,EAEzB;AAAA,EAEA,MAAM,cACL,QACA,MACA,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,IAAI;AAChF,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B,GACA;AACD,aAAO;AAAA,IACR;AAEA,WAAO,uBAAuB,sBAAsB,OAAO;AAAA,EAC5D;AACD;"}

package/dist/development/src/resolvers/responseHelpers/ApiKeyResponseFactory.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const apiKeyTypeToSchema = (type) => {
   switch (type) {

package/dist/development/src/resolvers/responseHelpers/ApiKeyResponseFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ApiKeyResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAAA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;;"}

package/dist/development/src/resolvers/responseHelpers/ApiKeyResponseFactory.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 const apiKeyTypeToSchema = (type) => {
   switch (type) {

package/dist/development/src/resolvers/responseHelpers/ApiKeyResponseFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ApiKeyResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ApiKeyResponseFactory.ts"],"sourcesContent":["import { ApiKey as ApiKeyDto } from '../../model/index.js'\nimport { ApiKeyListRow } from '../../model/queries/apiKey/index.js'\nimport { ApiKey, ApiKeyType } from '../../schema/index.js'\n\nconst apiKeyTypeToSchema = (type: ApiKeyDto.Type): ApiKeyType => {\n\tswitch (type) {\n\t\tcase ApiKeyDto.Type.SESSION:\n\t\t\treturn 'SESSION'\n\t\tcase ApiKeyDto.Type.PERMANENT:\n\t\t\treturn 'PERMANENT'\n\t\tcase ApiKeyDto.Type.ONE_OFF:\n\t\t\treturn 'ONE_OFF'\n\t}\n}\n\nexport class ApiKeyResponseFactory {\n\tpublic static createApiKeyResponse(row: ApiKeyListRow): ApiKey {\n\t\treturn {\n\t\t\tid: row.id,\n\t\t\ttype: apiKeyTypeToSchema(row.type),\n\t\t\tdescription: row.description,\n\t\t\tenabled: row.disabled_at === null,\n\t\t\tcreatedAt: row.created_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\t// projects/sessions left empty so IdentityTypeResolver resolves them lazily —\n\t\t\t// apiKey.identity.projects exposes the key's memberships for cloning.\n\t\t\tidentity: {\n\t\t\t\tid: row.identity_id,\n\t\t\t\tdescription: row.description,\n\t\t\t\tprojects: [],\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["ApiKeyDto"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAIA,MAAM,qBAAqB,CAAC,SAAqC;AAChE,UAAQ,MAAA;AAAA,IACP,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,IACR,KAAKA,OAAU,KAAK;AACnB,aAAO;AAAA,EAAA;AAEV;AAEO,MAAM,sBAAsB;AAAA,EAClC,OAAc,qBAAqB,KAA4B;AAC9D,WAAO;AAAA,MACN,IAAI,IAAI;AAAA,MACR,MAAM,mBAAmB,IAAI,IAAI;AAAA,MACjC,aAAa,IAAI;AAAA,MACjB,SAAS,IAAI,gBAAgB;AAAA,MAC7B,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA;AAAA;AAAA,MAGf,UAAU;AAAA,QACT,IAAI,IAAI;AAAA,QACR,aAAa,IAAI;AAAA,QACjB,UAAU,CAAA;AAAA,QACV,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;"}

package/dist/development/src/resolvers/responseHelpers/PersonResponseFactory.cjs

@@ -13,6 +13,11 @@ class PersonResponseFactory {
       emailVerified: !!personRow.email_verified_at,
       name: personRow.name,
       passwordlessEnabled: personRow.passwordless_enabled,
+      // resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+      // non-nullable field types complete
+      passwordlessAvailable: false,
+      passwordlessSelfManaged: false,
+      disabledAt: personRow.disabled_at,
       identity: {
         id: personRow.identity_id,
         projects,

package/dist/development/src/resolvers/responseHelpers/PersonResponseFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA,MAC/B,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;;"}
+{"version":3,"file":"PersonResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\t// resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the\n\t\t\t// non-nullable field types complete\n\t\t\tpasswordlessAvailable: false,\n\t\t\tpasswordlessSelfManaged: false,\n\t\t\tdisabledAt: personRow.disabled_at,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA;AAAA;AAAA,MAG/B,uBAAuB;AAAA,MACvB,yBAAyB;AAAA,MACzB,YAAY,UAAU;AAAA,MACtB,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;;"}

package/dist/development/src/resolvers/responseHelpers/PersonResponseFactory.js

@@ -11,6 +11,11 @@ class PersonResponseFactory {
       emailVerified: !!personRow.email_verified_at,
       name: personRow.name,
       passwordlessEnabled: personRow.passwordless_enabled,
+      // resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+      // non-nullable field types complete
+      passwordlessAvailable: false,
+      passwordlessSelfManaged: false,
+      disabledAt: personRow.disabled_at,
       identity: {
         id: personRow.identity_id,
         projects,

package/dist/development/src/resolvers/responseHelpers/PersonResponseFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA,MAC/B,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;"}
+{"version":3,"file":"PersonResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/PersonResponseFactory.ts"],"sourcesContent":["import { PersonListRow } from '../../model/index.js'\nimport { IdentityProjectRelation, Person } from '../../schema/index.js'\n\nexport class PersonResponseFactory {\n\t// Accepts the slim `PersonListRow` shape; the full `PersonRow` (from byId/auth\n\t// lookups) is structurally compatible, so both listing and single-person paths\n\t// reuse this without dragging secret columns through the listing.\n\tpublic static createPersonResponse(personRow: PersonListRow, projects: ReadonlyArray<IdentityProjectRelation> = []): Person {\n\t\treturn {\n\t\t\tid: personRow.id,\n\t\t\totpEnabled: !!personRow.otp_activated_at,\n\t\t\temailOtpEnabled: personRow.email_otp_enabled,\n\t\t\temail: personRow.email,\n\t\t\temailVerified: !!personRow.email_verified_at,\n\t\t\tname: personRow.name,\n\t\t\tpasswordlessEnabled: personRow.passwordless_enabled,\n\t\t\t// resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the\n\t\t\t// non-nullable field types complete\n\t\t\tpasswordlessAvailable: false,\n\t\t\tpasswordlessSelfManaged: false,\n\t\t\tdisabledAt: personRow.disabled_at,\n\t\t\tidentity: {\n\t\t\t\tid: personRow.identity_id,\n\t\t\t\tprojects,\n\t\t\t\tsessions: [],\n\t\t\t},\n\t\t\t// resolved by PersonTypeResolver.identityProviders; placeholder keeps the type complete\n\t\t\tidentityProviders: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,sBAAsB;AAAA;AAAA;AAAA;AAAA,EAIlC,OAAc,qBAAqB,WAA0B,WAAmD,IAAY;AAC3H,WAAO;AAAA,MACN,IAAI,UAAU;AAAA,MACd,YAAY,CAAC,CAAC,UAAU;AAAA,MACxB,iBAAiB,UAAU;AAAA,MAC3B,OAAO,UAAU;AAAA,MACjB,eAAe,CAAC,CAAC,UAAU;AAAA,MAC3B,MAAM,UAAU;AAAA,MAChB,qBAAqB,UAAU;AAAA;AAAA;AAAA,MAG/B,uBAAuB;AAAA,MACvB,yBAAyB;AAAA,MACzB,YAAY,UAAU;AAAA,MACtB,UAAU;AAAA,QACT,IAAI,UAAU;AAAA,QACd;AAAA,QACA,UAAU,CAAA;AAAA,MAAC;AAAA;AAAA,MAGZ,mBAAmB,CAAA;AAAA,IAAC;AAAA,EAEtB;AACD;"}

package/dist/development/src/resolvers/responseHelpers/ProjectResponseFactory.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const unresolvedPermissions = {
+  canViewMembers: false,
+  canAddMember: false,
+  canUpdateMember: false,
+  canRemoveMember: false,
+  canViewSecrets: false,
+  canSetSecret: false,
+  canCreateApiKey: false,
+  canUpdate: false
+};
+class ProjectResponseFactory {
+  /**
+   * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,
+   * roles, api keys, secrets and permissions all need the project scope, which is not known here.
+   */
+  static createProjectResponse(project) {
+    return { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions };
+  }
+}
+exports.ProjectResponseFactory = ProjectResponseFactory;
+//# sourceMappingURL=ProjectResponseFactory.cjs.map

package/dist/development/src/resolvers/responseHelpers/ProjectResponseFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ProjectResponseFactory.ts"],"sourcesContent":["import { Project as ProjectDto } from '../../model/index.js'\nimport { Project } from '../../schema/index.js'\n\n/** Placeholder for `Project.permissions`; `ProjectTypeResolver.permissions` always replaces it. */\nconst unresolvedPermissions = {\n\tcanViewMembers: false,\n\tcanAddMember: false,\n\tcanUpdateMember: false,\n\tcanRemoveMember: false,\n\tcanViewSecrets: false,\n\tcanSetSecret: false,\n\tcanCreateApiKey: false,\n\tcanUpdate: false,\n}\n\nexport class ProjectResponseFactory {\n\t/**\n\t * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,\n\t * roles, api keys, secrets and permissions all need the project scope, which is not known here.\n\t */\n\tpublic static createProjectResponse(project: ProjectDto): Project {\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions }\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,wBAAwB;AAAA,EAC7B,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AACZ;AAEO,MAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,OAAc,sBAAsB,SAA8B;AACjE,WAAO,EAAE,GAAG,SAAS,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,IAAI,aAAa,sBAAA;AAAA,EACrF;AACD;;"}

package/dist/development/src/resolvers/responseHelpers/ProjectResponseFactory.js

@@ -0,0 +1,23 @@
+const unresolvedPermissions = {
+  canViewMembers: false,
+  canAddMember: false,
+  canUpdateMember: false,
+  canRemoveMember: false,
+  canViewSecrets: false,
+  canSetSecret: false,
+  canCreateApiKey: false,
+  canUpdate: false
+};
+class ProjectResponseFactory {
+  /**
+   * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,
+   * roles, api keys, secrets and permissions all need the project scope, which is not known here.
+   */
+  static createProjectResponse(project) {
+    return { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions };
+  }
+}
+export {
+  ProjectResponseFactory
+};
+//# sourceMappingURL=ProjectResponseFactory.js.map

package/dist/development/src/resolvers/responseHelpers/ProjectResponseFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/ProjectResponseFactory.ts"],"sourcesContent":["import { Project as ProjectDto } from '../../model/index.js'\nimport { Project } from '../../schema/index.js'\n\n/** Placeholder for `Project.permissions`; `ProjectTypeResolver.permissions` always replaces it. */\nconst unresolvedPermissions = {\n\tcanViewMembers: false,\n\tcanAddMember: false,\n\tcanUpdateMember: false,\n\tcanRemoveMember: false,\n\tcanViewSecrets: false,\n\tcanSetSecret: false,\n\tcanCreateApiKey: false,\n\tcanUpdate: false,\n}\n\nexport class ProjectResponseFactory {\n\t/**\n\t * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,\n\t * roles, api keys, secrets and permissions all need the project scope, which is not known here.\n\t */\n\tpublic static createProjectResponse(project: ProjectDto): Project {\n\t\treturn { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions }\n\t}\n}\n"],"names":[],"mappings":"AAIA,MAAM,wBAAwB;AAAA,EAC7B,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,iBAAiB;AAAA,EACjB,WAAW;AACZ;AAEO,MAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,OAAc,sBAAsB,SAA8B;AACjE,WAAO,EAAE,GAAG,SAAS,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,CAAA,GAAI,SAAS,IAAI,aAAa,sBAAA;AAAA,EACrF;AACD;"}

package/dist/development/src/resolvers/responseHelpers/SignInResponseFactory.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 require("@contember/graphql-utils");
 const PersonResponseFactory = require("./PersonResponseFactory.cjs");

package/dist/development/src/resolvers/responseHelpers/SignInResponseFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index.js'\nimport { PermissionContextFactory, SignInResult } from '../../model/index.js'\nimport { CommonSignInResult } from '../../schema/index.js'\nimport { PersonResponseFactory } from './PersonResponseFactory.js'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(\n\t\tsignInResult: SignInResult,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CommonSignInResult & { backupCodes?: readonly string[] }> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t\t// Present only when this sign-in completed an MFA enrollment (A06).\n\t\t\t...(signInResult.backupCodes ? { backupCodes: signInResult.backupCodes } : {}),\n\t\t}\n\t}\n}\n"],"names":["createResolverContext","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eACZ,cACA,SACoE;AACpE,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAGA,6BAAAA,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQC,sBAAAA,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA;AAAA,MAEhF,GAAI,aAAa,cAAc,EAAE,aAAa,aAAa,YAAA,IAAgB,CAAA;AAAA,IAAC;AAAA,EAE9E;AACD;;"}
+{"version":3,"file":"SignInResponseFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index.js'\nimport { PermissionContextFactory, SignInResult } from '../../model/index.js'\nimport { CommonSignInResult } from '../../schema/index.js'\nimport { PersonResponseFactory } from './PersonResponseFactory.js'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(\n\t\tsignInResult: SignInResult,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CommonSignInResult & { backupCodes?: readonly string[] }> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t\t// Present only when this sign-in completed an MFA enrollment (A06).\n\t\t\t...(signInResult.backupCodes ? { backupCodes: signInResult.backupCodes } : {}),\n\t\t}\n\t}\n}\n"],"names":["createResolverContext","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eACZ,cACA,SACoE;AACpE,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAGA,6BAAAA,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQC,sBAAAA,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA;AAAA,MAEhF,GAAI,aAAa,cAAc,EAAE,aAAa,aAAa,YAAA,IAAgB,CAAA;AAAA,IAAC;AAAA,EAE9E;AACD;;"}

package/dist/development/src/resolvers/responseHelpers/SignInResponseFactory.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import "@contember/graphql-utils";
 import { PersonResponseFactory } from "./PersonResponseFactory.js";

package/dist/development/src/resolvers/responseHelpers/SignInResponseFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index.js'\nimport { PermissionContextFactory, SignInResult } from '../../model/index.js'\nimport { CommonSignInResult } from '../../schema/index.js'\nimport { PersonResponseFactory } from './PersonResponseFactory.js'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(\n\t\tsignInResult: SignInResult,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CommonSignInResult & { backupCodes?: readonly string[] }> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t\t// Present only when this sign-in completed an MFA enrollment (A06).\n\t\t\t...(signInResult.backupCodes ? { backupCodes: signInResult.backupCodes } : {}),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eACZ,cACA,SACoE;AACpE,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAG,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQ,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA;AAAA,MAEhF,GAAI,aAAa,cAAc,EAAE,aAAa,aAAa,YAAA,IAAgB,CAAA;AAAA,IAAC;AAAA,EAE9E;AACD;"}
+{"version":3,"file":"SignInResponseFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/responseHelpers/SignInResponseFactory.ts"],"sourcesContent":["import { createResolverContext, IdentityTypeResolver, TenantResolverContext } from '../index.js'\nimport { PermissionContextFactory, SignInResult } from '../../model/index.js'\nimport { CommonSignInResult } from '../../schema/index.js'\nimport { PersonResponseFactory } from './PersonResponseFactory.js'\n\nexport class SignInResponseFactory {\n\tconstructor(\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly identityTypeResolver: IdentityTypeResolver,\n\t) {\n\t}\n\n\tpublic async createResponse(\n\t\tsignInResult: SignInResult,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CommonSignInResult & { backupCodes?: readonly string[] }> {\n\t\tconst identityId = signInResult.person.identity_id\n\t\tconst permissionContext = this.permissionContextFactory.create(context.db, {\n\t\t\tid: identityId,\n\t\t\troles: signInResult.person.roles,\n\t\t})\n\t\tconst projects = await this.identityTypeResolver.projects(\n\t\t\t{ id: identityId, projects: [] },\n\t\t\t{},\n\t\t\t{\n\t\t\t\t...context,\n\t\t\t\t...createResolverContext(permissionContext, context.apiKeyId),\n\t\t\t},\n\t\t)\n\t\treturn {\n\t\t\ttoken: signInResult.token,\n\t\t\tperson: PersonResponseFactory.createPersonResponse(signInResult.person, projects),\n\t\t\t// Present only when this sign-in completed an MFA enrollment (A06).\n\t\t\t...(signInResult.backupCodes ? { backupCodes: signInResult.backupCodes } : {}),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,sBAAsB;AAAA,EAClC,YACkB,0BACA,sBAChB;AAFgB,SAAA,2BAAA;AACA,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eACZ,cACA,SACoE;AACpE,UAAM,aAAa,aAAa,OAAO;AACvC,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAC1E,IAAI;AAAA,MACJ,OAAO,aAAa,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,MAAM,KAAK,qBAAqB;AAAA,MAChD,EAAE,IAAI,YAAY,UAAU,GAAC;AAAA,MAC7B,CAAA;AAAA,MACA;AAAA,QACC,GAAG;AAAA,QACH,GAAG,sBAAsB,mBAAmB,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC7D;AAED,WAAO;AAAA,MACN,OAAO,aAAa;AAAA,MACpB,QAAQ,sBAAsB,qBAAqB,aAAa,QAAQ,QAAQ;AAAA;AAAA,MAEhF,GAAI,aAAa,cAAc,EAAE,aAAa,aAAa,YAAA,IAAgB,CAAA;AAAA,IAAC;AAAA,EAE9E;AACD;"}

package/dist/development/src/resolvers/types/IdentityTypeResolver.cjs

@@ -15,6 +15,8 @@ const PersonByIdentityBatchQuery = require("../../model/queries/person/PersonByI
 const IdentityQuery = require("../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,10 +24,10 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const array = require("../../utils/array.cjs");
 const PersonResponseFactory = require("../responseHelpers/PersonResponseFactory.cjs");
+const ProjectResponseFactory = require("../responseHelpers/ProjectResponseFactory.cjs");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
@@ -79,7 +81,7 @@ class IdentityTypeResolver {
           return null;
         }
         return {
-          project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+          project: ProjectResponseFactory.ProjectResponseFactory.createProjectResponse(it),
           memberships
         };
       })
@@ -118,9 +120,40 @@ class IdentityTypeResolver {
     if (!permissionsContext) {
       return null;
     }
+    const [
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
+    ] = await Promise.all([
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PROJECT_CREATE }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.CONFIG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.IDP_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.CONFIGURE }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.AUTH_LOG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PERSON_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.API_KEY_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL() })
+    ]);
     return {
-      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PROJECT_CREATE }),
-      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY })
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
     };
   }
   async sessions(parent, args, context) {

package/dist/development/src/resolvers/types/IdentityTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","notEmpty","PermissionActions","ApiKeySessionsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,UACjE;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQA,kBAAAA,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,oBAAAA,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;;"}
+{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: ProjectResponseFactory.createProjectResponse(it),\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Advisory only — every one of these is checked again where it is used. It exists so a UI can\n\t\t// stop offering what it cannot deliver: the operations behind these flags fail in three\n\t\t// different ways (empty list, thrown query, thrown mutation), so probing is not an option.\n\t\tconst [\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t] = await Promise.all([\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),\n\t\t])\n\n\t\treturn {\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","ProjectResponseFactory","notEmpty","PermissionActions","ApiKeySessionsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAASC,uBAAAA,uBAAuB,sBAAsB,EAAE;AAAA,UACxD;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAKA,UAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,IACG,MAAM,QAAQ,IAAI;AAAA,MACrB,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACzE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,MAC5E,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,UAAU;AAAA,MACnE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,oBAAoB;AAAA,MAC7E,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,WAAW;AAAA,MACpE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,eAAe;AAAA,MACxE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,cAAc;AAAA,MACvE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,sBAAA,GAAyB;AAAA,IAAA,CAClF;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQA,kBAAAA,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,oBAAAA,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/types/IdentityTypeResolver.js

@@ -13,6 +13,8 @@ import { PersonByIdentityBatchQuery } from "../../model/queries/person/PersonByI
 import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,10 +22,10 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { notEmpty } from "../../utils/array.js";
 import { PersonResponseFactory } from "../responseHelpers/PersonResponseFactory.js";
+import { ProjectResponseFactory } from "../responseHelpers/ProjectResponseFactory.js";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
@@ -77,7 +79,7 @@ class IdentityTypeResolver {
           return null;
         }
         return {
-          project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+          project: ProjectResponseFactory.createProjectResponse(it),
           memberships
         };
       })
@@ -116,9 +118,40 @@ class IdentityTypeResolver {
     if (!permissionsContext) {
       return null;
     }
+    const [
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
+    ] = await Promise.all([
+      permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+      permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+      permissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),
+      permissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() })
+    ]);
     return {
-      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
-      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY })
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
     };
   }
   async sessions(parent, args, context) {

package/dist/development/src/resolvers/types/IdentityTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,UACjE;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;"}
+{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: ProjectResponseFactory.createProjectResponse(it),\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Advisory only — every one of these is checked again where it is used. It exists so a UI can\n\t\t// stop offering what it cannot deliver: the operations behind these flags fail in three\n\t\t// different ways (empty list, thrown query, thrown mutation), so probing is not an option.\n\t\tconst [\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t] = await Promise.all([\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),\n\t\t])\n\n\t\treturn {\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,uBAAuB,sBAAsB,EAAE;AAAA,UACxD;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAKA,UAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,IACG,MAAM,QAAQ,IAAI;AAAA,MACrB,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACzE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,MAC5E,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,UAAU;AAAA,MACnE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,oBAAoB;AAAA,MAC7E,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,WAAW;AAAA,MACpE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,eAAe;AAAA,MACxE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,cAAc;AAAA,MACvE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,sBAAA,GAAyB;AAAA,IAAA,CAClF;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;"}