@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js

@@ -13,6 +13,8 @@ import { ConfigurationQuery } from "../../../model/queries/configuration/Configu
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,7 +22,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";

package/dist/development/src/resolvers/mutation/person/SignUpMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"SignUpMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/SignUpMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tApiKeyManager,\n\tCaptchaValidator,\n\tConfigurationQuery,\n\tEmailVerificationManager,\n\tNoPassword,\n\tPasswordHash,\n\tPasswordPlain,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonQuery,\n\tRateLimiter,\n\tSignUpManager,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'\nimport { ResponseError, ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SignUpMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly signUpManager: SignUpManager,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly captchaValidator: CaptchaValidator,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t\tprivate readonly emailVerificationManager: EmailVerificationManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {\n\t\tconst roles = args.roles ?? []\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_SIGN_UP(roles),\n\t\t\tmessage: 'You are not allowed to sign up',\n\t\t})\n\n\t\tconst configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\n\t\tconst rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)\n\t\tif (!rl.ok) {\n\t\t\treturn createErrorResponse(\n\t\t\t\tnew ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),\n\t\t\t)\n\t\t}\n\n\t\tconst captchaConfig = this.captchaValidator.extractConfig(configuration)\n\t\tif (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {\n\t\t\tconst captcha = await this.captchaValidator.verify({\n\t\t\t\tconfig: captchaConfig,\n\t\t\t\ttoken: args.captchaToken ?? undefined,\n\t\t\t\tremoteIp: context.httpInfo.ip,\n\t\t\t})\n\t\t\tif (!captcha.ok) {\n\t\t\t\treturn createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)\n\t\t\t}\n\t\t}\n\n\t\tconst password = (() => {\n\t\t\tif (args.password) {\n\t\t\t\treturn new PasswordPlain(args.password)\n\t\t\t}\n\t\t\tif (args.passwordHash) {\n\t\t\t\tif (!args.passwordHash.startsWith('$2b$')) {\n\t\t\t\t\tthrow new UserInputError('Invalid password hash. Only $2b$ bcrypt hashes are accepted.')\n\t\t\t\t}\n\t\t\t\treturn new PasswordHash(args.passwordHash)\n\t\t\t}\n\t\t\treturn NoPassword\n\t\t})()\n\n\t\tconst response = await this.signUpManager.signUp(context.db, {\n\t\t\temail: args.email,\n\t\t\tname: args.name ?? undefined,\n\t\t\tpassword,\n\t\t\troles,\n\t\t\tconfig: configuration,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\t\tconst result = response.result\n\t\tawait this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)\n\n\t\tif (result.emailVerificationRequired) {\n\t\t\t// Re-fetch to get the identity roles needed for the project lookup\n\t\t\t// the verification mail is scoped to.\n\t\t\tconst personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))\n\t\t\tif (personRow?.email) {\n\t\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\t\tid: personRow.identity_id,\n\t\t\t\t\troles: personRow.roles,\n\t\t\t\t})\n\t\t\t\tconst sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)\n\t\t\t\tif (sent) {\n\t\t\t\t\tawait context.logAuthAction({\n\t\t\t\t\t\ttype: 'email_verify_init',\n\t\t\t\t\t\tresponse: new ResponseOk(null),\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\tpersonInput: personRow.email,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t\tresult: {\n\t\t\t\tperson: PersonResponseFactory.createPersonResponse(result.person),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,uBAAoD;AAAA,EAChE,YACkB,eACA,eACA,kBACA,aACA,0BACA,0BAChB;AANgB,SAAA,gBAAA;AACA,SAAA,gBAAA;AACA,SAAA,mBAAA;AACA,SAAA,cAAA;AACA,SAAA,2BAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,QAAa,MAA0B,SAAyD;AAC5G,UAAM,QAAQ,KAAK,SAAS,CAAA;AAC5B,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,KAAK;AAAA,MAC9C,SAAS;AAAA,IAAA,CACT;AAED,UAAM,gBAAgB,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAEtG,UAAM,KAAK,MAAM,KAAK,YAAY,QAAQ,QAAQ,IAAI,kBAAkB,QAAQ,SAAS,IAAI,aAAa;AAC1G,QAAI,CAAC,GAAG,IAAI;AACX,aAAO;AAAA,QACN,IAAI,cAAc,uBAAuB,0CAA0C,GAAG,iBAAiB,IAAI;AAAA,MAAA;AAAA,IAE7G;AAEA,UAAM,gBAAgB,KAAK,iBAAiB,cAAc,aAAa;AACvE,QAAI,KAAK,iBAAiB,aAAa,eAAe,QAAQ,GAAG;AAChE,YAAM,UAAU,MAAM,KAAK,iBAAiB,OAAO;AAAA,QAClD,QAAQ;AAAA,QACR,OAAO,KAAK,gBAAgB;AAAA,QAC5B,UAAU,QAAQ,SAAS;AAAA,MAAA,CAC3B;AACD,UAAI,CAAC,QAAQ,IAAI;AAChB,eAAO,oBAAoB,mBAAmB,gCAAgC,QAAQ,MAAM,EAAE;AAAA,MAC/F;AAAA,IACD;AAEA,UAAM,YAAY,MAAM;AACvB,UAAI,KAAK,UAAU;AAClB,eAAO,IAAI,cAAc,KAAK,QAAQ;AAAA,MACvC;AACA,UAAI,KAAK,cAAc;AACtB,YAAI,CAAC,KAAK,aAAa,WAAW,MAAM,GAAG;AAC1C,gBAAM,IAAI,eAAe,8DAA8D;AAAA,QACxF;AACA,eAAO,IAAI,aAAa,KAAK,YAAY;AAAA,MAC1C;AACA,aAAO;AAAA,IACR,GAAA;AAEA,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,QAAQ,IAAI;AAAA,MAC5D,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,QAAQ;AAAA,MACnB;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IAAA,CACR;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AACA,UAAM,SAAS,SAAS;AACxB,UAAM,KAAK,cAAc,oBAAoB,QAAQ,IAAI,QAAQ,QAAQ;AAEzE,QAAI,OAAO,2BAA2B;AAGrC,YAAM,YAAY,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,OAAO,OAAO,EAAE,CAAC;AACxF,UAAI,WAAW,OAAO;AACrB,cAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,UAChF,IAAI,UAAU;AAAA,UACd,OAAO,UAAU;AAAA,QAAA,CACjB;AACD,cAAM,OAAO,MAAM,KAAK,yBAAyB,sBAAsB,QAAQ,IAAI,mBAAmB,SAAS;AAC/G,YAAI,MAAM;AACT,gBAAM,QAAQ,cAAc;AAAA,YAC3B,MAAM;AAAA,YACN,UAAU,IAAI,WAAW,IAAI;AAAA,YAC7B,UAAU,UAAU;AAAA,YACpB,aAAa,UAAU;AAAA,UAAA,CACvB;AAAA,QACF;AAAA,MACD;AAAA,IACD;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,MACR,QAAQ;AAAA,QACP,QAAQ,sBAAsB,qBAAqB,OAAO,MAAM;AAAA,MAAA;AAAA,IACjE;AAAA,EAEF;AACD;"}

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs

@@ -13,6 +13,8 @@ const ConfigurationQuery = require("../../../model/queries/configuration/Configu
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class TogglePasswordlessMutationResolver {

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAOF,WAAAA,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js

@@ -11,6 +11,8 @@ import { ConfigurationQuery } from "../../../model/queries/configuration/Configu
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class TogglePasswordlessMutationResolver {

package/dist/development/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"TogglePasswordlessMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {\n\t}\n\n\tasync enableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, true)\n\t}\n\n\tasync disableMyPasswordless(parent: unknown, args: unknown, context: TenantResolverContext): Promise<ToggleMyPasswordlessResponse> {\n\t\treturn this.doTogglePasswordless(context, false)\n\t}\n\n\tprivate async doTogglePasswordless(\n\t\tcontext: TenantResolverContext,\n\t\tvalue: boolean,\n\t): Promise<ToggleMyPasswordlessResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,\n\t\t\tmessage: 'You are not allowed to enable passwordless',\n\t\t})\n\t\tconst config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tif (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {\n\t\t\treturn createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')\n\t\t}\n\n\t\tawait this.personManager.togglePasswordless(context.db, person, value)\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,mCAAwH;AAAA,EACpI,YACkB,sBACA,eAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,qBAAqB,QAAiB,MAAe,SAAuE;AACjI,WAAO,KAAK,qBAAqB,SAAS,IAAI;AAAA,EAC/C;AAAA,EAEA,MAAM,sBAAsB,QAAiB,MAAe,SAAuE;AAClI,WAAO,KAAK,qBAAqB,SAAS,KAAK;AAAA,EAChD;AAAA,EAEA,MAAc,qBACb,SACA,OACwC;AACxC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AACrG,QAAI,OAAO,cAAc,YAAY,YAAY,OAAO,cAAc,YAAY,SAAS;AAC1F,aAAO,oBAAoB,iBAAiB,2DAA2D;AAAA,IACxG;AAEA,UAAM,KAAK,cAAc,mBAAmB,QAAQ,IAAI,QAAQ,KAAK;AAErE,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs

@@ -13,6 +13,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const graphqlUtils = require("@contember/graphql-utils");

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIK,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"CreateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["createErrorResponse","PermissionActions","isTokenHash","UserInputError","TenantRole","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAOA,WAAAA,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAACC,MAAAA,YAAY,eAAe,GAAG;AACzE,YAAM,IAAIC,aAAAA,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOJ,WAAAA,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIK,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;;"}

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.js

@@ -11,6 +11,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { UserInputError } from "@contember/graphql-utils";

package/dist/development/src/resolvers/mutation/project/CreateProjectMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}
+{"version":3,"file":"CreateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/CreateProjectMutationResolver.ts"],"sourcesContent":["import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class CreateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync createProject(\n\t\tparent: any,\n\t\t{ projectSlug, name, config, deployTokenHash: deployTokenHashDeprecated, secrets, options }: MutationCreateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<CreateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\n\t\tif (project) {\n\t\t\treturn createErrorResponse('ALREADY_EXISTS', `Project ${projectSlug} already exists`)\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PROJECT_CREATE,\n\t\t\tmessage: 'You are not allowed to create a project',\n\t\t})\n\t\tconst deployTokenHash = options?.deployTokenHash ?? deployTokenHashDeprecated ?? undefined\n\n\t\tif (typeof deployTokenHash === 'string' && !isTokenHash(deployTokenHash)) {\n\t\t\tthrow new UserInputError('Invalid format of deployTokenHash. Must be hex-encoded sha256.')\n\t\t}\n\n\t\tconst isSuperAdmin = await context.identity.roles.includes(TenantRole.SUPER_ADMIN)\n\n\t\tconst response = await this.projectManager.createProject(\n\t\t\tcontext.db,\n\t\t\tcontext.logger,\n\t\t\t{\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tconfig: (config as any) || {},\n\t\t\t\tsecrets: Object.fromEntries((secrets || []).map(it => [it.key, it.value])),\n\t\t\t},\n\t\t\t{\n\t\t\t\townerIdentityId: isSuperAdmin ? undefined : context.identity.id,\n\t\t\t\tdeployTokenHash,\n\t\t\t\tnoDeployToken: options?.noDeployToken ?? false,\n\t\t\t},\n\t\t)\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response.error, response.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: projectSlug,\n\t\t\t\tname: name || projectSlug,\n\t\t\t\tsecretKeys: (secrets ?? []).map(it => it.key).sort(),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terror: null,\n\t\t\tresult: {\n\t\t\t\tdeployerApiKey: response.result.deployerApiKey?.toApiKeyWithToken(),\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,EAAE,aAAa,MAAM,QAAQ,iBAAiB,2BAA2B,SAAS,QAAA,GAClF,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAElF,QAAI,SAAS;AACZ,aAAO,oBAAoB,kBAAkB,WAAW,WAAW,iBAAiB;AAAA,IACrF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,kBAAkB,SAAS,mBAAmB,6BAA6B;AAEjF,QAAI,OAAO,oBAAoB,YAAY,CAAC,YAAY,eAAe,GAAG;AACzE,YAAM,IAAI,eAAe,gEAAgE;AAAA,IAC1F;AAEA,UAAM,eAAe,MAAM,QAAQ,SAAS,MAAM,SAAS,WAAW,WAAW;AAEjF,UAAM,WAAW,MAAM,KAAK,eAAe;AAAA,MAC1C,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR;AAAA,QACC,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,QAAS,UAAkB,CAAA;AAAA,QAC3B,SAAS,OAAO,aAAa,WAAW,CAAA,GAAI,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAAA,MAAA;AAAA,MAE1E;AAAA,QACC,iBAAiB,eAAe,SAAY,QAAQ,SAAS;AAAA,QAC7D;AAAA,QACA,eAAe,SAAS,iBAAiB;AAAA,MAAA;AAAA,IAC1C;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,SAAS,OAAO,SAAS,YAAY;AAAA,IACjE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM;AAAA,QACN,MAAM,QAAQ;AAAA,QACd,aAAa,WAAW,IAAI,IAAI,CAAA,OAAM,GAAG,GAAG,EAAE,KAAA;AAAA,MAAK;AAAA,IACpD,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,OAAO;AAAA,MACP,QAAQ;AAAA,QACP,gBAAgB,SAAS,OAAO,gBAAgB,kBAAA;AAAA,MAAkB;AAAA,IACnE;AAAA,EAEF;AACD;"}

package/dist/development/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class SetProjectSecretMutationResolver {

package/dist/development/src/resolvers/mutation/project/SetProjectSecretMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SetProjectSecretMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/project/SetProjectSecretMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse } from "../../errorUtils.js";
 class SetProjectSecretMutationResolver {

package/dist/development/src/resolvers/mutation/project/SetProjectSecretMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SetProjectSecretMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts"],"sourcesContent":["import {\n\tAddProjectMemberErrorCode,\n\tCreateProjectResponseErrorCode,\n\tMutationResolvers,\n\tMutationSetProjectSecretArgs,\n\tSetProjectSecretResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class SetProjectSecretMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}\n\n\tasync setProjectSecret(\n\t\tparent: any,\n\t\targs: MutationSetProjectSecretArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SetProjectSecretResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_SET_SECRET,\n\t\t\tmessage: 'You are not allowed to set project secrets',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tawait this.secretManager.setSecret(context.db, project.id, args.key, args.value)\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_secret_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\tkey: args.key,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,iCAA8D;AAAA,EAC1E,YAA6B,gBAAiD,eAA+B;AAAhF,SAAA,iBAAA;AAAiD,SAAA,gBAAA;AAAA,EAAgC;AAAA,EAE9G,MAAM,iBACL,QACA,MACA,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,KAAK,cAAc,UAAU,QAAQ,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK;AAE/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,KAAK,KAAK;AAAA,MAAA;AAAA,IACX,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/project/UpdateProjectMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const configLoader = require("@contember/config-loader");

package/dist/development/src/resolvers/mutation/project/UpdateProjectMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Merger } from '@contember/config-loader'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class UpdateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync updateProject(\n\t\tparent: any,\n\t\targs: MutationUpdateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_UPDATE,\n\t\t\tmessage: 'You are not allowed to update a project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tconst nameChange = args.name && args.name !== project.name ? { before: project.name, after: args.name } : undefined\n\t\tconst configChanged = args.config !== undefined\n\t\tawait this.projectManager.updateProject(context.db, project.id, {\n\t\t\tname: args.name || undefined,\n\t\t\tconfig: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\t...(nameChange ? { name: nameChange } : {}),\n\t\t\t\t...(configChanged ? { configChanged: true, mergeConfig: args.mergeConfig ?? false } : {}),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","Merger","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,aAAa,KAAK,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,KAAK,SAAS;AAC1G,UAAM,gBAAgB,KAAK,WAAW;AACtC,UAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC/D,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,WAAW,SAAYC,aAAAA,OAAO,MAAM,KAAK,cAAc,QAAQ,SAAS,CAAA,GAAI,KAAK,MAAa,IAAI;AAAA,IAAA,CAC/G;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,GAAI,aAAa,EAAE,MAAM,WAAA,IAAe,CAAA;AAAA,QACxC,GAAI,gBAAgB,EAAE,eAAe,MAAM,aAAa,KAAK,eAAe,UAAU,CAAA;AAAA,MAAC;AAAA,IACxF,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"UpdateProjectMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Merger } from '@contember/config-loader'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class UpdateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync updateProject(\n\t\tparent: any,\n\t\targs: MutationUpdateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_UPDATE,\n\t\t\tmessage: 'You are not allowed to update a project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tconst nameChange = args.name && args.name !== project.name ? { before: project.name, after: args.name } : undefined\n\t\tconst configChanged = args.config !== undefined\n\t\tawait this.projectManager.updateProject(context.db, project.id, {\n\t\t\tname: args.name || undefined,\n\t\t\tconfig: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\t...(nameChange ? { name: nameChange } : {}),\n\t\t\t\t...(configChanged ? { configChanged: true, mergeConfig: args.mergeConfig ?? false } : {}),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","Merger","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,yCAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,aAAa,KAAK,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,KAAK,SAAS;AAC1G,UAAM,gBAAgB,KAAK,WAAW;AACtC,UAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC/D,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,WAAW,SAAYC,aAAAA,OAAO,MAAM,KAAK,cAAc,QAAQ,SAAS,CAAA,GAAI,KAAK,MAAa,IAAI;AAAA,IAAA,CAC/G;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,GAAI,aAAa,EAAE,MAAM,WAAA,IAAe,CAAA;AAAA,QACxC,GAAI,gBAAgB,EAAE,eAAe,MAAM,aAAa,KAAK,eAAe,UAAU,CAAA;AAAA,MAAC;AAAA,IACxF,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/project/UpdateProjectMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse } from "../../errorUtils.js";
 import { Merger } from "@contember/config-loader";

package/dist/development/src/resolvers/mutation/project/UpdateProjectMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Merger } from '@contember/config-loader'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class UpdateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync updateProject(\n\t\tparent: any,\n\t\targs: MutationUpdateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_UPDATE,\n\t\t\tmessage: 'You are not allowed to update a project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tconst nameChange = args.name && args.name !== project.name ? { before: project.name, after: args.name } : undefined\n\t\tconst configChanged = args.config !== undefined\n\t\tawait this.projectManager.updateProject(context.db, project.id, {\n\t\t\tname: args.name || undefined,\n\t\t\tconfig: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\t...(nameChange ? { name: nameChange } : {}),\n\t\t\t\t...(configChanged ? { configChanged: true, mergeConfig: args.mergeConfig ?? false } : {}),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,aAAa,KAAK,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,KAAK,SAAS;AAC1G,UAAM,gBAAgB,KAAK,WAAW;AACtC,UAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC/D,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,WAAW,SAAY,OAAO,MAAM,KAAK,cAAc,QAAQ,SAAS,CAAA,GAAI,KAAK,MAAa,IAAI;AAAA,IAAA,CAC/G;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,GAAI,aAAa,EAAE,MAAM,WAAA,IAAe,CAAA;AAAA,QACxC,GAAI,gBAAgB,EAAE,eAAe,MAAM,aAAa,KAAK,eAAe,UAAU,CAAA;AAAA,MAAC;AAAA,IACxF,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"UpdateProjectMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Merger } from '@contember/config-loader'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class UpdateProjectMutationResolver implements MutationResolvers {\n\tconstructor(private readonly projectManager: ProjectManager) {}\n\n\tasync updateProject(\n\t\tparent: any,\n\t\targs: MutationUpdateProjectArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_UPDATE,\n\t\t\tmessage: 'You are not allowed to update a project',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)\n\t\t}\n\t\tconst nameChange = args.name && args.name !== project.name ? { before: project.name, after: args.name } : undefined\n\t\tconst configChanged = args.config !== undefined\n\t\tawait this.projectManager.updateProject(context.db, project.id, {\n\t\t\tname: args.name || undefined,\n\t\t\tconfig: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'project_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: project.slug,\n\t\t\t\t...(nameChange ? { name: nameChange } : {}),\n\t\t\t\t...(configChanged ? { configChanged: true, mergeConfig: args.mergeConfig ?? false } : {}),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,gBAAgC;AAAhC,SAAA,iBAAA;AAAA,EAAiC;AAAA,EAE9D,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,KAAK,WAAW;AAAA,IAC3E;AACA,UAAM,aAAa,KAAK,QAAQ,KAAK,SAAS,QAAQ,OAAO,EAAE,QAAQ,QAAQ,MAAM,OAAO,KAAK,SAAS;AAC1G,UAAM,gBAAgB,KAAK,WAAW;AACtC,UAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,QAAQ,IAAI;AAAA,MAC/D,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,WAAW,SAAY,OAAO,MAAM,KAAK,cAAc,QAAQ,SAAS,CAAA,GAAI,KAAK,MAAa,IAAI;AAAA,IAAA,CAC/G;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,QAAQ;AAAA,QACd,GAAI,aAAa,EAAE,MAAM,WAAA,IAAe,CAAA;AAAA,QACxC,GAAI,gBAAgB,EAAE,eAAe,MAAM,aAAa,KAAK,eAAe,UAAU,CAAA;AAAA,MAAC;AAAA,IACxF,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const membershipUtils = require("../../membershipUtils.cjs");
 const errorUtils = require("../../errorUtils.cjs");

package/dist/development/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AddProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.ts"],"sourcesContent":["import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class AddProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync addProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationAddProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_ADD_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to add a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.addProjectMember(context.db, project.id, identityId, memberships)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_create', project.id, identityId, [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipValidationErrorResult","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,iCAA8D;AAAA,EAC1E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,mBAAmB,WAAW;AAAA,MACxD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,YAAY,WAAW;AAE/G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,EAAE;AAEjG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"AddProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.ts"],"sourcesContent":["import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class AddProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync addProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationAddProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_ADD_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to add a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.addProjectMember(context.db, project.id, identityId, memberships)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_create', project.id, identityId, [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipValidationErrorResult","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,iCAA8D;AAAA,EAC1E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQA,kBAAAA,kBAAkB,mBAAmB,WAAW;AAAA,MACxD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,gBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,YAAY,WAAW;AAE/G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,EAAE;AAEjG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/development/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";

package/dist/development/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.ts"],"sourcesContent":["import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class AddProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync addProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationAddProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_ADD_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to add a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.addProjectMember(context.db, project.id, identityId, memberships)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_create', project.id, identityId, [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,iCAA8D;AAAA,EAC1E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,mBAAmB,WAAW;AAAA,MACxD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,YAAY,WAAW;AAE/G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,EAAE;AAEjG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"AddProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.ts"],"sourcesContent":["import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class AddProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync addProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationAddProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tawait context.requireAccess({\n\t\t\tscope: await context.permissionContext.createProjectScope(project),\n\t\t\taction: PermissionActions.PROJECT_ADD_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to add a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst validationResult = await this.membershipValidator.validate(project.slug, memberships)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst result = await this.projectMemberManager.addProjectMember(context.db, project.id, identityId, memberships)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_create', project.id, identityId, [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,iCAA8D;AAAA,EAC1E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACoC;AACpC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAAA,MACjE,QAAQ,kBAAkB,mBAAmB,WAAW;AAAA,MACxD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,mBAAmB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW;AAC1F,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,iBAAiB,QAAQ,IAAI,QAAQ,IAAI,YAAY,WAAW;AAE/G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,EAAE;AAEjG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.cjs

@@ -12,6 +12,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ProjectMembershipByIdentityQuery = require("../../../model/queries/membership/ProjectMembershipByIdentityQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const audit = require("./audit.cjs");

package/dist/development/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RemoveProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQD,kBAAAA,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"RemoveProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQD,kBAAAA,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/development/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.js

@@ -10,6 +10,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { ProjectMembershipByIdentityQuery } from "../../../model/queries/membership/ProjectMembershipByIdentityQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
 import { logProjectMembershipChange } from "./audit.js";

package/dist/development/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"RemoveProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"RemoveProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationRemoveProjectMemberArgs,\n\tMutationResolvers,\n\tRemoveProjectMemberErrorCode,\n\tRemoveProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class RemoveProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync removeProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId }: MutationRemoveProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst memberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_REMOVE_MEMBER(memberships),\n\t\t\tmessage: 'You are not allowed to remove a project member',\n\t\t})\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBAChB;AAFgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,WAAA,GACf,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,MACnD,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,WAAW;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,UAAU;AAErG,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.cjs

@@ -13,6 +13,8 @@ const ProjectMembershipByIdentityQuery = require("../../../model/queries/members
 require("node:assert");
 const membershipUtils = require("../../../model/service/membershipUtils.cjs");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+const schemaUtils = require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-const schemaUtils = require("@contember/schema-utils");
 require("otpauth");
 const membershipUtils$1 = require("../../membershipUtils.cjs");
 const errorUtils = require("../../errorUtils.cjs");

package/dist/development/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipModification","it","MembershipValidationErrorType","createMembershipValidationErrorResult","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkBC,gBAAAA,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAC,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQH,kBAAAA,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAUI,0CAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,kBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
+{"version":3,"file":"UpdateProjectMemberMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createProjectNotFoundResponse","createMembershipModification","it","MembershipValidationErrorType","createMembershipValidationErrorResult","ProjectMembershipByIdentityQuery","createErrorResponse","logProjectMembershipChange"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkBC,gBAAAA,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAC,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQH,kBAAAA,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAUI,0CAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAASC,kBAAAA,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAMC,MAAAA,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/development/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.js

@@ -11,6 +11,8 @@ import { ProjectMembershipByIdentityQuery } from "../../../model/queries/members
 import "node:assert";
 import { createMembershipModification } from "../../../model/service/membershipUtils.js";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import { MembershipValidationErrorType } from "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import { MembershipValidationErrorType } from "@contember/schema-utils";
 import "otpauth";
 import { createMembershipValidationErrorResult } from "../../membershipUtils.js";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";