@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/resolvers/mutation/person/ForceSignOutMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ForceSignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ForceSignOutMutationResolver.ts"],"sourcesContent":["import { ForceSignOutPersonResponse, MutationForceSignOutPersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\nimport { UserMailer } from '../../../model/mailing/index.js'\n\nexport class ForceSignOutMutationResolver implements Pick<MutationResolvers, 'forceSignOutPerson'> {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync forceSignOutPerson(\n\t\tparent: unknown,\n\t\targs: MutationForceSignOutPersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ForceSignOutPersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\t\tconst reason = args.reason ?? null\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_FORCE_SIGN_OUT(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to force sign out this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'forced_sign_out',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: {\n\t\t\t\t\trequestedPersonId: args.personId,\n\t\t\t\t\t...(reason !== null ? { reason } : {}),\n\t\t\t\t},\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, targetPerson.identity_id)\n\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'forced_sign_out',\n\t\t\tresponse,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t\tmetadata: reason !== null ? { reason } : undefined,\n\t\t})\n\n\t\tif (targetPerson.email) {\n\t\t\tawait this.userMailer.sendForcedSignOutEmail(\n\t\t\t\tcontext.db,\n\t\t\t\t{ email: targetPerson.email, reason },\n\t\t\t\t{ projectId: null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","response","ResponseError","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,6BAAsF;AAAA,EAClG,YACkB,eACA,eACA,YAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACsC;AACtC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AACtF,UAAM,SAAS,KAAK,UAAU;AAE9B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,sBAAsB,cAAc,SAAS,CAAA,CAAE;AAAA,MACzE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAMC,YAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU;AAAA,UACT,mBAAmB,KAAK;AAAA,UACxB,GAAI,WAAW,OAAO,EAAE,WAAW,CAAA;AAAA,QAAC;AAAA,MACrC,CACA;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,aAAa,WAAW;AAEpF,UAAM,WAAW,IAAIG,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,aAAa;AAAA,MAC7B,UAAU,WAAW,OAAO,EAAE,WAAW;AAAA,IAAA,CACzC;AAED,QAAI,aAAa,OAAO;AACvB,YAAM,KAAK,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,EAAE,OAAO,aAAa,OAAO,OAAA;AAAA,QAC7B,EAAE,WAAW,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEjC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"ForceSignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ForceSignOutMutationResolver.ts"],"sourcesContent":["import { ForceSignOutPersonResponse, MutationForceSignOutPersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\nimport { UserMailer } from '../../../model/mailing/index.js'\n\nexport class ForceSignOutMutationResolver implements Pick<MutationResolvers, 'forceSignOutPerson'> {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync forceSignOutPerson(\n\t\tparent: unknown,\n\t\targs: MutationForceSignOutPersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ForceSignOutPersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\t\tconst reason = args.reason ?? null\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_FORCE_SIGN_OUT(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to force sign out this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'forced_sign_out',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: {\n\t\t\t\t\trequestedPersonId: args.personId,\n\t\t\t\t\t...(reason !== null ? { reason } : {}),\n\t\t\t\t},\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, targetPerson.identity_id)\n\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'forced_sign_out',\n\t\t\tresponse,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t\tmetadata: reason !== null ? { reason } : undefined,\n\t\t})\n\n\t\tif (targetPerson.email) {\n\t\t\tawait this.userMailer.sendForcedSignOutEmail(\n\t\t\t\tcontext.db,\n\t\t\t\t{ email: targetPerson.email, reason },\n\t\t\t\t{ projectId: null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","response","ResponseError","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,6BAAsF;AAAA,EAClG,YACkB,eACA,eACA,YAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACsC;AACtC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AACtF,UAAM,SAAS,KAAK,UAAU;AAE9B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,sBAAsB,cAAc,SAAS,CAAA,CAAE;AAAA,MACzE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAMC,YAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU;AAAA,UACT,mBAAmB,KAAK;AAAA,UACxB,GAAI,WAAW,OAAO,EAAE,WAAW,CAAA;AAAA,QAAC;AAAA,MACrC,CACA;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,aAAa,WAAW;AAEpF,UAAM,WAAW,IAAIG,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,aAAa;AAAA,MAC7B,UAAU,WAAW,OAAO,EAAE,WAAW;AAAA,IAAA,CACzC;AAED,QAAI,aAAa,OAAO;AACvB,YAAM,KAAK,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,EAAE,OAAO,aAAa,OAAO,OAAA;AAAA,QAC7B,EAAE,WAAW,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEjC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ForceSignOutMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseError, ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ForceSignOutMutationResolver {

package/dist/development/src/resolvers/mutation/person/ForceSignOutMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ForceSignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ForceSignOutMutationResolver.ts"],"sourcesContent":["import { ForceSignOutPersonResponse, MutationForceSignOutPersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\nimport { UserMailer } from '../../../model/mailing/index.js'\n\nexport class ForceSignOutMutationResolver implements Pick<MutationResolvers, 'forceSignOutPerson'> {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync forceSignOutPerson(\n\t\tparent: unknown,\n\t\targs: MutationForceSignOutPersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ForceSignOutPersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\t\tconst reason = args.reason ?? null\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_FORCE_SIGN_OUT(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to force sign out this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'forced_sign_out',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: {\n\t\t\t\t\trequestedPersonId: args.personId,\n\t\t\t\t\t...(reason !== null ? { reason } : {}),\n\t\t\t\t},\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, targetPerson.identity_id)\n\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'forced_sign_out',\n\t\t\tresponse,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t\tmetadata: reason !== null ? { reason } : undefined,\n\t\t})\n\n\t\tif (targetPerson.email) {\n\t\t\tawait this.userMailer.sendForcedSignOutEmail(\n\t\t\t\tcontext.db,\n\t\t\t\t{ email: targetPerson.email, reason },\n\t\t\t\t{ projectId: null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,6BAAsF;AAAA,EAClG,YACkB,eACA,eACA,YAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACsC;AACtC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AACtF,UAAM,SAAS,KAAK,UAAU;AAE9B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,sBAAsB,cAAc,SAAS,CAAA,CAAE;AAAA,MACzE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAMA,YAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU;AAAA,UACT,mBAAmB,KAAK;AAAA,UACxB,GAAI,WAAW,OAAO,EAAE,WAAW,CAAA;AAAA,QAAC;AAAA,MACrC,CACA;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,aAAa,WAAW;AAEpF,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,aAAa;AAAA,MAC7B,UAAU,WAAW,OAAO,EAAE,WAAW;AAAA,IAAA,CACzC;AAED,QAAI,aAAa,OAAO;AACvB,YAAM,KAAK,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,EAAE,OAAO,aAAa,OAAO,OAAA;AAAA,QAC7B,EAAE,WAAW,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEjC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"ForceSignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ForceSignOutMutationResolver.ts"],"sourcesContent":["import { ForceSignOutPersonResponse, MutationForceSignOutPersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\nimport { UserMailer } from '../../../model/mailing/index.js'\n\nexport class ForceSignOutMutationResolver implements Pick<MutationResolvers, 'forceSignOutPerson'> {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync forceSignOutPerson(\n\t\tparent: unknown,\n\t\targs: MutationForceSignOutPersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ForceSignOutPersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\t\tconst reason = args.reason ?? null\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_FORCE_SIGN_OUT(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to force sign out this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'forced_sign_out',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: {\n\t\t\t\t\trequestedPersonId: args.personId,\n\t\t\t\t\t...(reason !== null ? { reason } : {}),\n\t\t\t\t},\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(context.db, targetPerson.identity_id)\n\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'forced_sign_out',\n\t\t\tresponse,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t\tmetadata: reason !== null ? { reason } : undefined,\n\t\t})\n\n\t\tif (targetPerson.email) {\n\t\t\tawait this.userMailer.sendForcedSignOutEmail(\n\t\t\t\tcontext.db,\n\t\t\t\t{ email: targetPerson.email, reason },\n\t\t\t\t{ projectId: null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,6BAAsF;AAAA,EAClG,YACkB,eACA,eACA,YAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACsC;AACtC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AACtF,UAAM,SAAS,KAAK,UAAU;AAE9B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,sBAAsB,cAAc,SAAS,CAAA,CAAE;AAAA,MACzE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAMA,YAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU;AAAA,UACT,mBAAmB,KAAK;AAAA,UACxB,GAAI,WAAW,OAAO,EAAE,WAAW,CAAA;AAAA,QAAC;AAAA,MACrC,CACA;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,uBAAuB,QAAQ,IAAI,aAAa,WAAW;AAEpF,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,gBAAgB,aAAa;AAAA,MAC7B,UAAU,WAAW,OAAO,EAAE,WAAW;AAAA,IAAA,CACzC;AAED,QAAI,aAAa,OAAO;AACvB,YAAM,KAAK,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,EAAE,OAAO,aAAa,OAAO,OAAA;AAAA,QAC7B,EAAE,WAAW,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEjC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs

@@ -8,9 +8,12 @@ require("@contember/schema");
 require("../../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class IDPMutationResolver {
@@ -64,6 +66,30 @@ class IDPMutationResolver {
       type: "idp_login",
       response: signIn
     });
+    if (signIn.ok && signIn.result.claimMappingAudit) {
+      const audit = signIn.result.claimMappingAudit;
+      await context.logAuthAction({
+        type: "idp_role_mapped",
+        response: new Response.ResponseOk(null),
+        personId: signIn.result.person.id,
+        // the membership change affects the signing-in person — record it as the target too, so it
+        // surfaces in target_person_id audit queries like the other project_membership_* events.
+        targetPersonId: signIn.result.person.id,
+        identityProviderId: signIn.result.identityProviderId,
+        // the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it
+        // whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).
+        eventData: audit
+      });
+    }
+    if (signIn.ok && signIn.result.claimMappingFailed) {
+      await context.logAuthAction({
+        type: "idp_role_mapping_failed",
+        response: new Response.ResponseOk(null),
+        personId: signIn.result.person.id,
+        targetPersonId: signIn.result.person.id,
+        identityProviderId: signIn.result.identityProviderId
+      });
+    }
     if (!signIn.ok) {
       return errorUtils.createErrorResponse(signIn.error, signIn.errorMessage);
     }

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IDPSignInManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,MAAA;AAAA,IACnB;AAED,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MAAA;AAAA,MAEnB,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"IDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IDPSignInManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\t// A09 — audit claim-mapping membership sync separately from the login itself, with a plain\n\t\t// `{ before, after }` diff. Emitted only when the mapping actually changed grants on this\n\t\t// sign-in (the manager returns null otherwise).\n\t\tif (signIn.ok && signIn.result.claimMappingAudit) {\n\t\t\tconst audit = signIn.result.claimMappingAudit\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_role_mapped',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t\t// the membership change affects the signing-in person — record it as the target too, so it\n\t\t\t\t// surfaces in target_person_id audit queries like the other project_membership_* events.\n\t\t\t\ttargetPersonId: signIn.result.person.id,\n\t\t\t\tidentityProviderId: signIn.result.identityProviderId,\n\t\t\t\t// the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it\n\t\t\t\t// whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).\n\t\t\t\teventData: audit,\n\t\t\t})\n\t\t}\n\t\t// A09 fail-open marker: the mapping was configured but its evaluation/apply failed and was\n\t\t// skipped so sign-in could proceed. Audited (no claim values in the payload) so a broken\n\t\t// mapping is visible to the operator instead of silently never applying.\n\t\tif (signIn.ok && signIn.result.claimMappingFailed) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_role_mapping_failed',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t\ttargetPersonId: signIn.result.person.id,\n\t\t\t\tidentityProviderId: signIn.result.identityProviderId,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,MAAA;AAAA,IACnB;AAED,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQD,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MAAA;AAAA,MAEnB,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AAID,QAAI,OAAO,MAAM,OAAO,OAAO,mBAAmB;AACjD,YAAM,QAAQ,OAAO,OAAO;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO,OAAO,OAAO;AAAA;AAAA;AAAA,QAG/B,gBAAgB,OAAO,OAAO,OAAO;AAAA,QACrC,oBAAoB,OAAO,OAAO;AAAA;AAAA;AAAA,QAGlC,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AAIA,QAAI,OAAO,MAAM,OAAO,OAAO,oBAAoB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,gBAAgB,OAAO,OAAO,OAAO;AAAA,QACrC,oBAAoB,OAAO,OAAO;AAAA,MAAA,CAClC;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOD,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;;"}

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js

@@ -6,9 +6,12 @@ import "@contember/schema";
 import "../../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class IDPMutationResolver {
@@ -62,6 +64,30 @@ class IDPMutationResolver {
       type: "idp_login",
       response: signIn
     });
+    if (signIn.ok && signIn.result.claimMappingAudit) {
+      const audit = signIn.result.claimMappingAudit;
+      await context.logAuthAction({
+        type: "idp_role_mapped",
+        response: new ResponseOk(null),
+        personId: signIn.result.person.id,
+        // the membership change affects the signing-in person — record it as the target too, so it
+        // surfaces in target_person_id audit queries like the other project_membership_* events.
+        targetPersonId: signIn.result.person.id,
+        identityProviderId: signIn.result.identityProviderId,
+        // the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it
+        // whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).
+        eventData: audit
+      });
+    }
+    if (signIn.ok && signIn.result.claimMappingFailed) {
+      await context.logAuthAction({
+        type: "idp_role_mapping_failed",
+        response: new ResponseOk(null),
+        personId: signIn.result.person.id,
+        targetPersonId: signIn.result.person.id,
+        identityProviderId: signIn.result.identityProviderId
+      });
+    }
     if (!signIn.ok) {
       return createErrorResponse(signIn.error, signIn.errorMessage);
     }

package/dist/development/src/resolvers/mutation/person/IDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IDPSignInManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,MAAA;AAAA,IACnB;AAED,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MAAA;AAAA,MAEnB,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;"}
+{"version":3,"file":"IDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/IDPMutationResolver.ts"],"sourcesContent":["import {\n\tInitSignInIdpResponse,\n\tMutationInitSignInIdpArgs,\n\tMutationResolvers,\n\tMutationSignInIdpArgs,\n\tSignInIdpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IDPSignInManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IDPMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly idpSignInManager: IDPSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t) {}\n\n\tasync initSignInIDP(\n\t\tparent: any,\n\t\targs: MutationInitSignInIdpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_IDP_URL,\n\t\t\tmessage: 'You are not allowed to create a redirect URL for IDP',\n\t\t})\n\t\tconst result = await this.idpSignInManager.initSignInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, errors: [], result: result.result }\n\t}\n\n\tasync signInIDP(parent: any, args: MutationSignInIdpArgs, context: TenantResolverContext): Promise<SignInIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN_IDP,\n\t\t\tmessage: 'You are not allowed to person IDP sign in',\n\t\t})\n\t\tconst signIn = await this.idpSignInManager.signInIDP(\n\t\t\tcontext.db,\n\t\t\targs.identityProvider,\n\t\t\targs.data ?? {\n\t\t\t\tsessionData: args.sessionData,\n\t\t\t\turl: args.idpResponse?.url,\n\t\t\t\tredirectUrl: args.redirectUrl,\n\t\t\t},\n\t\t\targs.expiration ?? undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\t// A09 — audit claim-mapping membership sync separately from the login itself, with a plain\n\t\t// `{ before, after }` diff. Emitted only when the mapping actually changed grants on this\n\t\t// sign-in (the manager returns null otherwise).\n\t\tif (signIn.ok && signIn.result.claimMappingAudit) {\n\t\t\tconst audit = signIn.result.claimMappingAudit\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_role_mapped',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t\t// the membership change affects the signing-in person — record it as the target too, so it\n\t\t\t\t// surfaces in target_person_id audit queries like the other project_membership_* events.\n\t\t\t\ttargetPersonId: signIn.result.person.id,\n\t\t\t\tidentityProviderId: signIn.result.identityProviderId,\n\t\t\t\t// the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it\n\t\t\t\t// whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).\n\t\t\t\teventData: audit,\n\t\t\t})\n\t\t}\n\t\t// A09 fail-open marker: the mapping was configured but its evaluation/apply failed and was\n\t\t// skipped so sign-in could proceed. Audited (no claim values in the payload) so a broken\n\t\t// mapping is visible to the operator instead of silently never applying.\n\t\tif (signIn.ok && signIn.result.claimMappingFailed) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_role_mapping_failed',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t\ttargetPersonId: signIn.result.person.id,\n\t\t\t\tidentityProviderId: signIn.result.identityProviderId,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\t...await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t\t\tidpResponse: signIn.result.idpResponse,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,kBACA,uBAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,MAAA;AAAA,IACnB;AAED,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,QAAQ,OAAO,OAAA;AAAA,EAC/C;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,iBAAiB;AAAA,MAC1C,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK,QAAQ;AAAA,QACZ,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK,aAAa;AAAA,QACvB,aAAa,KAAK;AAAA,MAAA;AAAA,MAEnB,KAAK,cAAc;AAAA,MACnB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AAID,QAAI,OAAO,MAAM,OAAO,OAAO,mBAAmB;AACjD,YAAM,QAAQ,OAAO,OAAO;AAC5B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO,OAAO,OAAO;AAAA;AAAA;AAAA,QAG/B,gBAAgB,OAAO,OAAO,OAAO;AAAA,QACrC,oBAAoB,OAAO,OAAO;AAAA;AAAA;AAAA,QAGlC,WAAW;AAAA,MAAA,CACX;AAAA,IACF;AAIA,QAAI,OAAO,MAAM,OAAO,OAAO,oBAAoB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,UAAU,OAAO,OAAO,OAAO;AAAA,QAC/B,gBAAgB,OAAO,OAAO,OAAO;AAAA,QACrC,oBAAoB,OAAO,OAAO;AAAA,MAAA,CAClC;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,GAAG,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,QACzE,aAAa,OAAO,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const membershipUtils = require("../../membershipUtils.cjs");
 const errorUtils = require("../../errorUtils.cjs");

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAACC,kBAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAIC,aAAAA,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}
+{"version":3,"file":"InviteMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":["PermissionActions","createProjectNotFoundResponse","isTokenHash","UserInputError","createMembershipValidationErrorResult","createErrorResponse","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQD,kBAAAA,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAACC,kBAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAIC,aAAAA,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;;"}

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";

package/dist/development/src/resolvers/mutation/person/InviteMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAI,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}
+{"version":3,"file":"InviteMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/InviteMutationResolver.ts"],"sourcesContent":["import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { Acl, JSONValue } from '@contember/schema'\n\nexport class InviteMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly inviteManager: InviteManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync invite(\n\t\tparent: any,\n\t\t{ projectSlug, email, name, memberships, options }: MutationInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE(memberships),\n\t\t\tmessage: 'You are not allowed to invite a person',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tname: name ?? undefined,\n\t\t\temailVariant: options?.mailVariant || '',\n\t\t\tmethod: options?.method ?? 'CREATE_PASSWORD',\n\t\t}, { unmanaged: false })\n\t}\n\n\tasync unmanagedInvite(\n\t\tparent: any,\n\t\t{ projectSlug, email, memberships, password, options }: MutationUnmanagedInviteArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InviteResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PERSON_INVITE_UNMANAGED(memberships),\n\t\t\tmessage: 'You are not allowed to unmanaged person invite',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (typeof options?.resetTokenHash === 'string' && !isTokenHash(options?.resetTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of resetTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\t\treturn this.doInvite(context, {\n\t\t\temail,\n\t\t\tproject,\n\t\t\tmemberships,\n\t\t\tnoEmail: true,\n\t\t\tpassword: password ?? options?.password ?? undefined,\n\t\t\tpasswordResetTokenHash: options?.resetTokenHash ?? undefined,\n\t\t}, { unmanaged: true })\n\t}\n\n\tprivate async doInvite(\n\t\tcontext: TenantResolverContext,\n\t\tinvite: InviteData,\n\t\taudit: { unmanaged: boolean },\n\t): Promise<InviteResponse> {\n\t\tconst validationResult = await this.membershipValidator.validate(invite.project.slug, invite.memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\t\tconst response = await this.inviteManager.invite(context.db, invite)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\t\tconst result = response.result\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_invite',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: result.person.id,\n\t\t\tpersonInput: invite.email,\n\t\t\teventData: {\n\t\t\t\tprojectSlug: invite.project.slug,\n\t\t\t\tisNew: result.isNew,\n\t\t\t\tunmanaged: audit.unmanaged,\n\t\t\t\tmemberships: invite.memberships.map(membershipToJson),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t\tisNew: result.isNew,\n\t\t\t},\n\t\t}\n\t}\n}\n\nconst membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({\n\trole,\n\tvariables: variables.map(({ name, values }) => ({ name, values: [...values] })),\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,gBACA,qBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,QACA,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,GACzC,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,cAAc,WAAW;AAAA,MACnD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,MAAM,QAAQ;AAAA,MACd,cAAc,SAAS,eAAe;AAAA,MACtC,QAAQ,SAAS,UAAU;AAAA,IAAA,GACzB,EAAE,WAAW,OAAO;AAAA,EACxB;AAAA,EAEA,MAAM,gBACL,QACA,EAAE,aAAa,OAAO,aAAa,UAAU,QAAA,GAC7C,SAC0B;AAC1B,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,wBAAwB,WAAW;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,OAAO,SAAS,mBAAmB,YAAY,CAAC,YAAY,SAAS,cAAc,GAAG;AACzF,YAAM,IAAI,eAAe,+DAA+D;AAAA,IACzF;AACA,WAAO,KAAK,SAAS,SAAS;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,UAAU,YAAY,SAAS,YAAY;AAAA,MAC3C,wBAAwB,SAAS,kBAAkB;AAAA,IAAA,GACjD,EAAE,WAAW,MAAM;AAAA,EACvB;AAAA,EAEA,MAAc,SACb,SACA,QACA,OAC0B;AAC1B,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,OAAO,QAAQ,MAAM,OAAO,WAAW;AACxG,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AACA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI,MAAM;AAEnE,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AACA,UAAM,SAAS,SAAS;AAExB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,aAAa,OAAO;AAAA,MACpB,WAAW;AAAA,QACV,aAAa,OAAO,QAAQ;AAAA,QAC5B,OAAO,OAAO;AAAA,QACd,WAAW,MAAM;AAAA,QACjB,aAAa,OAAO,YAAY,IAAI,gBAAgB;AAAA,MAAA;AAAA,IACrD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,QAChE,OAAO,OAAO;AAAA,MAAA;AAAA,IACf;AAAA,EAEF;AACD;AAEA,MAAM,mBAAmB,CAAC,EAAE,MAAM,iBAA4C;AAAA,EAC7E;AAAA,EACA,WAAW,UAAU,IAAI,CAAC,EAAE,MAAM,cAAc,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,IAAI;AAC/E;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs

@@ -14,6 +14,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class OtpMutationResolver {

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseError","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAOA,WAAAA;AAAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAOF,WAAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAOA,WAAAA,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"OtpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseError","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAOA,WAAAA;AAAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAIC,uBAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAOD,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIA,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAOF,WAAAA,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAOA,WAAAA,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js

@@ -12,6 +12,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class OtpMutationResolver {

package/dist/development/src/resolvers/mutation/person/OtpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAO,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAO,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"OtpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/OtpMutationResolver.ts"],"sourcesContent":["import {\n\tConfirmOtpResponse,\n\tDisableOtpResponse,\n\tMutationConfirmOtpArgs,\n\tMutationPrepareOtpArgs,\n\tMutationResolvers,\n\tPrepareOtpResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyResolver, BackupCodeManager, OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class OtpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t) {}\n\n\tasync prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tconst otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\totpUri: otp.uri,\n\t\t\t\totpSecret: otp.secret,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync confirmOtp(parent: any, args: MutationConfirmOtpArgs, context: TenantResolverContext): Promise<ConfirmOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_pending_secret) {\n\t\t\treturn createErrorResponse(\n\t\t\t\t'NOT_PREPARED',\n\t\t\t\t`OTP setup was not initialized. Call prepareOtp first.`,\n\t\t\t)\n\t\t}\n\t\tif (!await this.otpManager.verifyPendingOtp(person, args.otpToken)) {\n\t\t\tconst responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: '2fa_enable',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\t\tawait this.otpManager.confirmOtp(context.db, person)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\t// Promoting pending->active enrolls (or rotates) TOTP; (re)issue the backup-code set.\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_generated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync disableOtp(parent: any, args: {}, context: TenantResolverContext): Promise<DisableOtpResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\tif (!person.otp_secret) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')\n\t\t}\n\t\t// Block removal of the last factor when an effective policy mandates MFA.\n\t\t// Rotation (prepareOtp + confirmOtp) stays open — only removal is blocked.\n\t\tconst wouldHaveNoFactor = !person.email_otp_enabled\n\t\tif (wouldHaveNoFactor) {\n\t\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(context.db, person.identity_id, person.roles)\n\t\t\tif (policy.mfaRequired) {\n\t\t\t\treturn createErrorResponse('MFA_REQUIRED', 'MFA is required for your role; you cannot disable your only factor.')\n\t\t\t}\n\t\t}\n\t\tawait this.otpManager.disableOtp(context.db, person)\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: '2fa_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAcO,MAAM,oBAAiD;AAAA,EAC7D,YACkB,YACA,mBACA,oBAChB;AAHgB,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,qBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,QAAQ,KAAK,SAAS,WAAW;AAC1F,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,MAAA;AAAA,IAChB;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,oBAAoB;AAC/B,aAAO;AAAA,QACN;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AACA,QAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,KAAK,QAAQ,GAAG;AACnE,YAAM,gBAAgB,IAAI,cAAc,qBAAqB,gCAAgC;AAC7F,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AACD,aAAO,oBAAoB,aAAa;AAAA,IACzC;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAM,WAAW,QAAa,MAAU,SAA6D;AACpG,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AACtD,QAAI,CAAC,OAAO,YAAY;AACvB,aAAO,oBAAoB,kBAAkB,2CAA2C;AAAA,IACzF;AAGA,UAAM,oBAAoB,CAAC,OAAO;AAClC,QAAI,mBAAmB;AACtB,YAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,OAAO,aAAa,OAAO,KAAK;AAC5G,UAAI,OAAO,aAAa;AACvB,eAAO,oBAAoB,gBAAgB,qEAAqE;AAAA,MACjH;AAAA,IACD;AACA,UAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,MAAM;AACnD,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,OAAO,EAAE;AAClE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs

@@ -12,6 +12,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class PasswordlessMutationResolver {

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAOA,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"PasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAOA,WAAAA,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOE,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js

@@ -10,6 +10,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class PasswordlessMutationResolver {

package/dist/development/src/resolvers/mutation/person/PasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"PasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/PasswordlessMutationResolver.ts"],"sourcesContent":["import {\n\tActivatePasswordlessOtpResponse,\n\tInitSignInPasswordlessResponse,\n\tMutationActivatePasswordlessOtpArgs,\n\tMutationInitSignInPasswordlessArgs,\n\tMutationResolvers,\n\tMutationSignInPasswordlessArgs,\n\tSignInPasswordlessResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { CaptchaValidator, ConfigurationQuery, PermissionActions, RateLimiter } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager.js'\n\nexport class PasswordlessMutationResolver\n\timplements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>\n{\n\tconstructor(\n\t\tprivate readonly passwordlessSignInManager: PasswordlessSignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync initSignInPasswordless(\n\t\tparent: any,\n\t\targs: MutationInitSignInPasswordlessArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<InitSignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to request passwordless sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'passwordless_init_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many passwordless sign-in requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordlessInit')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.passwordlessSignInManager.initSignInPasswordless({\n\t\t\tdb: context.db,\n\t\t\tpermissionContext: context.permissionContext,\n\t\t\temail: args.email,\n\t\t\tmailVariant: args.options?.mailVariant ?? undefined,\n\t\t\tmailProject: args.options?.mailProject ?? undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_init',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\tif (result.error === 'PERSON_NOT_FOUND' && !configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we don't want to reveal that\n\t\t\t\treturn createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true, result: result.result }\n\t}\n\n\tasync signInPasswordless(parent: any, args: MutationSignInPasswordlessArgs, context: TenantResolverContext): Promise<SignInPasswordlessResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in using passwordless',\n\t\t})\n\t\tconst signIn = await this.passwordlessSignInManager.signInPasswordless({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\tmfaOtp: args.mfaOtp ?? undefined,\n\t\t\tbackupCode: args.backupCode ?? undefined,\n\t\t\tvalidationType: args.validationType,\n\t\t\texpiration: args.expiration ?? undefined,\n\t\t\trequestInfo: context.httpInfo,\n\t\t\ttrustForwardedInfo: args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login',\n\t\t\tresponse: signIn,\n\t\t})\n\t\tif (signIn.ok && signIn.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse: signIn,\n\t\t\t\tpersonId: signIn.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!signIn.ok) {\n\t\t\treturn createErrorResponse(signIn.error, signIn.errorMessage)\n\t\t}\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(signIn.result, context),\n\t\t}\n\t}\n\n\tasync activatePasswordlessOtp(\n\t\tparent: any,\n\t\targs: MutationActivatePasswordlessOtpArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ActivatePasswordlessOtpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to activate passwordless OTP',\n\t\t})\n\t\tconst result = await this.passwordlessSignInManager.activatePasswordlessOtp({\n\t\t\tdb: context.db,\n\t\t\trequestId: args.requestId,\n\t\t\ttoken: args.token,\n\t\t\totpHash: args.otpHash,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'passwordless_login_exchange',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,6BAEb;AAAA,EACC,YACkB,2BACA,uBACA,kBACA,aAChB;AAJgB,SAAA,4BAAA;AACA,SAAA,wBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,QACA,MACA,SAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,4BAA4B,QAAQ,SAAS,IAAI,aAAa;AACpH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,uDAAuD,GAAG,iBAAiB,IAAI;AAAA,IAClI;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,kBAAkB,GAAG;AAC1E,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,KAAK,0BAA0B,uBAAuB;AAAA,MAC1E,IAAI,QAAQ;AAAA,MACZ,mBAAmB,QAAQ;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,aAAa,KAAK,SAAS,eAAe;AAAA,IAAA,CAC1C;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,UAAI,OAAO,UAAU,sBAAsB,CAAC,cAAc,MAAM,kBAAkB;AAEjF,eAAO,oBAAoB,yBAAyB,kDAAkD;AAAA,MACvG;AAEA,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,MAAM,QAAQ,OAAO,OAAA;AAAA,EACnC;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,mBAAmB;AAAA,MACtE,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,UAAU;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,MAC/B,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,QAAQ;AAAA,MACrB,oBAAoB,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA,CAC/E;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,MAAM,OAAO,OAAO,gBAAgB;AAC9C,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO,OAAO,OAAO;AAAA,MAAA,CAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,OAAO,QAAQ,OAAO;AAAA,IAAA;AAAA,EAEhF;AAAA,EAEA,MAAM,wBACL,QACA,MACA,SAC2C;AAC3C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,0BAA0B,wBAAwB;AAAA,MAC3E,IAAI,QAAQ;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IAAA,CACd;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.cjs

@@ -14,6 +14,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class RegenerateBackupCodesMutationResolver {