npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.3 → 2.2.0-alpha.5 - Mend

@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1181) hide show

package/dist/development/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RegenerateBackupCodesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret \|\| !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAOA,WAAAA,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"RegenerateBackupCodesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret \|\| !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":["createErrorResponse","ResponseOk","PermissionActions","PersonQuery","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAOA,WAAAA,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIC,WAAAA,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.js CHANGED Viewed

@@ -12,6 +12,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class RegenerateBackupCodesMutationResolver {

package/dist/development/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RegenerateBackupCodesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret \|\| !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;~~AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAO,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"RegenerateBackupCodesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RegenerateBackupCodesMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, RegenerateBackupCodesResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions, PersonQuery, PersonRow } from '../../../model/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RegenerateBackupCodesMutationResolver implements Pick<MutationResolvers, 'regenerateBackupCodes'> {\n\tconstructor(private readonly backupCodeManager: BackupCodeManager) {}\n\n\tasync regenerateBackupCodes(parent: any, args: {}, context: TenantResolverContext): Promise<RegenerateBackupCodesResponse> {\n\t\tconst person = await this.getPersonFromContext(context)\n\t\t// Backup codes only exist alongside an active TOTP factor.\n\t\tif (!person.otp_secret \|\| !person.otp_activated_at) {\n\t\t\treturn createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot regenerate backup codes.')\n\t\t}\n\t\tconst backupCodes = await this.backupCodeManager.generate(context.db, person.id)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'backup_code_regenerated',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tbackupCodes,\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async getPersonFromContext(context: TenantResolverContext): Promise<PersonRow> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SETUP_OTP,\n\t\t\tmessage: 'You are not allowed to setup a OTP',\n\t\t})\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException('Person should exists')\n\t\t}\n\n\t\treturn person\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,sCAAkG;AAAA,EAC9G,YAA6B,mBAAsC;AAAtC,SAAA,oBAAA;AAAA,EAAuC;AAAA,EAEpE,MAAM,sBAAsB,QAAa,MAAU,SAAwE;AAC1H,UAAM,SAAS,MAAM,KAAK,qBAAqB,OAAO;AAEtD,QAAI,CAAC,OAAO,cAAc,CAAC,OAAO,kBAAkB;AACnD,aAAO,oBAAoB,kBAAkB,wDAAwD;AAAA,IACtG;AACA,UAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,QAAQ,IAAI,OAAO,EAAE;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP;AAAA,MAAA;AAAA,IACD;AAAA,EAEF;AAAA,EAEA,MAAc,qBAAqB,SAAoD;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAwB,sBAAsB;AAAA,IACzD;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs CHANGED Viewed

@@ -14,6 +14,8 @@ const ConfigurationQuery = require("../../../model/queries/configuration/Configu
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ResetPasswordMutationResolver {

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant \|\| undefined,\n\t\t\tproject: args.options?.mailProject \|\| undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","PersonQuery","ResponseError","ResponseOk"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOF,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIG,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOE,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}
1	+ {"version":3,"file":"ResetPasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant \|\| undefined,\n\t\t\tproject: args.options?.mailProject \|\| undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","PersonQuery","ResponseError","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOA,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAIC,SAAAA,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAOF,WAAAA,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIG,SAAAA,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQL,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAOE,WAAAA,oBAAoB,MAAM;AAAA,EAClC;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js CHANGED Viewed

@@ -12,6 +12,8 @@ import { ConfigurationQuery } from "../../../model/queries/configuration/Configu
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ResetPasswordMutationResolver {

package/dist/development/src/resolvers/mutation/person/ResetPasswordMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant \|\| undefined,\n\t\t\tproject: args.options?.mailProject \|\| undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;~~AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}
1	+ {"version":3,"file":"ResetPasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts"],"sourcesContent":["import {\n\tCreatePasswordResetRequestResponse,\n\tMutationCreateResetPasswordRequestArgs,\n\tMutationResetPasswordArgs,\n\tMutationResolvers,\n\tResetPasswordResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tPasswordResetManager,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class ResetPasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordResetManager: PasswordResetManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync createResetPasswordRequest(\n\t\tparent: any,\n\t\targs: MutationCreateResetPasswordRequestArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<CreatePasswordResetRequestResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to initialize reset password request',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'password_reset_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse('RATE_LIMIT_EXCEEDED', `Too many password-reset requests. Retry after ${rl.retryAfterSeconds}s.`)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'passwordReset')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))\n\t\tif (!person) {\n\t\t\tconst responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'password_reset_init',\n\t\t\t\tresponse: responseError,\n\t\t\t\tpersonInput: args.email,\n\t\t\t})\n\n\t\t\tif (!configuration.login.revealUserExists) {\n\t\t\t\t// If the user does not exist, we do not want to leak this information\n\t\t\t\treturn { ok: true, errors: [] }\n\t\t\t}\n\n\t\t\treturn createErrorResponse(responseError)\n\t\t}\n\n\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\tid: person.identity_id,\n\t\t\troles: person.roles,\n\t\t})\n\t\tawait this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {\n\t\t\tmailVariant: args.options?.mailVariant \|\| undefined,\n\t\t\tproject: args.options?.mailProject \|\| undefined,\n\t\t})\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset_init',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonInput: args.email,\n\t\t\tpersonId: person.id,\n\t\t})\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync resetPassword(\n\t\tparent: any,\n\t\targs: MutationResetPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ResetPasswordResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to perform reset password reset',\n\t\t})\n\n\t\tconst result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_reset',\n\t\t\tresponse: result,\n\t\t})\n\t\tif (result.ok) {\n\t\t\treturn { ok: true, errors: [] }\n\t\t}\n\t\treturn createErrorResponse(result)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,8BAA2D;AAAA,EACvE,YACkB,sBACA,0BACA,kBACA,aAChB;AAJgB,SAAA,uBAAA;AACA,SAAA,2BAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,2BACL,QACA,MACA,SACA,MAC8C;AAC9C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,yBAAyB,QAAQ,SAAS,IAAI,aAAa;AACjH,QAAI,CAAC,GAAG,IAAI;AACX,aAAO,oBAAoB,uBAAuB,iDAAiD,GAAG,iBAAiB,IAAI;AAAA,IAC5H;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,eAAe,GAAG;AACvE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,YAAM,gBAAgB,IAAI,cAAc,oBAAoB,qBAAqB,KAAK,KAAK,iBAAiB;AAC5G,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,aAAa,KAAK;AAAA,MAAA,CAClB;AAED,UAAI,CAAC,cAAc,MAAM,kBAAkB;AAE1C,eAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,MAC7B;AAEA,aAAO,oBAAoB,aAAa;AAAA,IACzC;AAEA,UAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,MAChF,IAAI,OAAO;AAAA,MACX,OAAO,OAAO;AAAA,IAAA,CACd;AACD,UAAM,KAAK,qBAAqB,2BAA2B,QAAQ,IAAI,mBAAmB,QAAQ;AAAA,MACjG,aAAa,KAAK,SAAS,eAAe;AAAA,MAC1C,SAAS,KAAK,SAAS,eAAe;AAAA,IAAA,CACtC;AACD,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,aAAa,KAAK;AAAA,MAClB,UAAU,OAAO;AAAA,IAAA,CACjB;AACD,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,cAAc,QAAQ,IAAI,KAAK,OAAO,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,OAAO,IAAI;AACd,aAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,IAC7B;AACA,WAAO,oBAAoB,MAAM;AAAA,EAClC;AACD;"}

package/dist/development/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs CHANGED Viewed

@@ -13,6 +13,8 @@ const ResetPersonMfaCommand = require("../../../model/commands/person/ResetPerso
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ResetPersonMfaMutationResolver {

package/dist/development/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ResetPersonMfaMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/*\n Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ResponseError","createErrorResponse","ResetPersonMfaCommand","ResponseOk"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;~~AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
1	+ {"version":3,"file":"ResetPersonMfaMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/*\n Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","ResponseError","createErrorResponse","ResetPersonMfaCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAIC,SAAAA,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.js CHANGED Viewed

@@ -11,6 +11,8 @@ import { ResetPersonMfaCommand } from "../../../model/commands/person/ResetPerso
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ResetPersonMfaMutationResolver {

package/dist/development/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ResetPersonMfaMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/*\n Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;~~AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,sBAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"ResetPersonMfaMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts"],"sourcesContent":["import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { BackupCodeManager, PermissionActions } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { ResetPersonMfaCommand } from '../../../model/commands/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\n/*\n Admin recovery for a locked-out user: clears the target person's MFA factors\n * (active + pending TOTP, email OTP), deletes their backup codes, and clears the\n * grace anchor, so they can re-enroll. Permission mirrors `forceSignOutPerson`\n * (A21): PROJECT_ADMIN with the role-escalation verifier, plus SUPER_ADMIN.\n * Audits `mfa_reset`.\n */\nexport class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, 'resetPersonMfa'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync resetPersonMfa(parent: unknown, args: MutationResetPersonMfaArgs, context: TenantResolverContext): Promise<ResetPersonMfaResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),\n\t\t\tmessage: 'You are not allowed to reset MFA for this person',\n\t\t})\n\n\t\tif (targetPerson === null) {\n\t\t\tconst response = new ResponseError('PERSON_NOT_FOUND', `Person <${args.personId}> was not found`)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_reset',\n\t\t\t\tresponse,\n\t\t\t\tmetadata: { requestedPersonId: args.personId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.db.commandBus.execute(new ResetPersonMfaCommand(targetPerson.id))\n\t\tawait this.backupCodeManager.deleteForPerson(context.db, targetPerson.id)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mfa_reset',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,+BAAoF;AAAA,EAChG,YACkB,eACA,mBAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,QAAiB,MAAkC,SAAiE;AACxI,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,iBAAiB,cAAc,SAAS,CAAA,CAAE;AAAA,MACpE,SAAS;AAAA,IAAA,CACT;AAED,QAAI,iBAAiB,MAAM;AAC1B,YAAM,WAAW,IAAI,cAAc,oBAAoB,WAAW,KAAK,QAAQ,iBAAiB;AAChG,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,EAAE,mBAAmB,KAAK,SAAA;AAAA,MAAS,CAC7C;AACD,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,GAAG,WAAW,QAAQ,IAAI,sBAAsB,aAAa,EAAE,CAAC;AAC9E,UAAM,KAAK,kBAAkB,gBAAgB,QAAQ,IAAI,aAAa,EAAE;AAExE,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/RevokeSessionMutationResolver.cjs CHANGED Viewed

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class RevokeSessionMutationResolver {

package/dist/development/src/resolvers/mutation/person/RevokeSessionMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RevokeSessionMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey \|\| apiKey.identity_id !== context.identity.id \|\| apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","response","ResponseError","createErrorResponse","PermissionActions","ApiKey","ResponseOk"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMC,YAAW,IAAIC,uBAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAD,WAAU;AACzE,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAASC,cAAO,KAAK,SAAS;AACjG,YAAMJ,YAAW,IAAIC,uBAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAIK,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
1	+ {"version":3,"file":"RevokeSessionMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey \|\| apiKey.identity_id !== context.identity.id \|\| apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","response","ResponseError","createErrorResponse","PermissionActions","ApiKey","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMC,YAAW,IAAIC,uBAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAD,WAAU;AACzE,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQG,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAASC,cAAO,KAAK,SAAS;AACjG,YAAMJ,YAAW,IAAIC,uBAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAD;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAOE,WAAAA,oBAAoBF,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAIK,SAAAA,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/RevokeSessionMutationResolver.js CHANGED Viewed

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class RevokeSessionMutationResolver {

package/dist/development/src/resolvers/mutation/person/RevokeSessionMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RevokeSessionMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey \|\| apiKey.identity_id !== context.identity.id \|\| apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMA,YAAW,IAAI,cAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAA,WAAU;AACzE,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAAS,OAAO,KAAK,SAAS;AACjG,YAAMA,YAAW,IAAI,cAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"RevokeSessionMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/RevokeSessionMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationRevokeSessionArgs, RevokeSessionResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKey, ApiKeyManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class RevokeSessionMutationResolver implements Pick<MutationResolvers, 'revokeSession'> {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync revokeSession(parent: unknown, args: MutationRevokeSessionArgs, context: TenantResolverContext): Promise<RevokeSessionResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\tconst response = new ResponseError('NOT_A_PERSON', 'Only a person can revoke a session')\n\t\t\tawait context.logAuthAction({ type: 'session_revoked_by_user', response })\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_REVOKE_SESSION,\n\t\t\tmessage: 'You are not allowed to revoke a session',\n\t\t})\n\n\t\tconst apiKey = await this.apiKeyManager.findApiKey(context.db, args.sessionId)\n\t\tif (!apiKey \|\| apiKey.identity_id !== context.identity.id \|\| apiKey.type !== ApiKey.Type.SESSION) {\n\t\t\tconst response = new ResponseError('SESSION_NOT_FOUND', 'Session not found')\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'session_revoked_by_user',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: person.id,\n\t\t\t\tmetadata: { sessionId: args.sessionId },\n\t\t\t})\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait this.apiKeyManager.disableApiKey(context.db, apiKey.id)\n\t\tconst response = new ResponseOk(null)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'session_revoked_by_user',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t\tmetadata: { sessionId: apiKey.id },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["response"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAAkF;AAAA,EAC9F,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,QAAiB,MAAiC,SAAgE;AACrI,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,YAAMA,YAAW,IAAI,cAAc,gBAAgB,oCAAoC;AACvF,YAAM,QAAQ,cAAc,EAAE,MAAM,2BAA2B,UAAAA,WAAU;AACzE,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,WAAW,QAAQ,IAAI,KAAK,SAAS;AAC7E,QAAI,CAAC,UAAU,OAAO,gBAAgB,QAAQ,SAAS,MAAM,OAAO,SAAS,OAAO,KAAK,SAAS;AACjG,YAAMA,YAAW,IAAI,cAAc,qBAAqB,mBAAmB;AAC3E,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAAA;AAAAA,QACA,UAAU,OAAO;AAAA,QACjB,UAAU,EAAE,WAAW,KAAK,UAAA;AAAA,MAAU,CACtC;AACD,aAAO,oBAAoBA,UAAS,OAAOA,UAAS,YAAY;AAAA,IACjE;AAEA,UAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,OAAO,EAAE;AAC5D,UAAM,WAAW,IAAI,WAAW,IAAI;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,EAAE,WAAW,OAAO,GAAA;AAAA,IAAG,CACjC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs CHANGED Viewed

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration \|\| undefined,\n\t\t\targs.otpToken \|\| undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode \|\| undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll \|\| collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration \|\| undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","NextLoginAttemptQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAOF,WAAAA;AAAAA,QACN,IAAIC,uBAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAOD,WAAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAOA,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQL,kBAAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;;"}
1	+ {"version":3,"file":"SignInMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration \|\| undefined,\n\t\t\targs.otpToken \|\| undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode \|\| undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll \|\| collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration \|\| undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","NextLoginAttemptQuery","UserInputError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAOF,WAAAA;AAAAA,QACN,IAAIC,uBAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAOD,WAAAA,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAOA,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAIK,aAAAA,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQL,kBAAAA,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOE,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;;"}

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js CHANGED Viewed

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { ConfigurationQuery } from "../../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";

package/dist/development/src/resolvers/mutation/person/SignInMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration \|\| undefined,\n\t\t\targs.otpToken \|\| undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode \|\| undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll \|\| collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration \|\| undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAO,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAI,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;"}
1	+ {"version":3,"file":"SignInMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignInMutationResolver.ts"],"sourcesContent":["import {\n\tCreateSessionTokenResponse,\n\tMutationCreateSessionTokenArgs,\n\tMutationResolvers,\n\tMutationSignInArgs,\n\tSignInResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery.js'\nimport { ResponseError } from '../../../model/utils/Response.js'\n\nexport class SignInMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signInManager: SignInManager,\n\t\tprivate readonly signInResponseFactory: SignInResponseFactory,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\tasync signIn(parent: any, args: MutationSignInArgs, context: TenantResolverContext): Promise<SignInResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_IN,\n\t\t\tmessage: 'You are not allowed to sign in',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst ipGate = await this.rateLimiter.consume(context.db, 'login_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!ipGate.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-in attempts from this IP. Retry after ${ipGate.retryAfterSeconds}s.`, {\n\t\t\t\t\tretryAfter: ipGate.retryAfterSeconds,\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))\n\t\tif (nextAllowedSignIn > new Date()) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {\n\t\t\t\t\tretryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),\n\t\t\t\t}),\n\t\t\t)\n\t\t}\n\n\t\tconst response = await this.signInManager.signIn(\n\t\t\tcontext.db,\n\t\t\targs.email,\n\t\t\targs.password,\n\t\t\targs.expiration \|\| undefined,\n\t\t\targs.otpToken \|\| undefined,\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t\targs.backupCode \|\| undefined,\n\t\t\tconfiguration,\n\t\t\tcontext.httpInfo.geoCountry,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'login',\n\t\t\tresponse,\n\t\t})\n\t\tif (response.ok && response.result.usedBackupCode) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'backup_code_used',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.emailOtpSent) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_otp_sent',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.mfaEnrollmentRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'mfa_enrollment_required',\n\t\t\t\tresponse,\n\t\t\t})\n\t\t}\n\t\t// A03 anomaly audit. The risk scoring runs in SignInManager; the audit\n\t\t// entries are emitted here at the resolver layer (per convention), with the\n\t\t// score + reasons snapshot in event_data.\n\t\tif (response.ok && response.result.unusualLoginDetected) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\tpersonId: response.result.person.id,\n\t\t\t\teventData: response.result.risk ? { ...response.result.risk } : undefined,\n\t\t\t})\n\t\t}\n\t\tif (!response.ok && response.metadata?.stepUpRequired) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'unusual_login_detected',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'step_up_required',\n\t\t\t\tresponse,\n\t\t\t\teventData: response.metadata.risk ? { ...response.metadata.risk } : undefined,\n\t\t\t})\n\t\t}\n\n\t\tif (!response.ok) {\n\t\t\tconst { revealUserExists, revealLoginMethod } = configuration.login\n\t\t\tconst collapseAll = !revealUserExists\n\t\t\t\t&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)\n\t\t\tconst collapseMethodOnly = revealUserExists\n\t\t\t\t&& !revealLoginMethod\n\t\t\t\t&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)\n\t\t\tif (collapseAll \|\| collapseMethodOnly) {\n\t\t\t\treturn createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')\n\t\t\t}\n\t\t\t// Preserve the additive mfaEnrollment payload on MFA_ENROLLMENT_REQUIRED (A06).\n\t\t\tif (response.error === 'MFA_ENROLLMENT_REQUIRED' && response.metadata?.mfaEnrollment) {\n\t\t\t\tconst error = {\n\t\t\t\t\tcode: response.error,\n\t\t\t\t\tdeveloperMessage: response.errorMessage,\n\t\t\t\t\tmfaEnrollment: response.metadata.mfaEnrollment,\n\t\t\t\t}\n\t\t\t\treturn { ok: false, error, errors: [error] }\n\t\t\t}\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n\n\tasync createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(),\n\t\t\tmessage: 'You are not allowed to create a session key',\n\t\t})\n\t\tlet identifier: PersonUniqueIdentifier\n\t\tif (args.email) {\n\t\t\tidentifier = { type: 'email', email: args.email }\n\t\t} else if (args.personId) {\n\t\t\tidentifier = { type: 'id', id: args.personId }\n\t\t} else {\n\t\t\tthrow new UserInputError(`Please provide either email or personId`)\n\t\t}\n\n\t\tconst response = await this.signInManager.createSessionToken(\n\t\t\tcontext.db,\n\t\t\tidentifier,\n\t\t\targs.expiration \|\| undefined,\n\t\t\tasync person =>\n\t\t\t\tawait context.requireAccess({\n\t\t\t\t\taction: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),\n\t\t\t\t\tmessage: 'You are not allowed to create a session key for this person.',\n\t\t\t\t}),\n\t\t\tcontext.httpInfo,\n\t\t\targs.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,\n\t\t)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'create_session_token',\n\t\t\tresponse: response,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: await this.signInResponseFactory.createResponse(response.result, context),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,uBACA,aAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,wBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,SAAS,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ,SAAS,IAAI,aAAa;AAC5G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,uDAAuD,OAAO,iBAAiB,MAAM;AAAA,UAC7H,YAAY,OAAO;AAAA,QAAA,CACnB;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,oBAAoB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,sBAAsB,KAAK,KAAK,CAAC;AACnG,QAAI,oBAAoB,oBAAI,QAAQ;AACnC,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,8CAA8C;AAAA,UACtF,YAAY,KAAK,MAAM,kBAAkB,YAAY,KAAK,IAAA,KAAS,GAAI;AAAA,QAAA,CACvE;AAAA,MAAA;AAAA,IAEH;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK,cAAc;AAAA,MACnB,KAAK,YAAY;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,MAC3D,KAAK,cAAc;AAAA,MACnB;AAAA,MACA,QAAQ,SAAS;AAAA,IAAA;AAElB,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AACD,QAAI,SAAS,MAAM,SAAS,OAAO,gBAAgB;AAClD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,MAAA,CACjC;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,cAAc;AACpD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,uBAAuB;AAC7D,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,MAAA,CACA;AAAA,IACF;AAIA,QAAI,SAAS,MAAM,SAAS,OAAO,sBAAsB;AACxD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,UAAU,SAAS,OAAO,OAAO;AAAA,QACjC,WAAW,SAAS,OAAO,OAAO,EAAE,GAAG,SAAS,OAAO,SAAS;AAAA,MAAA,CAChE;AAAA,IACF;AACA,QAAI,CAAC,SAAS,MAAM,SAAS,UAAU,gBAAgB;AACtD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AACD,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN;AAAA,QACA,WAAW,SAAS,SAAS,OAAO,EAAE,GAAG,SAAS,SAAS,SAAS;AAAA,MAAA,CACpE;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,IAAI;AACjB,YAAM,EAAE,kBAAkB,kBAAA,IAAsB,cAAc;AAC9D,YAAM,cAAc,CAAC,oBACjB,CAAC,mBAAmB,mBAAmB,oBAAoB,eAAe,EAAE,SAAS,SAAS,KAAK;AACvG,YAAM,qBAAqB,oBACvB,CAAC,qBACD,CAAC,mBAAmB,kBAAkB,EAAE,SAAS,SAAS,KAAK;AACnE,UAAI,eAAe,oBAAoB;AACtC,eAAO,oBAAoB,uBAAuB,qBAAqB;AAAA,MACxE;AAEA,UAAI,SAAS,UAAU,6BAA6B,SAAS,UAAU,eAAe;AACrF,cAAM,QAAQ;AAAA,UACb,MAAM,SAAS;AAAA,UACf,kBAAkB,SAAS;AAAA,UAC3B,eAAe,SAAS,SAAS;AAAA,QAAA;AAElC,eAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,KAAK,EAAA;AAAA,MAC1C;AACA,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AAAA,EAEA,MAAM,mBAAmB,QAAa,MAAsC,SAAqE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAAA;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI;AACJ,QAAI,KAAK,OAAO;AACf,mBAAa,EAAE,MAAM,SAAS,OAAO,KAAK,MAAA;AAAA,IAC3C,WAAW,KAAK,UAAU;AACzB,mBAAa,EAAE,MAAM,MAAM,IAAI,KAAK,SAAA;AAAA,IACrC,OAAO;AACN,YAAM,IAAI,eAAe,yCAAyC;AAAA,IACnE;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc;AAAA,MACzC,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,cAAc;AAAA,MACnB,OAAM,WACL,MAAM,QAAQ,cAAc;AAAA,QAC3B,QAAQ,kBAAkB,0BAA0B,OAAO,KAAK;AAAA,QAChE,SAAS;AAAA,MAAA,CACT;AAAA,MACF,QAAQ;AAAA,MACR,KAAK,SAAS,6BAA6B,QAAQ,QAAQ;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,IAAA,CACA;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,MAAM,KAAK,sBAAsB,eAAe,SAAS,QAAQ,OAAO;AAAA,IAAA;AAAA,EAElF;AACD;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs CHANGED Viewed

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class SignOutMutationResolver {

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;;"}
1	+ {"version":3,"file":"SignOutMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOC,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;;"}

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js CHANGED Viewed

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class SignOutMutationResolver {

package/dist/development/src/resolvers/mutation/person/SignOutMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;"}
1	+ {"version":3,"file":"SignOutMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignOutMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignOutArgs, SignOutResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, SignOutManager } from '../../../model/index.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class SignOutMutationResolver implements MutationResolvers {\n\tconstructor(private readonly signOutManager: SignOutManager) {}\n\n\tasync signOut(parent: any, args: MutationSignOutArgs, context: TenantResolverContext): Promise<SignOutResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_OUT,\n\t\t\tmessage: 'You are not allowed to sign out',\n\t\t})\n\n\t\tconst response = await this.signOutManager.signOut(\n\t\t\tcontext.db,\n\t\t\tcontext.identity.id,\n\t\t\tcontext.apiKeyId,\n\t\t\targs.all ?? false,\n\t\t)\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\t// Audit at the resolver layer (the manager only returns what happened). Only emit when the\n\t\t// session was federated and the IdP actually produced an RP-initiated logout URL — i.e. a\n\t\t// real Single Logout was initiated, not a plain local sign-out.\n\t\tif (response.result.logoutUrl) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'idp_logout_initiated',\n\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\tidentityProviderId: response.result.identityProviderId ?? undefined,\n\t\t\t\teventData: { all: args.all ?? false },\n\t\t\t})\n\t\t}\n\n\t\treturn { ok: true, errors: [], logoutUrl: response.result.logoutUrl }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,wBAAqD;AAAA,EACjE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,QAAQ,QAAa,MAA2B,SAA0D;AAC/G,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ,SAAS;AAAA,MACjB,QAAQ;AAAA,MACR,KAAK,OAAO;AAAA,IAAA;AAGb,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAKA,QAAI,SAAS,OAAO,WAAW;AAC9B,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU,IAAI,WAAW,IAAI;AAAA,QAC7B,oBAAoB,SAAS,OAAO,sBAAsB;AAAA,QAC1D,WAAW,EAAE,KAAK,KAAK,OAAO,MAAA;AAAA,MAAM,CACpC;AAAA,IACF;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,GAAI,WAAW,SAAS,OAAO,UAAA;AAAA,EAC3D;AACD;"}

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs CHANGED Viewed

@@ -15,6 +15,8 @@ const ConfigurationQuery = require("../../../model/queries/configuration/Configu
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,7 +24,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","PasswordPlain","UserInputError","PasswordHash","NoPassword","PersonQuery","ResponseOk","PersonResponseFactory"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOD,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIE,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOL,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAMM,YAAAA,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}
1	+ {"version":3,"file":"SignUpMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery","createErrorResponse","ResponseError","PasswordPlain","UserInputError","PasswordHash","NoPassword","PersonQuery","ResponseOk","PersonResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAOC,WAAAA;AAAAA,QACN,IAAIC,SAAAA,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAOD,WAAAA,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAIE,SAAAA,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAIC,aAAAA,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAIC,SAAAA,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAOC,SAAAA;AAAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOL,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAMM,YAAAA,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQC,sBAAAA,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;;"}