@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["it"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkB,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAU,8BAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"UpdateProjectMemberMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts"],"sourcesContent":["import {\n\tMutationResolvers,\n\tMutationUpdateProjectMemberArgs,\n\tUpdateProjectMemberErrorCode,\n\tUpdateProjectMemberResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'\nimport { createMembershipValidationErrorResult } from '../../membershipUtils.js'\nimport { createMembershipModification } from '../../../model/service/membershipUtils.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { Acl } from '@contember/schema'\nimport { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'\nimport { logProjectMembershipChange } from './audit.js'\n\nexport class UpdateProjectMemberMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly membershipValidator: MembershipValidator,\n\t) {}\n\n\tasync updateProjectMember(\n\t\tparent: any,\n\t\t{ projectSlug, identityId, memberships }: MutationUpdateProjectMemberArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateProjectMemberResponse> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER([]),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\t\tif (!project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tconst visibleMemberships = await this.projectMemberManager.getStoredProjectsMemberships(\n\t\t\tcontext.db,\n\t\t\t{ id: project.id },\n\t\t\t{ id: identityId },\n\t\t\tcontext.permissionContext.createAccessVerifier(projectScope),\n\t\t)\n\t\tconst membershipPatch = createMembershipModification(visibleMemberships, memberships)\n\n\t\tconst aclMemberships: Acl.Membership[] = membershipPatch.map(it => ({\n\t\t\trole: it.role,\n\t\t\tvariables: it.variables.map(it => ({\n\t\t\t\tname: it.name,\n\t\t\t\tvalues: 'set' in it ? it.set : [...it.remove, ...it.append],\n\t\t\t})),\n\t\t}))\n\n\t\tawait context.requireAccess({\n\t\t\tscope: projectScope,\n\t\t\taction: PermissionActions.PROJECT_UPDATE_MEMBER(aclMemberships),\n\t\t\tmessage: 'You are not allowed to update project member variables',\n\t\t})\n\n\t\tconst validationResult = (await this.membershipValidator.validate(project.slug, memberships)).filter(\n\t\t\tit => it.error !== MembershipValidationErrorType.VARIABLE_EMPTY,\n\t\t)\n\t\tif (validationResult.length > 0) {\n\t\t\tconst errors = createMembershipValidationErrorResult(validationResult)\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terrors: errors,\n\t\t\t\terror: errors[0],\n\t\t\t}\n\t\t}\n\n\t\tconst before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\tconst result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["it"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,sBACA,gBACA,qBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,oBACL,QACA,EAAE,aAAa,YAAY,YAAA,GAC3B,SACuC;AACvC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW;AAClF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,EAAE;AAAA,MAClD,SAAS;AAAA,IAAA,CACT;AACD,QAAI,CAAC,SAAS;AACb,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,UAAM,qBAAqB,MAAM,KAAK,qBAAqB;AAAA,MAC1D,QAAQ;AAAA,MACR,EAAE,IAAI,QAAQ,GAAA;AAAA,MACd,EAAE,IAAI,WAAA;AAAA,MACN,QAAQ,kBAAkB,qBAAqB,YAAY;AAAA,IAAA;AAE5D,UAAM,kBAAkB,6BAA6B,oBAAoB,WAAW;AAEpF,UAAM,iBAAmC,gBAAgB,IAAI,CAAA,QAAO;AAAA,MACnE,MAAM,GAAG;AAAA,MACT,WAAW,GAAG,UAAU,IAAI,CAAAA,SAAO;AAAA,QAClC,MAAMA,IAAG;AAAA,QACT,QAAQ,SAASA,MAAKA,IAAG,MAAM,CAAC,GAAGA,IAAG,QAAQ,GAAGA,IAAG,MAAM;AAAA,MAAA,EACzD;AAAA,IAAA,EACD;AAEF,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO;AAAA,MACP,QAAQ,kBAAkB,sBAAsB,cAAc;AAAA,MAC9D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,oBAAoB,MAAM,KAAK,oBAAoB,SAAS,QAAQ,MAAM,WAAW,GAAG;AAAA,MAC7F,CAAA,OAAM,GAAG,UAAU,8BAA8B;AAAA,IAAA;AAElD,QAAI,iBAAiB,SAAS,GAAG;AAChC,YAAM,SAAS,sCAAsC,gBAAgB;AACrE,aAAO;AAAA,QACN,IAAI;AAAA,QACJ;AAAA,QACA,OAAO,OAAO,CAAC;AAAA,MAAA;AAAA,IAEjB;AAEA,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACzH,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,QAAQ,IAAI,YAAY,eAAe;AAEtH,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,2BAA2B,SAAS,6BAA6B,QAAQ,IAAI,YAAY,MAAM;AAErG,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/query/ApiKeyQueryResolver.cjs

@@ -12,6 +12,8 @@ require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ApiKeyListQuery = require("../../model/queries/apiKey/ApiKeyListQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const ApiKeyResponseFactory = require("../responseHelpers/ApiKeyResponseFactory.cjs");
 class ApiKeyQueryResolver {

package/dist/development/src/resolvers/query/ApiKeyQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":["PermissionActions","GlobalApiKeysQuery","ApiKeyResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}
+{"version":3,"file":"ApiKeyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":["PermissionActions","GlobalApiKeysQuery","ApiKeyResponseFactory"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}

package/dist/development/src/resolvers/query/ApiKeyQueryResolver.js

@@ -10,6 +10,8 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { GlobalApiKeysQuery } from "../../model/queries/apiKey/ApiKeyListQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { ApiKeyResponseFactory } from "../responseHelpers/ApiKeyResponseFactory.js";
 class ApiKeyQueryResolver {

package/dist/development/src/resolvers/query/ApiKeyQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}
+{"version":3,"file":"ApiKeyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ApiKeyQueryResolver.ts"],"sourcesContent":["import { ApiKey, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ApiKeyQueryResolver implements QueryResolvers {\n\tasync globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {\n\t\tif (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,oBAA8C;AAAA,EAC1D,MAAM,cAAc,QAAiB,MAAe,SAA4D;AAC/G,QAAI,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,aAAA,CAAc,GAAI;AAC3E,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB;AACzE,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}

package/dist/development/src/resolvers/query/AuthLogQueryResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const AuthLogQuery = require("../../model/queries/authLog/AuthLogQuery.cjs");
 class AuthLogQueryResolver {

package/dist/development/src/resolvers/query/AuthLogQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","AuthLogQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,aAAAA;AAAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAASA,aAAAA,aAAa,cAAcA,aAAAA,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;;"}
+{"version":3,"file":"AuthLogQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","AuthLogQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,aAAAA;AAAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAASA,aAAAA,aAAa,cAAcA,aAAAA,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;;"}

package/dist/development/src/resolvers/query/AuthLogQueryResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { AuthLogQuery } from "../../model/queries/authLog/AuthLogQuery.js";
 class AuthLogQueryResolver {

package/dist/development/src/resolvers/query/AuthLogQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI;AAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAAS,aAAa,cAAc,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;"}
+{"version":3,"file":"AuthLogQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthLogQueryResolver.ts"],"sourcesContent":["import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'\nimport { AuthActionType } from '../../model/type/AuthLog.js'\n\nexport class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {\n\tasync authLog(\n\t\tparent: unknown,\n\t\targs: QueryAuthLogArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AuthLogPage> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.AUTH_LOG_VIEW,\n\t\t\tmessage: 'You are not allowed to view the audit log',\n\t\t})\n\n\t\tconst limit = args.limit ?? undefined\n\t\tconst offset = args.offset ?? undefined\n\t\tconst filter = args.filter ?? {}\n\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew AuthLogQuery(\n\t\t\t\t{\n\t\t\t\t\ttypes: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,\n\t\t\t\t\tsuccess: filter.success ?? undefined,\n\t\t\t\t\tinvokedByIdentityId: filter.invokedByIdentityId ?? undefined,\n\t\t\t\t\tpersonId: filter.personId ?? undefined,\n\t\t\t\t\ttargetPersonId: filter.targetPersonId ?? undefined,\n\t\t\t\t\tpersonInputIdentifier: filter.personInputIdentifier ?? undefined,\n\t\t\t\t\tcreatedAfter: filter.createdAfter ?? undefined,\n\t\t\t\t\tcreatedBefore: filter.createdBefore ?? undefined,\n\t\t\t\t},\n\t\t\t\t{ limit: limit ?? undefined, offset: offset ?? undefined },\n\t\t\t),\n\t\t)\n\n\t\tconst effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)\n\t\tconst hasMore = rows.length > effectiveLimit\n\t\tconst visible = hasMore ? rows.slice(0, effectiveLimit) : rows\n\n\t\treturn {\n\t\t\thasMore,\n\t\t\tentries: visible.map(row => ({\n\t\t\t\tid: row.id,\n\t\t\t\tcreatedAt: row.created_at,\n\t\t\t\ttype: row.type,\n\t\t\t\tsuccess: row.success,\n\t\t\t\tinvokedByIdentityId: row.invoked_by_id,\n\t\t\t\tpersonId: row.person_id,\n\t\t\t\ttargetPersonId: row.target_person_id,\n\t\t\t\tpersonInputIdentifier: row.person_input_identifier,\n\t\t\t\terrorCode: row.error_code,\n\t\t\t\terrorMessage: row.error_message,\n\t\t\t\tipAddress: row.ip_address,\n\t\t\t\tuserAgent: row.user_agent,\n\t\t\t\tidentityProviderId: row.identity_provider_id,\n\t\t\t\tmetadata: row.metadata,\n\t\t\t\teventData: row.event_data,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,qBAAgE;AAAA,EAC5E,MAAM,QACL,QACA,MACA,SACuB;AACvB,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,QAAQ,KAAK,SAAS;AAC5B,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,SAAS,KAAK,UAAU,CAAA;AAE9B,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI;AAAA,QACH;AAAA,UACC,OAAQ,OAAO,SAAS;AAAA,UACxB,SAAS,OAAO,WAAW;AAAA,UAC3B,qBAAqB,OAAO,uBAAuB;AAAA,UACnD,UAAU,OAAO,YAAY;AAAA,UAC7B,gBAAgB,OAAO,kBAAkB;AAAA,UACzC,uBAAuB,OAAO,yBAAyB;AAAA,UACvD,cAAc,OAAO,gBAAgB;AAAA,UACrC,eAAe,OAAO,iBAAiB;AAAA,QAAA;AAAA,QAExC,EAAE,OAAO,SAAS,QAAW,QAAQ,UAAU,OAAA;AAAA,MAAU;AAAA,IAC1D;AAGD,UAAM,iBAAiB,KAAK,IAAI,SAAS,aAAa,cAAc,aAAa,SAAS;AAC1F,UAAM,UAAU,KAAK,SAAS;AAC9B,UAAM,UAAU,UAAU,KAAK,MAAM,GAAG,cAAc,IAAI;AAE1D,WAAO;AAAA,MACN;AAAA,MACA,SAAS,QAAQ,IAAI,CAAA,SAAQ;AAAA,QAC5B,IAAI,IAAI;AAAA,QACR,WAAW,IAAI;AAAA,QACf,MAAM,IAAI;AAAA,QACV,SAAS,IAAI;AAAA,QACb,qBAAqB,IAAI;AAAA,QACzB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,uBAAuB,IAAI;AAAA,QAC3B,WAAW,IAAI;AAAA,QACf,cAAc,IAAI;AAAA,QAClB,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,oBAAoB,IAAI;AAAA,QACxB,UAAU,IAAI;AAAA,QACd,WAAW,IAAI;AAAA,MAAA,EACd;AAAA,IAAA;AAAA,EAEJ;AACD;"}

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.cjs

@@ -12,6 +12,8 @@ require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ProjectsQuery = require("../../model/queries/project/ProjectsQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class AuthPolicyQueryResolver {
   constructor(authPolicyManager) {

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectsQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;;"}
+{"version":3,"file":"AuthPolicyQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectsQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.js

@@ -10,6 +10,8 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { ProjectsQuery } from "../../model/queries/project/ProjectsQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class AuthPolicyQueryResolver {
   constructor(authPolicyManager) {

package/dist/development/src/resolvers/query/AuthPolicyQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAI,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;"}
+{"version":3,"file":"AuthPolicyQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/AuthPolicyQueryResolver.ts"],"sourcesContent":["import { AuthPolicy, QueryResolvers } from '../../schema/index.js'\nimport { AuthPolicyManager, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ProjectsQuery } from '../../model/queries/index.js'\n\n/**\n * Lists configured auth policies. Gated like `configure`. Maps each row's\n * `project_id` back to a project slug, and lets the Interval scalar serialize\n * the IPostgresInterval session fields.\n */\nexport class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to view auth policies',\n\t\t})\n\n\t\tconst [rows, projects] = await Promise.all([\n\t\t\tthis.authPolicyManager.listPolicies(context.db),\n\t\t\tcontext.db.queryHandler.fetch(new ProjectsQuery()),\n\t\t])\n\t\tconst slugById = new Map(projects.map(p => [p.id, p.slug]))\n\n\t\treturn rows.map((row): AuthPolicy => ({\n\t\t\tid: row.id,\n\t\t\tscope: row.scope,\n\t\t\tproject: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,\n\t\t\troles: row.roles,\n\t\t\tmfaRequired: row.mfa_required,\n\t\t\t// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.\n\t\t\ttokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],\n\t\t\tidleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],\n\t\t\tmfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],\n\t\t\trememberMeAllowed: row.remember_me_allowed,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,wBAAwE;AAAA,EACpF,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,QAAiB,MAAe,SAAgE;AAClH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC1C,KAAK,kBAAkB,aAAa,QAAQ,EAAE;AAAA,MAC9C,QAAQ,GAAG,aAAa,MAAM,IAAI,eAAe;AAAA,IAAA,CACjD;AACD,UAAM,WAAW,IAAI,IAAI,SAAS,IAAI,CAAA,MAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1D,WAAO,KAAK,IAAI,CAAC,SAAqB;AAAA,MACrC,IAAI,IAAI;AAAA,MACR,OAAO,IAAI;AAAA,MACX,SAAS,IAAI,eAAe,OAAO,SAAS,IAAI,IAAI,UAAU,KAAK,OAAO;AAAA,MAC1E,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA;AAAA,MAEjB,iBAAiB,IAAI;AAAA,MACrB,aAAa,IAAI;AAAA,MACjB,kBAAkB,IAAI;AAAA,MACtB,mBAAmB,IAAI;AAAA,IAAA,EACtB;AAAA,EACH;AACD;"}

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.cjs

@@ -12,6 +12,8 @@ require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ConfigurationQuery = require("../../model/queries/configuration/ConfigurationQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class ConfigurationQueryResolver {
   constructor(configurationManager) {

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;;"}
+{"version":3,"file":"ConfigurationQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":["PermissionActions","ConfigurationQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;;"}

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.js

@@ -10,6 +10,8 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { ConfigurationQuery } from "../../model/queries/configuration/ConfigurationQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class ConfigurationQueryResolver {
   constructor(configurationManager) {

package/dist/development/src/resolvers/query/ConfigurationQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;"}
+{"version":3,"file":"ConfigurationQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ConfigurationQueryResolver.ts"],"sourcesContent":["import { Config, QueryResolvers } from '../../schema/index.js'\nimport { ConfigurationQuery, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { ConfigurationManager } from '../../model/service/ConfigurationManager.js'\n\nexport class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configuration(parent: unknown, args: unknown, context: TenantResolverContext): Promise<Config> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIG_VIEW,\n\t\t\tmessage: 'You are not allowed to view configuration',\n\t\t})\n\n\t\treturn await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,2BAA4E;AAAA,EACxF,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,cAAc,QAAiB,MAAe,SAAiD;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAAA,EACxF;AACD;"}

package/dist/development/src/resolvers/query/IDPQueryResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class IDPQueryResolver {
   constructor(idpManager) {

package/dist/development/src/resolvers/query/IDPQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;;"}
+{"version":3,"file":"IDPQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;;"}

package/dist/development/src/resolvers/query/IDPQueryResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class IDPQueryResolver {
   constructor(idpManager) {

package/dist/development/src/resolvers/query/IDPQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;"}
+{"version":3,"file":"IDPQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/IDPQueryResolver.ts"],"sourcesContent":["import { IdentityProvider, QueryResolvers } from '../../schema/index.js'\nimport { PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { IDPManager } from '../../model/service/idp/IDPManager.js'\n\nexport class IDPQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly idpManager: IDPManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: unknown, args: unknown, context: TenantResolverContext): Promise<IdentityProvider[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_LIST,\n\t\t\tmessage: 'You are not allowed to list IDP',\n\t\t})\n\n\t\treturn await this.idpManager.listIDP(context.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,iBAA2C;AAAA,EACvD,YACkB,YAChB;AADgB,SAAA,aAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAiB,MAAe,SAA6D;AACpH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,WAAO,MAAM,KAAK,WAAW,QAAQ,QAAQ,EAAE;AAAA,EAChD;AACD;"}

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.cjs

@@ -13,6 +13,8 @@ const MailTemplateListQuery = require("../../model/queries/mailTemplate/MailTemp
 const type = require("../../model/mailing/type.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class MailTemplateQueryResolver {
   async mailTemplates(parent, args, context) {

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","MailTemplateListQuery","mailTypeFromDbToSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAMC,KAAAA,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;;"}
+{"version":3,"file":"MailTemplateQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","MailTemplateListQuery","mailTypeFromDbToSchema"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sBAAAA,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAMC,KAAAA,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.js

@@ -11,6 +11,8 @@ import { MailTemplateListQuery } from "../../model/queries/mailTemplate/MailTemp
 import { mailTypeFromDbToSchema } from "../../model/mailing/type.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class MailTemplateQueryResolver {
   async mailTemplates(parent, args, context) {

package/dist/development/src/resolvers/query/MailTemplateQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAM,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;"}
+{"version":3,"file":"MailTemplateQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/MailTemplateQueryResolver.ts"],"sourcesContent":["import { MailTemplateData, QueryResolvers } from '../../schema/index.js'\nimport { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class MailTemplateQueryResolver implements QueryResolvers {\n\tasync mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_LIST,\n\t\t\tmessage: 'You are not allowed to list mail templates',\n\t\t})\n\t\treturn (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({\n\t\t\t...it,\n\t\t\tvariant: it.variant || null,\n\t\t\ttype: mailTypeFromDbToSchema(it.type),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,0BAAoD;AAAA,EAChE,MAAM,cAAc,QAAiB,MAAe,SAA6D;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,YAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,uBAAuB,GAAG,IAAI,CAAA,QAAO;AAAA,MACpF,GAAG;AAAA,MACH,SAAS,GAAG,WAAW;AAAA,MACvB,MAAM,uBAAuB,GAAG,IAAI;AAAA,IAAA,EACnC;AAAA,EACH;AACD;"}

package/dist/development/src/resolvers/query/PersonQueryResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const PersonResponseFactory = require("../responseHelpers/PersonResponseFactory.cjs");
 class PersonQueryResolver {

package/dist/development/src/resolvers/query/PersonQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["PermissionActions","PersonResponseFactory","rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAMC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQD,kBAAAA,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAME,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAOD,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAASD,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}
+{"version":3,"file":"PersonQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["PermissionActions","PersonResponseFactory","rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAMC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQD,kBAAAA,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAME,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAOD,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAASD,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;;"}

package/dist/development/src/resolvers/query/PersonQueryResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { PersonResponseFactory } from "../responseHelpers/PersonResponseFactory.js";
 class PersonQueryResolver {

package/dist/development/src/resolvers/query/PersonQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAM,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAMA,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}
+{"version":3,"file":"PersonQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/PersonQueryResolver.ts"],"sourcesContent":["import { Maybe, Person, QueryPersonByIdArgs, QueryPersonsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, PersonManager, ProjectManager, ProjectMemberManager } from '../../model/index.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class PersonQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync personById(\n\t\tparent: unknown,\n\t\targs: QueryPersonByIdArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<Maybe<Person>> {\n\t\tconst person = await this.personManager.findPersonById(context.db, args.id)\n\t\tif (!person || !(await context.isAllowed({ action: PermissionActions.PERSON_VIEW }))) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn await PersonResponseFactory.createPersonResponse(person)\n\t}\n\n\tasync persons(\n\t\tparent: unknown,\n\t\targs: QueryPersonsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Person[]> {\n\t\tconst filter = {\n\t\t\temail: args.filter?.email,\n\t\t\tpersonId: args.filter?.personId,\n\t\t\tidentityId: args.filter?.identityId,\n\t\t}\n\n\t\t// SUPER_ADMIN (global wildcard) may list every person.\n\t\tif (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {\n\t\t\tconst rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)\n\t\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t\t}\n\n\t\t// Otherwise scope to exactly the members the caller may see — the same set\n\t\t// reachable via `project.members`. We resolve visible members per project\n\t\t// through `getProjectMembers`, which applies per-membership-role filtering,\n\t\t// so a caller whose `tenant.view` rule is restricted to some roles only sees\n\t\t// those members (a plain `PROJECT_VIEW_MEMBER([])` gate would leak the whole\n\t\t// membership, incl. admins, regardless of role).\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)\n\t\tconst visibleIdentityIds = new Set<string>()\n\t\tfor (const project of projects) {\n\t\t\tconst scope = await context.permissionContext.createProjectScope(project)\n\t\t\tconst verifier = context.permissionContext.createAccessVerifier(scope)\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst members = await this.projectMemberManager.getProjectMembers(context.db, project.id, verifier, { filter: {} })\n\t\t\tfor (const member of members) {\n\t\t\t\tvisibleIdentityIds.add(member.identity.id)\n\t\t\t}\n\t\t}\n\t\tif (visibleIdentityIds.size === 0) {\n\t\t\treturn []\n\t\t}\n\n\t\tconst rows = await this.personManager.listPersons(\n\t\t\tcontext.db,\n\t\t\t{ ...filter, identityIds: [...visibleIdentityIds] },\n\t\t\targs.limit,\n\t\t\targs.offset,\n\t\t)\n\t\treturn rows.map(row => PersonResponseFactory.createPersonResponse(row))\n\t}\n}\n"],"names":["rows"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,oBAA8C;AAAA,EAC1D,YACkB,eACA,gBACA,sBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WACL,QACA,MACA,SACyB;AACzB,UAAM,SAAS,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,EAAE;AAC1E,QAAI,CAAC,UAAU,CAAE,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAI;AACrF,aAAO;AAAA,IACR;AAEA,WAAO,MAAM,sBAAsB,qBAAqB,MAAM;AAAA,EAC/D;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,SAAS;AAAA,MACd,OAAO,KAAK,QAAQ;AAAA,MACpB,UAAU,KAAK,QAAQ;AAAA,MACvB,YAAY,KAAK,QAAQ;AAAA,IAAA;AAI1B,QAAI,MAAM,QAAQ,UAAU,EAAE,QAAQ,kBAAkB,YAAA,CAAa,GAAG;AACvE,YAAMA,QAAO,MAAM,KAAK,cAAc,YAAY,QAAQ,IAAI,QAAQ,KAAK,OAAO,KAAK,MAAM;AAC7F,aAAOA,MAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,IACvE;AAQA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,QAAQ,SAAS,IAAI,QAAQ,iBAAiB;AAC3H,UAAM,yCAAyB,IAAA;AAC/B,eAAW,WAAW,UAAU;AAC/B,YAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AACxE,YAAM,WAAW,QAAQ,kBAAkB,qBAAqB,KAAK;AACrE,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE;AAAA,MACD;AACA,YAAM,UAAU,MAAM,KAAK,qBAAqB,kBAAkB,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,QAAQ,CAAA,GAAI;AAClH,iBAAW,UAAU,SAAS;AAC7B,2BAAmB,IAAI,OAAO,SAAS,EAAE;AAAA,MAC1C;AAAA,IACD;AACA,QAAI,mBAAmB,SAAS,GAAG;AAClC,aAAO,CAAA;AAAA,IACR;AAEA,UAAM,OAAO,MAAM,KAAK,cAAc;AAAA,MACrC,QAAQ;AAAA,MACR,EAAE,GAAG,QAAQ,aAAa,CAAC,GAAG,kBAAkB,EAAA;AAAA,MAChD,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AACD;"}

package/dist/development/src/resolvers/query/ProjectMembersQueryResolver.cjs

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 class ProjectMembersQueryResolver {
   constructor(projectManager, projectMemberManager) {

package/dist/development/src/resolvers/query/ProjectMembersQueryResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;;"}
+{"version":3,"file":"ProjectMembersQueryResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":["PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;;"}

package/dist/development/src/resolvers/query/ProjectMembersQueryResolver.js

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 class ProjectMembersQueryResolver {
   constructor(projectManager, projectMemberManager) {

package/dist/development/src/resolvers/query/ProjectMembersQueryResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;"}
+{"version":3,"file":"ProjectMembersQueryResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/query/ProjectMembersQueryResolver.ts"],"sourcesContent":["import { Membership, QueryProjectMembershipsArgs, QueryResolvers } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, ProjectManager, ProjectMemberManager } from '../../model/index.js'\n\nexport class ProjectMembersQueryResolver implements QueryResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t) {}\n\n\tasync projectMemberships(\n\t\tparent: unknown,\n\t\targs: QueryProjectMembershipsArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly Membership[]> {\n\t\tconst project = await this.projectManager.getProjectBySlug(context.db, args.projectSlug)\n\t\tconst projectScope = await context.permissionContext.createProjectScope(project)\n\t\tif (\n\t\t\t!project\n\t\t\t|| !(await context.isAllowed({\n\t\t\t\tscope: projectScope,\n\t\t\t\taction: PermissionActions.PROJECT_VIEW_MEMBER([]),\n\t\t\t}))\n\t\t) {\n\t\t\treturn []\n\t\t}\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\n\t\treturn await this.projectMemberManager.getAllProjectMemberships(context.db, { id: project.id }, { id: args.identityId }, verifier)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,4BAAsD;AAAA,EAClE,YACkB,gBACA,sBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,uBAAA;AAAA,EACf;AAAA,EAEH,MAAM,mBACL,QACA,MACA,SACiC;AACjC,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,KAAK,WAAW;AACvF,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO;AAC/E,QACC,CAAC,WACE,CAAE,MAAM,QAAQ,UAAU;AAAA,MAC5B,OAAO;AAAA,MACP,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE;AAAA,IAAA,CAChD,GACA;AACD,aAAO,CAAA;AAAA,IACR;AACA,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAE5E,WAAO,MAAM,KAAK,qBAAqB,yBAAyB,QAAQ,IAAI,EAAE,IAAI,QAAQ,GAAA,GAAM,EAAE,IAAI,KAAK,WAAA,GAAc,QAAQ;AAAA,EAClI;AACD;"}