@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/resolvers/ResolverFactory.js

@@ -16,13 +16,16 @@ class ResolverFactory {
         sessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver)
       },
       Person: {
-        identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver)
+        identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),
+        passwordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),
+        passwordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver)
       },
       Project: {
         members: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),
         roles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),
         apiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),
-        secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver)
+        secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),
+        permissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver)
       },
       Query: {
         me: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),
@@ -69,6 +72,7 @@ class ResolverFactory {
           this.resolvers.disconnectMyIdentityProviderMutationResolver
         ),
         disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
+        enablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),
         forceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),
         resetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),
         revokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),

package/dist/development/src/resolvers/ResolverFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResolverFactory.js","sources":["../../../../../packages/engine-tenant-api/src/resolvers/ResolverFactory.ts"],"sourcesContent":["import {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tEmailOtpMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tOtpMutationResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './mutation/index.js'\n\nimport { Resolvers } from '../schema/index.js'\nimport {\n\tApiKeyQueryResolver,\n\tAuthLogQueryResolver,\n\tMeQueryResolver,\n\tPersonQueryResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n} from './query/index.js'\nimport { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js'\nimport { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js'\nimport { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'\nimport { IDPQueryResolver } from './query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'\nimport { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'\nimport { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'\nimport { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'\nimport { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'\nimport { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js'\n\nclass ResolverFactory {\n\tpublic constructor(\n\t\tprivate readonly resolvers: {\n\t\t\tmeQueryResolver: MeQueryResolver\n\t\t\tpersonQueryResolver: PersonQueryResolver\n\t\t\tprojectQueryResolver: ProjectQueryResolver\n\t\t\tprojectMembersQueryResolver: ProjectMembersQueryResolver\n\t\t\tidpQueryResolver: IDPQueryResolver\n\t\t\tmailTemplateQueryResolver: MailTemplateQueryResolver\n\n\t\t\tsignUpMutationResolver: SignUpMutationResolver\n\t\t\tsignInMutationResolver: SignInMutationResolver\n\t\t\tsignOutMutationResolver: SignOutMutationResolver\n\t\t\tchangeProfileMutationResolver: ChangeProfileMutationResolver\n\t\t\tchangePasswordMutationResolver: ChangePasswordMutationResolver\n\t\t\tresetPasswordMutationResolver: ResetPasswordMutationResolver\n\t\t\temailVerificationMutationResolver: EmailVerificationMutationResolver\n\t\t\tidpMutationResolver: IDPMutationResolver\n\t\t\tregisterIdpMutationResolver: AddIDPMutationResolver\n\t\t\tdisableIdpMutationResolver: DisableIDPMutationResolver\n\t\t\tenableIdpMutationResolver: EnableIDPMutationResolver\n\t\t\tupdateIdpMutationResolver: UpdateIDPMutationResolver\n\t\t\tdisconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver\n\t\t\tpasswordlessMutationResolver: PasswordlessMutationResolver\n\n\t\t\tdisablePersonMutationResolver: DisablePersonMutationResolver\n\t\t\tforceSignOutMutationResolver: ForceSignOutMutationResolver\n\t\t\tresetPersonMfaMutationResolver: ResetPersonMfaMutationResolver\n\t\t\trevokeSessionMutationResolver: RevokeSessionMutationResolver\n\n\t\t\tinviteMutationResolver: InviteMutationResolver\n\t\t\taddProjectMemberMutationResolver: AddProjectMemberMutationResolver\n\t\t\tupdateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver\n\t\t\tremoveProjectMemberMutationResolver: RemoveProjectMemberMutationResolver\n\n\t\t\tcreateApiKeyMutationResolver: CreateApiKeyMutationResolver\n\t\t\tdisableApiKeyMutationResolver: DisableApiKeyMutationResolver\n\n\t\t\totpMutationResolver: OtpMutationResolver\n\t\t\temailOtpMutationResolver: EmailOtpMutationResolver\n\t\t\tregenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver\n\n\t\t\tmailTemplateMutationResolver: MailTemplateMutationResolver\n\n\t\t\tcreateProjectMutationResolver: CreateProjectMutationResolver\n\t\t\tsetProjectSecretMutationResolver: SetProjectSecretMutationResolver\n\t\t\tupdateProjectMutationResolver: UpdateProjectMutationResolver\n\n\t\t\tidentityTypeResolver: IdentityTypeResolver\n\t\t\tpersonTypeResolver: PersonTypeResolver\n\t\t\tprojectTypeResolver: ProjectTypeResolver\n\n\t\t\tidentityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver\n\n\t\t\tconfigurationMutationResolver: ConfigurationMutationResolver\n\t\t\tconfigurationQueryResolver: ConfigurationQueryResolver\n\n\t\t\tauthPolicyMutationResolver: AuthPolicyMutationResolver\n\t\t\tauthPolicyQueryResolver: AuthPolicyQueryResolver\n\n\t\t\tauthLogQueryResolver: AuthLogQueryResolver\n\t\t\tapiKeyQueryResolver: ApiKeyQueryResolver\n\n\t\t\ttogglePasswordlessMutationResolver: TogglePasswordlessMutationResolver\n\t\t},\n\t) {}\n\n\tcreate(): Resolvers & { Mutation: Required<Resolvers['Mutation']> } & { Query: Required<Resolvers['Query']> } {\n\t\treturn {\n\t\t\tJson: JSONType,\n\t\t\tDateTime: DateTimeType,\n\t\t\tInterval: IntervalType,\n\t\t\tIdentity: {\n\t\t\t\tprojects: this.resolvers.identityTypeResolver.projects.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tperson: this.resolvers.identityTypeResolver.person.bind(this.resolvers.identityTypeResolver),\n\t\t\t\troles: this.resolvers.identityTypeResolver.roles.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tpermissions: this.resolvers.identityTypeResolver.permissions.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tsessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver),\n\t\t\t},\n\t\t\tPerson: {\n\t\t\t\tidentityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),\n\t\t\t},\n\t\t\tProject: {\n\t\t\t\tmembers: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),\n\t\t\t\troles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tapiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tsecrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),\n\t\t\t},\n\t\t\tQuery: {\n\t\t\t\tme: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),\n\t\t\t\tpersonById: this.resolvers.personQueryResolver.personById.bind(this.resolvers.personQueryResolver),\n\t\t\t\tpersons: this.resolvers.personQueryResolver.persons.bind(this.resolvers.personQueryResolver),\n\t\t\t\tglobalApiKeys: this.resolvers.apiKeyQueryResolver.globalApiKeys.bind(this.resolvers.apiKeyQueryResolver),\n\t\t\t\tprojectBySlug: this.resolvers.projectQueryResolver.projectBySlug.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojects: this.resolvers.projectQueryResolver.projects.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),\n\t\t\t\tidentityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),\n\t\t\t\tmailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),\n\t\t\t\tconfiguration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),\n\t\t\t\tauthPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),\n\t\t\t\tauthLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),\n\t\t\t\tcheckResetPasswordToken: () => {\n\t\t\t\t\tthrow new Error('not implemented')\n\t\t\t\t},\n\t\t\t},\n\t\t\tMutation: {\n\t\t\t\tsignUp: this.resolvers.signUpMutationResolver.signUp.bind(this.resolvers.signUpMutationResolver),\n\t\t\t\tsignIn: this.resolvers.signInMutationResolver.signIn.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tcreateSessionToken: this.resolvers.signInMutationResolver.createSessionToken.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tsignOut: this.resolvers.signOutMutationResolver.signOut.bind(this.resolvers.signOutMutationResolver),\n\n\t\t\t\tchangeProfile: this.resolvers.changeProfileMutationResolver.changeProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangeMyProfile: this.resolvers.changeProfileMutationResolver.changeMyProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangePassword: this.resolvers.changePasswordMutationResolver.changePassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tchangeMyPassword: this.resolvers.changePasswordMutationResolver.changeMyPassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tcreateResetPasswordRequest: this.resolvers.resetPasswordMutationResolver.createResetPasswordRequest.bind(\n\t\t\t\t\tthis.resolvers.resetPasswordMutationResolver,\n\t\t\t\t),\n\t\t\t\tresetPassword: this.resolvers.resetPasswordMutationResolver.resetPassword.bind(this.resolvers.resetPasswordMutationResolver),\n\n\t\t\t\trequestEmailVerification: this.resolvers.emailVerificationMutationResolver.requestEmailVerification.bind(\n\t\t\t\t\tthis.resolvers.emailVerificationMutationResolver,\n\t\t\t\t),\n\t\t\t\tverifyEmail: this.resolvers.emailVerificationMutationResolver.verifyEmail.bind(this.resolvers.emailVerificationMutationResolver),\n\t\t\t\tconfirmEmailChange: this.resolvers.changeProfileMutationResolver.confirmEmailChange.bind(this.resolvers.changeProfileMutationResolver),\n\n\t\t\t\tinitSignInIDP: this.resolvers.idpMutationResolver.initSignInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\tsignInIDP: this.resolvers.idpMutationResolver.signInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\taddIDP: this.resolvers.registerIdpMutationResolver.addIDP.bind(this.resolvers.registerIdpMutationResolver),\n\t\t\t\tdisableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),\n\t\t\t\tenableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),\n\t\t\t\tupdateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),\n\t\t\t\tdisconnectMyIdentityProvider: this.resolvers.disconnectMyIdentityProviderMutationResolver.disconnectMyIdentityProvider.bind(\n\t\t\t\t\tthis.resolvers.disconnectMyIdentityProviderMutationResolver,\n\t\t\t\t),\n\t\t\t\tdisablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),\n\t\t\t\tforceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),\n\t\t\t\tresetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),\n\t\t\t\trevokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),\n\n\t\t\t\tsignInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tinitSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tactivatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tdisableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\t\t\t\tenableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinvite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),\n\t\t\t\tunmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),\n\n\t\t\t\taddProjectMember: this.resolvers.addProjectMemberMutationResolver.addProjectMember.bind(this.resolvers.addProjectMemberMutationResolver),\n\t\t\t\tupdateProjectMember: this.resolvers.updateProjectMemberMutationResolver.updateProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveProjectMember: this.resolvers.removeProjectMemberMutationResolver.removeProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tcreateApiKey: this.resolvers.createApiKeyMutationResolver.createApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tcreateGlobalApiKey: this.resolvers.createApiKeyMutationResolver.createGlobalApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tdisableApiKey: this.resolvers.disableApiKeyMutationResolver.disableApiKey.bind(this.resolvers.disableApiKeyMutationResolver),\n\n\t\t\t\tprepareOtp: this.resolvers.otpMutationResolver.prepareOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tconfirmOtp: this.resolvers.otpMutationResolver.confirmOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tdisableOtp: this.resolvers.otpMutationResolver.disableOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tregenerateBackupCodes: this.resolvers.regenerateBackupCodesMutationResolver.regenerateBackupCodes.bind(\n\t\t\t\t\tthis.resolvers.regenerateBackupCodesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinitEmailOtp: this.resolvers.emailOtpMutationResolver.initEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tconfirmEmailOtp: this.resolvers.emailOtpMutationResolver.confirmEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tdisableEmailOtp: this.resolvers.emailOtpMutationResolver.disableEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\n\t\t\t\taddMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\taddProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\tcreateProject: this.resolvers.createProjectMutationResolver.createProject.bind(this.resolvers.createProjectMutationResolver),\n\t\t\t\tupdateProject: this.resolvers.updateProjectMutationResolver.updateProject.bind(this.resolvers.updateProjectMutationResolver),\n\t\t\t\tsetProjectSecret: this.resolvers.setProjectSecretMutationResolver.setProjectSecret.bind(this.resolvers.setProjectSecretMutationResolver),\n\n\t\t\t\taddGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tconfigure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),\n\n\t\t\t\tcreateAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tupdateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tdeleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t},\n\t\t}\n\t}\n}\n\nnamespace ResolverFactory {\n\texport type FieldResolverArgs = {\n\t\t[argument: string]: any\n\t}\n}\n\nexport { ResolverFactory }\n"],"names":[],"mappings":";AAsDA,MAAM,gBAAgB;AAAA,EACd,YACW,WA+DhB;AA/DgB,SAAA,YAAA;AAAA,EA+Df;AAAA,EAEH,SAA8G;AAC7G,WAAO;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU;AAAA,MACV,UAAU;AAAA,QACT,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,QAAQ,KAAK,UAAU,qBAAqB,OAAO,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC3F,OAAO,KAAK,UAAU,qBAAqB,MAAM,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzF,aAAa,KAAK,UAAU,qBAAqB,YAAY,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACrG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,MAAA;AAAA,MAEhG,QAAQ;AAAA,QACP,mBAAmB,KAAK,UAAU,mBAAmB,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAAA,MAAA;AAAA,MAE9G,SAAS;AAAA,QACR,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,OAAO,KAAK,UAAU,oBAAoB,MAAM,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvF,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,MAAA;AAAA,MAE5F,OAAO;AAAA,QACN,IAAI,KAAK,UAAU,gBAAgB,GAAG,KAAK,KAAK,UAAU,eAAe;AAAA,QACzE,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,eAAe,KAAK,UAAU,qBAAqB,cAAc,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,4BAA4B,mBAAmB,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACjI,mBAAmB,KAAK,UAAU,iBAAiB,kBAAkB,KAAK,KAAK,UAAU,gBAAgB;AAAA,QACzG,eAAe,KAAK,UAAU,0BAA0B,cAAc,KAAK,KAAK,UAAU,yBAAyB;AAAA,QACnH,eAAe,KAAK,UAAU,2BAA2B,cAAc,KAAK,KAAK,UAAU,0BAA0B;AAAA,QACrH,cAAc,KAAK,UAAU,wBAAwB,aAAa,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC7G,SAAS,KAAK,UAAU,qBAAqB,QAAQ,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC7F,yBAAyB,MAAM;AAC9B,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QAClC;AAAA,MAAA;AAAA,MAED,UAAU;AAAA,QACT,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,uBAAuB,mBAAmB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QACvH,SAAS,KAAK,UAAU,wBAAwB,QAAQ,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAEnG,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,iBAAiB,KAAK,UAAU,8BAA8B,gBAAgB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC/H,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,kBAAkB,KAAK,UAAU,+BAA+B,iBAAiB,KAAK,KAAK,UAAU,8BAA8B;AAAA,QACnI,4BAA4B,KAAK,UAAU,8BAA8B,2BAA2B;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,0BAA0B,KAAK,UAAU,kCAAkC,yBAAyB;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,aAAa,KAAK,UAAU,kCAAkC,YAAY,KAAK,KAAK,UAAU,iCAAiC;AAAA,QAC/H,oBAAoB,KAAK,UAAU,8BAA8B,mBAAmB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAErI,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,WAAW,KAAK,UAAU,oBAAoB,UAAU,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC/F,QAAQ,KAAK,UAAU,4BAA4B,OAAO,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACzG,YAAY,KAAK,UAAU,2BAA2B,WAAW,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC/G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,8BAA8B,KAAK,UAAU,6CAA6C,6BAA6B;AAAA,UACtH,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,wBAAwB,KAAK,UAAU,6BAA6B,uBAAuB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC3I,yBAAyB,KAAK,UAAU,6BAA6B,wBAAwB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7I,uBAAuB,KAAK,UAAU,mCAAmC,sBAAsB;AAAA,UAC9F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,sBAAsB,KAAK,UAAU,mCAAmC,qBAAqB;AAAA,UAC5F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,iBAAiB,KAAK,UAAU,uBAAuB,gBAAgB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAEjH,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QACvI,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,uBAAuB,KAAK,UAAU,sCAAsC,sBAAsB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,yBAAyB,aAAa,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAC/G,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QACrH,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAErH,iBAAiB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAEnI,wBAAwB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACpI,2BAA2B,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAE1I,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QAEvI,wBAAwB,KAAK,UAAU,oCAAoC,uBAAuB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,2BAA2B,KAAK,UAAU,oCAAoC,0BAA0B;AAAA,UACvG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,WAAW,KAAK,UAAU,8BAA8B,UAAU,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAEnH,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,MAAA;AAAA,IAC5H;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ResolverFactory.js","sources":["../../../../../packages/engine-tenant-api/src/resolvers/ResolverFactory.ts"],"sourcesContent":["import {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tEmailOtpMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tOtpMutationResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './mutation/index.js'\n\nimport { Resolvers } from '../schema/index.js'\nimport {\n\tApiKeyQueryResolver,\n\tAuthLogQueryResolver,\n\tMeQueryResolver,\n\tPersonQueryResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n} from './query/index.js'\nimport { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js'\nimport { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js'\nimport { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'\nimport { IDPQueryResolver } from './query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'\nimport { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'\nimport { EnablePersonMutationResolver } from './mutation/person/EnablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'\nimport { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'\nimport { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'\nimport { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'\nimport { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js'\n\nclass ResolverFactory {\n\tpublic constructor(\n\t\tprivate readonly resolvers: {\n\t\t\tmeQueryResolver: MeQueryResolver\n\t\t\tpersonQueryResolver: PersonQueryResolver\n\t\t\tprojectQueryResolver: ProjectQueryResolver\n\t\t\tprojectMembersQueryResolver: ProjectMembersQueryResolver\n\t\t\tidpQueryResolver: IDPQueryResolver\n\t\t\tmailTemplateQueryResolver: MailTemplateQueryResolver\n\n\t\t\tsignUpMutationResolver: SignUpMutationResolver\n\t\t\tsignInMutationResolver: SignInMutationResolver\n\t\t\tsignOutMutationResolver: SignOutMutationResolver\n\t\t\tchangeProfileMutationResolver: ChangeProfileMutationResolver\n\t\t\tchangePasswordMutationResolver: ChangePasswordMutationResolver\n\t\t\tresetPasswordMutationResolver: ResetPasswordMutationResolver\n\t\t\temailVerificationMutationResolver: EmailVerificationMutationResolver\n\t\t\tidpMutationResolver: IDPMutationResolver\n\t\t\tregisterIdpMutationResolver: AddIDPMutationResolver\n\t\t\tdisableIdpMutationResolver: DisableIDPMutationResolver\n\t\t\tenableIdpMutationResolver: EnableIDPMutationResolver\n\t\t\tupdateIdpMutationResolver: UpdateIDPMutationResolver\n\t\t\tdisconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver\n\t\t\tpasswordlessMutationResolver: PasswordlessMutationResolver\n\n\t\t\tdisablePersonMutationResolver: DisablePersonMutationResolver\n\t\t\tenablePersonMutationResolver: EnablePersonMutationResolver\n\t\t\tforceSignOutMutationResolver: ForceSignOutMutationResolver\n\t\t\tresetPersonMfaMutationResolver: ResetPersonMfaMutationResolver\n\t\t\trevokeSessionMutationResolver: RevokeSessionMutationResolver\n\n\t\t\tinviteMutationResolver: InviteMutationResolver\n\t\t\taddProjectMemberMutationResolver: AddProjectMemberMutationResolver\n\t\t\tupdateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver\n\t\t\tremoveProjectMemberMutationResolver: RemoveProjectMemberMutationResolver\n\n\t\t\tcreateApiKeyMutationResolver: CreateApiKeyMutationResolver\n\t\t\tdisableApiKeyMutationResolver: DisableApiKeyMutationResolver\n\n\t\t\totpMutationResolver: OtpMutationResolver\n\t\t\temailOtpMutationResolver: EmailOtpMutationResolver\n\t\t\tregenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver\n\n\t\t\tmailTemplateMutationResolver: MailTemplateMutationResolver\n\n\t\t\tcreateProjectMutationResolver: CreateProjectMutationResolver\n\t\t\tsetProjectSecretMutationResolver: SetProjectSecretMutationResolver\n\t\t\tupdateProjectMutationResolver: UpdateProjectMutationResolver\n\n\t\t\tidentityTypeResolver: IdentityTypeResolver\n\t\t\tpersonTypeResolver: PersonTypeResolver\n\t\t\tprojectTypeResolver: ProjectTypeResolver\n\n\t\t\tidentityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver\n\n\t\t\tconfigurationMutationResolver: ConfigurationMutationResolver\n\t\t\tconfigurationQueryResolver: ConfigurationQueryResolver\n\n\t\t\tauthPolicyMutationResolver: AuthPolicyMutationResolver\n\t\t\tauthPolicyQueryResolver: AuthPolicyQueryResolver\n\n\t\t\tauthLogQueryResolver: AuthLogQueryResolver\n\t\t\tapiKeyQueryResolver: ApiKeyQueryResolver\n\n\t\t\ttogglePasswordlessMutationResolver: TogglePasswordlessMutationResolver\n\t\t},\n\t) {}\n\n\tcreate(): Resolvers & { Mutation: Required<Resolvers['Mutation']> } & { Query: Required<Resolvers['Query']> } {\n\t\treturn {\n\t\t\tJson: JSONType,\n\t\t\tDateTime: DateTimeType,\n\t\t\tInterval: IntervalType,\n\t\t\tIdentity: {\n\t\t\t\tprojects: this.resolvers.identityTypeResolver.projects.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tperson: this.resolvers.identityTypeResolver.person.bind(this.resolvers.identityTypeResolver),\n\t\t\t\troles: this.resolvers.identityTypeResolver.roles.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tpermissions: this.resolvers.identityTypeResolver.permissions.bind(this.resolvers.identityTypeResolver),\n\t\t\t\tsessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver),\n\t\t\t},\n\t\t\tPerson: {\n\t\t\t\tidentityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),\n\t\t\t\tpasswordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),\n\t\t\t\tpasswordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver),\n\t\t\t},\n\t\t\tProject: {\n\t\t\t\tmembers: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),\n\t\t\t\troles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tapiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tsecrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),\n\t\t\t\tpermissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver),\n\t\t\t},\n\t\t\tQuery: {\n\t\t\t\tme: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),\n\t\t\t\tpersonById: this.resolvers.personQueryResolver.personById.bind(this.resolvers.personQueryResolver),\n\t\t\t\tpersons: this.resolvers.personQueryResolver.persons.bind(this.resolvers.personQueryResolver),\n\t\t\t\tglobalApiKeys: this.resolvers.apiKeyQueryResolver.globalApiKeys.bind(this.resolvers.apiKeyQueryResolver),\n\t\t\t\tprojectBySlug: this.resolvers.projectQueryResolver.projectBySlug.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojects: this.resolvers.projectQueryResolver.projects.bind(this.resolvers.projectQueryResolver),\n\t\t\t\tprojectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),\n\t\t\t\tidentityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),\n\t\t\t\tmailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),\n\t\t\t\tconfiguration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),\n\t\t\t\tauthPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),\n\t\t\t\tauthLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),\n\t\t\t\tcheckResetPasswordToken: () => {\n\t\t\t\t\tthrow new Error('not implemented')\n\t\t\t\t},\n\t\t\t},\n\t\t\tMutation: {\n\t\t\t\tsignUp: this.resolvers.signUpMutationResolver.signUp.bind(this.resolvers.signUpMutationResolver),\n\t\t\t\tsignIn: this.resolvers.signInMutationResolver.signIn.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tcreateSessionToken: this.resolvers.signInMutationResolver.createSessionToken.bind(this.resolvers.signInMutationResolver),\n\t\t\t\tsignOut: this.resolvers.signOutMutationResolver.signOut.bind(this.resolvers.signOutMutationResolver),\n\n\t\t\t\tchangeProfile: this.resolvers.changeProfileMutationResolver.changeProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangeMyProfile: this.resolvers.changeProfileMutationResolver.changeMyProfile.bind(this.resolvers.changeProfileMutationResolver),\n\t\t\t\tchangePassword: this.resolvers.changePasswordMutationResolver.changePassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tchangeMyPassword: this.resolvers.changePasswordMutationResolver.changeMyPassword.bind(this.resolvers.changePasswordMutationResolver),\n\t\t\t\tcreateResetPasswordRequest: this.resolvers.resetPasswordMutationResolver.createResetPasswordRequest.bind(\n\t\t\t\t\tthis.resolvers.resetPasswordMutationResolver,\n\t\t\t\t),\n\t\t\t\tresetPassword: this.resolvers.resetPasswordMutationResolver.resetPassword.bind(this.resolvers.resetPasswordMutationResolver),\n\n\t\t\t\trequestEmailVerification: this.resolvers.emailVerificationMutationResolver.requestEmailVerification.bind(\n\t\t\t\t\tthis.resolvers.emailVerificationMutationResolver,\n\t\t\t\t),\n\t\t\t\tverifyEmail: this.resolvers.emailVerificationMutationResolver.verifyEmail.bind(this.resolvers.emailVerificationMutationResolver),\n\t\t\t\tconfirmEmailChange: this.resolvers.changeProfileMutationResolver.confirmEmailChange.bind(this.resolvers.changeProfileMutationResolver),\n\n\t\t\t\tinitSignInIDP: this.resolvers.idpMutationResolver.initSignInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\tsignInIDP: this.resolvers.idpMutationResolver.signInIDP.bind(this.resolvers.idpMutationResolver),\n\t\t\t\taddIDP: this.resolvers.registerIdpMutationResolver.addIDP.bind(this.resolvers.registerIdpMutationResolver),\n\t\t\t\tdisableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),\n\t\t\t\tenableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),\n\t\t\t\tupdateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),\n\t\t\t\tdisconnectMyIdentityProvider: this.resolvers.disconnectMyIdentityProviderMutationResolver.disconnectMyIdentityProvider.bind(\n\t\t\t\t\tthis.resolvers.disconnectMyIdentityProviderMutationResolver,\n\t\t\t\t),\n\t\t\t\tdisablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),\n\t\t\t\tenablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),\n\t\t\t\tforceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),\n\t\t\t\tresetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),\n\t\t\t\trevokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),\n\n\t\t\t\tsignInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tinitSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tactivatePasswordlessOtp: this.resolvers.passwordlessMutationResolver.activatePasswordlessOtp.bind(this.resolvers.passwordlessMutationResolver),\n\t\t\t\tdisableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.disableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\t\t\t\tenableMyPasswordless: this.resolvers.togglePasswordlessMutationResolver.enableMyPasswordless.bind(\n\t\t\t\t\tthis.resolvers.togglePasswordlessMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinvite: this.resolvers.inviteMutationResolver.invite.bind(this.resolvers.inviteMutationResolver),\n\t\t\t\tunmanagedInvite: this.resolvers.inviteMutationResolver.unmanagedInvite.bind(this.resolvers.inviteMutationResolver),\n\n\t\t\t\taddProjectMember: this.resolvers.addProjectMemberMutationResolver.addProjectMember.bind(this.resolvers.addProjectMemberMutationResolver),\n\t\t\t\tupdateProjectMember: this.resolvers.updateProjectMemberMutationResolver.updateProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveProjectMember: this.resolvers.removeProjectMemberMutationResolver.removeProjectMember.bind(\n\t\t\t\t\tthis.resolvers.updateProjectMemberMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tcreateApiKey: this.resolvers.createApiKeyMutationResolver.createApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tcreateGlobalApiKey: this.resolvers.createApiKeyMutationResolver.createGlobalApiKey.bind(this.resolvers.createApiKeyMutationResolver),\n\t\t\t\tdisableApiKey: this.resolvers.disableApiKeyMutationResolver.disableApiKey.bind(this.resolvers.disableApiKeyMutationResolver),\n\n\t\t\t\tprepareOtp: this.resolvers.otpMutationResolver.prepareOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tconfirmOtp: this.resolvers.otpMutationResolver.confirmOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tdisableOtp: this.resolvers.otpMutationResolver.disableOtp.bind(this.resolvers.otpMutationResolver),\n\t\t\t\tregenerateBackupCodes: this.resolvers.regenerateBackupCodesMutationResolver.regenerateBackupCodes.bind(\n\t\t\t\t\tthis.resolvers.regenerateBackupCodesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tinitEmailOtp: this.resolvers.emailOtpMutationResolver.initEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tconfirmEmailOtp: this.resolvers.emailOtpMutationResolver.confirmEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\t\t\t\tdisableEmailOtp: this.resolvers.emailOtpMutationResolver.disableEmailOtp.bind(this.resolvers.emailOtpMutationResolver),\n\n\t\t\t\taddMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\taddProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\t\t\t\tremoveProjectMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),\n\n\t\t\t\tcreateProject: this.resolvers.createProjectMutationResolver.createProject.bind(this.resolvers.createProjectMutationResolver),\n\t\t\t\tupdateProject: this.resolvers.updateProjectMutationResolver.updateProject.bind(this.resolvers.updateProjectMutationResolver),\n\t\t\t\tsetProjectSecret: this.resolvers.setProjectSecretMutationResolver.setProjectSecret.bind(this.resolvers.setProjectSecretMutationResolver),\n\n\t\t\t\taddGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.addGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\t\t\t\tremoveGlobalIdentityRoles: this.resolvers.identityGlobalRolesMutationResolver.removeGlobalIdentityRoles.bind(\n\t\t\t\t\tthis.resolvers.identityGlobalRolesMutationResolver,\n\t\t\t\t),\n\n\t\t\t\tconfigure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),\n\n\t\t\t\tcreateAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tupdateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t\tdeleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),\n\t\t\t},\n\t\t}\n\t}\n}\n\nnamespace ResolverFactory {\n\texport type FieldResolverArgs = {\n\t\t[argument: string]: any\n\t}\n}\n\nexport { ResolverFactory }\n"],"names":[],"mappings":";AAuDA,MAAM,gBAAgB;AAAA,EACd,YACW,WAgEhB;AAhEgB,SAAA,YAAA;AAAA,EAgEf;AAAA,EAEH,SAA8G;AAC7G,WAAO;AAAA,MACN,MAAM;AAAA,MACN,UAAU;AAAA,MACV,UAAU;AAAA,MACV,UAAU;AAAA,QACT,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,QAAQ,KAAK,UAAU,qBAAqB,OAAO,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC3F,OAAO,KAAK,UAAU,qBAAqB,MAAM,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzF,aAAa,KAAK,UAAU,qBAAqB,YAAY,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACrG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,MAAA;AAAA,MAEhG,QAAQ;AAAA,QACP,mBAAmB,KAAK,UAAU,mBAAmB,kBAAkB,KAAK,KAAK,UAAU,kBAAkB;AAAA,QAC7G,uBAAuB,KAAK,UAAU,mBAAmB,sBAAsB,KAAK,KAAK,UAAU,kBAAkB;AAAA,QACrH,yBAAyB,KAAK,UAAU,mBAAmB,wBAAwB,KAAK,KAAK,UAAU,kBAAkB;AAAA,MAAA;AAAA,MAE1H,SAAS;AAAA,QACR,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,OAAO,KAAK,UAAU,oBAAoB,MAAM,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvF,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,aAAa,KAAK,UAAU,oBAAoB,YAAY,KAAK,KAAK,UAAU,mBAAmB;AAAA,MAAA;AAAA,MAEpG,OAAO;AAAA,QACN,IAAI,KAAK,UAAU,gBAAgB,GAAG,KAAK,KAAK,UAAU,eAAe;AAAA,QACzE,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,SAAS,KAAK,UAAU,oBAAoB,QAAQ,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC3F,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,eAAe,KAAK,UAAU,qBAAqB,cAAc,KAAK,KAAK,UAAU,oBAAoB;AAAA,QACzG,UAAU,KAAK,UAAU,qBAAqB,SAAS,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,4BAA4B,mBAAmB,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACjI,mBAAmB,KAAK,UAAU,iBAAiB,kBAAkB,KAAK,KAAK,UAAU,gBAAgB;AAAA,QACzG,eAAe,KAAK,UAAU,0BAA0B,cAAc,KAAK,KAAK,UAAU,yBAAyB;AAAA,QACnH,eAAe,KAAK,UAAU,2BAA2B,cAAc,KAAK,KAAK,UAAU,0BAA0B;AAAA,QACrH,cAAc,KAAK,UAAU,wBAAwB,aAAa,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAC7G,SAAS,KAAK,UAAU,qBAAqB,QAAQ,KAAK,KAAK,UAAU,oBAAoB;AAAA,QAC7F,yBAAyB,MAAM;AAC9B,gBAAM,IAAI,MAAM,iBAAiB;AAAA,QAClC;AAAA,MAAA;AAAA,MAED,UAAU;AAAA,QACT,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,oBAAoB,KAAK,UAAU,uBAAuB,mBAAmB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QACvH,SAAS,KAAK,UAAU,wBAAwB,QAAQ,KAAK,KAAK,UAAU,uBAAuB;AAAA,QAEnG,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,iBAAiB,KAAK,UAAU,8BAA8B,gBAAgB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC/H,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,kBAAkB,KAAK,UAAU,+BAA+B,iBAAiB,KAAK,KAAK,UAAU,8BAA8B;AAAA,QACnI,4BAA4B,KAAK,UAAU,8BAA8B,2BAA2B;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,0BAA0B,KAAK,UAAU,kCAAkC,yBAAyB;AAAA,UACnG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,aAAa,KAAK,UAAU,kCAAkC,YAAY,KAAK,KAAK,UAAU,iCAAiC;AAAA,QAC/H,oBAAoB,KAAK,UAAU,8BAA8B,mBAAmB,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAErI,eAAe,KAAK,UAAU,oBAAoB,cAAc,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACvG,WAAW,KAAK,UAAU,oBAAoB,UAAU,KAAK,KAAK,UAAU,mBAAmB;AAAA,QAC/F,QAAQ,KAAK,UAAU,4BAA4B,OAAO,KAAK,KAAK,UAAU,2BAA2B;AAAA,QACzG,YAAY,KAAK,UAAU,2BAA2B,WAAW,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC/G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,WAAW,KAAK,UAAU,0BAA0B,UAAU,KAAK,KAAK,UAAU,yBAAyB;AAAA,QAC3G,8BAA8B,KAAK,UAAU,6CAA6C,6BAA6B;AAAA,UACtH,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,gBAAgB,KAAK,UAAU,+BAA+B,eAAe,KAAK,KAAK,UAAU,8BAA8B;AAAA,QAC/H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,wBAAwB,KAAK,UAAU,6BAA6B,uBAAuB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC3I,yBAAyB,KAAK,UAAU,6BAA6B,wBAAwB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7I,uBAAuB,KAAK,UAAU,mCAAmC,sBAAsB;AAAA,UAC9F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,sBAAsB,KAAK,UAAU,mCAAmC,qBAAqB;AAAA,UAC5F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,QAAQ,KAAK,UAAU,uBAAuB,OAAO,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAC/F,iBAAiB,KAAK,UAAU,uBAAuB,gBAAgB,KAAK,KAAK,UAAU,sBAAsB;AAAA,QAEjH,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QACvI,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,qBAAqB,KAAK,UAAU,oCAAoC,oBAAoB;AAAA,UAC3F,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,6BAA6B,aAAa,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACvH,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACnI,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAE3H,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,YAAY,KAAK,UAAU,oBAAoB,WAAW,KAAK,KAAK,UAAU,mBAAmB;AAAA,QACjG,uBAAuB,KAAK,UAAU,sCAAsC,sBAAsB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,cAAc,KAAK,UAAU,yBAAyB,aAAa,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAC/G,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QACrH,iBAAiB,KAAK,UAAU,yBAAyB,gBAAgB,KAAK,KAAK,UAAU,wBAAwB;AAAA,QAErH,iBAAiB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAC7H,oBAAoB,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAEnI,wBAAwB,KAAK,UAAU,6BAA6B,gBAAgB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QACpI,2BAA2B,KAAK,UAAU,6BAA6B,mBAAmB,KAAK,KAAK,UAAU,4BAA4B;AAAA,QAE1I,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,eAAe,KAAK,UAAU,8BAA8B,cAAc,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,iCAAiC,iBAAiB,KAAK,KAAK,UAAU,gCAAgC;AAAA,QAEvI,wBAAwB,KAAK,UAAU,oCAAoC,uBAAuB;AAAA,UACjG,KAAK,UAAU;AAAA,QAAA;AAAA,QAEhB,2BAA2B,KAAK,UAAU,oCAAoC,0BAA0B;AAAA,UACvG,KAAK,UAAU;AAAA,QAAA;AAAA,QAGhB,WAAW,KAAK,UAAU,8BAA8B,UAAU,KAAK,KAAK,UAAU,6BAA6B;AAAA,QAEnH,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,QAC3H,kBAAkB,KAAK,UAAU,2BAA2B,iBAAiB,KAAK,KAAK,UAAU,0BAA0B;AAAA,MAAA;AAAA,IAC5H;AAAA,EAEF;AACD;"}

package/dist/development/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const membershipUtils = require("../../membershipUtils.cjs");
 const errorUtils = require("../../errorUtils.cjs");

package/dist/development/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"sourcesContent":["import {\n\tCreateApiKeyErrorCode,\n\tCreateApiKeyResponse,\n\tMutationCreateApiKeyArgs,\n\tMutationCreateGlobalApiKeyArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class CreateApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync createApiKey(\n\t\tparent: any,\n\t\t{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.API_KEY_CREATE,\n\t\t\tmessage: 'You are not allowed to create an API key for this project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.apiKeyManager.createProjectPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tproject.id,\n\t\t\tmemberships,\n\t\t\tdescription,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'project',\n\t\t\t\tprojectSlug: project.slug,\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\tmemberships: memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n\n\tasync createGlobalApiKey(\n\t\tparent: any,\n\t\t{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\troles ??= []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_CREATE_GLOBAL(roles),\n\t\t\tmessage: 'You are not allowed to create a global API key',\n\t\t})\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst result = await this.apiKeyManager.createGlobalPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tdescription,\n\t\t\troles,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'global',\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\troles: [...roles],\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aACL,QACA,EAAE,aAAa,aAAa,aAAa,WAAW,QAAA,GACpD,SACA,MACgC;AAChC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,cAAc,YAAY,CAACC,MAAAA,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAIC,aAAAA,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,aAAa,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IAC9C,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,OAAO,aAAa,WAAW,QAAA,GACjC,SACA,MACgC;AAChC,cAAA,QAAU;AACV,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB,sBAAsB,KAAK;AAAA,MACrD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,OAAO,cAAc,YAAY,CAACE,MAAAA,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAIC,aAAAA,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAAA;AAAA,IACjB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}
+{"version":3,"file":"CreateApiKeyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"sourcesContent":["import {\n\tCreateApiKeyErrorCode,\n\tCreateApiKeyResponse,\n\tMutationCreateApiKeyArgs,\n\tMutationCreateGlobalApiKeyArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class CreateApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync createApiKey(\n\t\tparent: any,\n\t\t{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.API_KEY_CREATE,\n\t\t\tmessage: 'You are not allowed to create an API key for this project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.apiKeyManager.createProjectPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tproject.id,\n\t\t\tmemberships,\n\t\t\tdescription,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'project',\n\t\t\t\tprojectSlug: project.slug,\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\tmemberships: memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n\n\tasync createGlobalApiKey(\n\t\tparent: any,\n\t\t{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\troles ??= []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_CREATE_GLOBAL(roles),\n\t\t\tmessage: 'You are not allowed to create a global API key',\n\t\t})\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst result = await this.apiKeyManager.createGlobalPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tdescription,\n\t\t\troles,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'global',\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\troles: [...roles],\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aACL,QACA,EAAE,aAAa,aAAa,aAAa,WAAW,QAAA,GACpD,SACA,MACgC;AAChC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,cAAc,YAAY,CAACC,MAAAA,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAIC,aAAAA,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,aAAa,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IAC9C,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,OAAO,aAAa,WAAW,QAAA,GACjC,SACA,MACgC;AAChC,cAAA,QAAU;AACV,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB,sBAAsB,KAAK;AAAA,MACrD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,OAAO,cAAc,YAAY,CAACE,MAAAA,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAIC,aAAAA,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAAA;AAAA,IACjB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}

package/dist/development/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
 import { createProjectNotFoundResponse } from "../../errorUtils.js";

package/dist/development/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"sourcesContent":["import {\n\tCreateApiKeyErrorCode,\n\tCreateApiKeyResponse,\n\tMutationCreateApiKeyArgs,\n\tMutationCreateGlobalApiKeyArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class CreateApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync createApiKey(\n\t\tparent: any,\n\t\t{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.API_KEY_CREATE,\n\t\t\tmessage: 'You are not allowed to create an API key for this project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.apiKeyManager.createProjectPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tproject.id,\n\t\t\tmemberships,\n\t\t\tdescription,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'project',\n\t\t\t\tprojectSlug: project.slug,\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\tmemberships: memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n\n\tasync createGlobalApiKey(\n\t\tparent: any,\n\t\t{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\troles ??= []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_CREATE_GLOBAL(roles),\n\t\t\tmessage: 'You are not allowed to create a global API key',\n\t\t})\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst result = await this.apiKeyManager.createGlobalPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tdescription,\n\t\t\troles,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'global',\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\troles: [...roles],\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aACL,QACA,EAAE,aAAa,aAAa,aAAa,WAAW,QAAA,GACpD,SACA,MACgC;AAChC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,cAAc,YAAY,CAAC,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAI,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,aAAa,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IAC9C,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,OAAO,aAAa,WAAW,QAAA,GACjC,SACA,MACgC;AAChC,cAAA,QAAU;AACV,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,sBAAsB,KAAK;AAAA,MACrD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,OAAO,cAAc,YAAY,CAAC,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAI,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAAA;AAAA,IACjB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}
+{"version":3,"file":"CreateApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts"],"sourcesContent":["import {\n\tCreateApiKeyErrorCode,\n\tCreateApiKeyResponse,\n\tMutationCreateApiKeyArgs,\n\tMutationCreateGlobalApiKeyArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class CreateApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync createApiKey(\n\t\tparent: any,\n\t\t{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.API_KEY_CREATE,\n\t\t\tmessage: 'You are not allowed to create an API key for this project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.apiKeyManager.createProjectPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tproject.id,\n\t\t\tmemberships,\n\t\t\tdescription,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'project',\n\t\t\t\tprojectSlug: project.slug,\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\tmemberships: memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n\n\tasync createGlobalApiKey(\n\t\tparent: any,\n\t\t{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreateApiKeyResponse> {\n\t\troles ??= []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_CREATE_GLOBAL(roles),\n\t\t\tmessage: 'You are not allowed to create a global API key',\n\t\t})\n\t\tif (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\tconst result = await this.apiKeyManager.createGlobalPermanentApiKey(\n\t\t\tcontext.db,\n\t\t\tdescription,\n\t\t\troles,\n\t\t\ttokenHash ?? undefined,\n\t\t\toptions?.trustForwardedClientInfo === true,\n\t\t)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tscope: 'global',\n\t\t\t\tapiKeyId: result.result.apiKey.id,\n\t\t\t\tidentityId: result.result.identity.id,\n\t\t\t\tdescription,\n\t\t\t\troles: [...roles],\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tapiKey: result.result.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,6BAA0D;AAAA,EACtE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aACL,QACA,EAAE,aAAa,aAAa,aAAa,WAAW,QAAA,GACpD,SACA,MACgC;AAChC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,cAAc,YAAY,CAAC,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAI,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,aAAa,QAAQ;AAAA,QACrB,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,aAAa,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IAC9C,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,OAAO,aAAa,WAAW,QAAA,GACjC,SACA,MACgC;AAChC,cAAA,QAAU;AACV,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,sBAAsB,KAAK;AAAA,MACrD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,OAAO,cAAc,YAAY,CAAC,YAAY,SAAS,GAAG;AAC7D,YAAM,IAAI,eAAe,0DAA0D;AAAA,IACpF;AACA,UAAM,SAAS,MAAM,KAAK,cAAc;AAAA,MACvC,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,SAAS,6BAA6B;AAAA,IAAA;AAGvC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO;AAAA,QACP,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,YAAY,OAAO,OAAO,SAAS;AAAA,QACnC;AAAA,QACA,OAAO,CAAC,GAAG,KAAK;AAAA,MAAA;AAAA,IACjB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,OAAO,OAAO,kBAAA;AAAA,MAAkB;AAAA,IACzC;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisableApiKeyMutationResolver {

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"DisableApiKeyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisableApiKeyMutationResolver {

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"DisableApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}
+{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}
+{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}
+{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}
+{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs

@@ -14,6 +14,8 @@ const PersonByIdentityBatchQuery = require("../../../model/queries/person/Person
 const IdentityQuery = require("../../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class IdentityGlobalRolesMutationResolver {

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}
+{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js

@@ -12,6 +12,8 @@ import { PersonByIdentityBatchQuery } from "../../../model/queries/person/Person
 import { IdentityQuery } from "../../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class IdentityGlobalRolesMutationResolver {

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}
+{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}