@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisableApiKeyMutationResolver {

package/dist/development/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
+{"version":3,"file":"DisableApiKeyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts"],"sourcesContent":["import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ApiKeyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableApiKeyMutationResolver implements MutationResolvers {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disableApiKey(\n\t\tparent: any,\n\t\t{ id }: MutationDisableApiKeyArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<DisableApiKeyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.API_KEY_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable api key',\n\t\t})\n\n\t\tconst result = await this.apiKeyManager.disableApiKey(context.db, id)\n\n\t\tif (!result) {\n\t\t\treturn createErrorResponse('KEY_NOT_FOUND', 'API key not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'api_key_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { apiKeyId: id },\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,8BAA2D;AAAA,EACvE,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cACL,QACA,EAAE,GAAA,GACF,SACA,MACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,EAAE;AAEpE,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,iBAAiB,mBAAmB;AAAA,IAChE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,UAAU,GAAA;AAAA,IAAG,CAC1B;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}
+{"version":3,"file":"AuthPolicyMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;;"}

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class AuthPolicyMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}
+{"version":3,"file":"AuthPolicyMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts"],"sourcesContent":["import {\n\tAuthPolicyInput,\n\tCreateAuthPolicyResponse,\n\tDeleteAuthPolicyResponse,\n\tMutationCreateAuthPolicyArgs,\n\tMutationDeleteAuthPolicyArgs,\n\tMutationResolvers,\n\tMutationUpdateAuthPolicyArgs,\n\tUpdateAuthPolicyResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { AuthPolicyManager, PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\n/**\n * CRUD over `auth_policy` (per-role MFA / session policy). Gated like\n * `configure` (a tenant-wide admin action). Every mutation audits\n * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.\n */\nexport class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {\n\tconstructor(\n\t\tprivate readonly authPolicyManager: AuthPolicyManager,\n\t) {}\n\n\tasync createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'create',\n\t\t\t\tid: result.result.id,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true, result: { id: result.result.id } }\n\t}\n\n\tasync updateAuthPolicy(\n\t\tparent: any,\n\t\t{ id, policy }: MutationUpdateAuthPolicyArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<UpdateAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'update',\n\t\t\t\tid,\n\t\t\t\tpolicy: snapshotInput(policy),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tasync deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to manage auth policies',\n\t\t})\n\n\t\tconst result = await this.authPolicyManager.deletePolicy(context.db, id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'auth_policy_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\toperation: 'delete',\n\t\t\t\tid,\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n\n\tprivate mapInput(policy: AuthPolicyInput) {\n\t\treturn {\n\t\t\tscope: policy.scope,\n\t\t\tproject: policy.project ?? null,\n\t\t\troles: [...policy.roles],\n\t\t\tmfaRequired: policy.mfaRequired ?? null,\n\t\t\ttokenExpiration: policy.tokenExpiration ?? null,\n\t\t\tidleTimeout: policy.idleTimeout ?? null,\n\t\t\tgraceDuration: policy.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n\t\t}\n\t}\n}\n\nconst snapshotInput = (policy: AuthPolicyInput): JSONValue => ({\n\tscope: policy.scope,\n\tproject: policy.project ?? null,\n\troles: [...policy.roles],\n\tmfaRequired: policy.mfaRequired ?? null,\n\ttokenExpiration: policy.tokenExpiration ?? null,\n\tidleTimeout: policy.idleTimeout ?? null,\n\tmfaGraceDuration: policy.mfaGraceDuration ?? null,\n\trememberMeAllowed: policy.rememberMeAllowed ?? null,\n})\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqBO,MAAM,2BAA4H;AAAA,EACxI,YACkB,mBAChB;AADgB,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBAAiB,QAAa,EAAE,OAAA,GAAwC,SAAmE;AAChJ,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,KAAK,SAAS,MAAM,CAAC;AAC1F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX,IAAI,OAAO,OAAO;AAAA,QAClB,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,MAAM,QAAQ,EAAE,IAAI,OAAO,OAAO,KAAG;AAAA,EACnD;AAAA,EAEA,MAAM,iBACL,QACA,EAAE,IAAI,OAAA,GACN,SACoC;AACpC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,IAAI,KAAK,SAAS,MAAM,CAAC;AAC9F,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,QACA,QAAQ,cAAc,MAAM;AAAA,MAAA;AAAA,IAC7B,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,iBAAiB,QAAa,EAAE,GAAA,GAAoC,SAAmE;AAC5I,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,kBAAkB,aAAa,QAAQ,IAAI,EAAE;AACvE,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,WAAW;AAAA,QACX;AAAA,MAAA;AAAA,IACD,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEQ,SAAS,QAAyB;AACzC,WAAO;AAAA,MACN,OAAO,OAAO;AAAA,MACd,SAAS,OAAO,WAAW;AAAA,MAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,MACvB,aAAa,OAAO,eAAe;AAAA,MACnC,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,aAAa,OAAO,eAAe;AAAA,MACnC,eAAe,OAAO,oBAAoB;AAAA,MAC1C,mBAAmB,OAAO,qBAAqB;AAAA,IAAA;AAAA,EAEjD;AACD;AAEA,MAAM,gBAAgB,CAAC,YAAwC;AAAA,EAC9D,OAAO,OAAO;AAAA,EACd,SAAS,OAAO,WAAW;AAAA,EAC3B,OAAO,CAAC,GAAG,OAAO,KAAK;AAAA,EACvB,aAAa,OAAO,eAAe;AAAA,EACnC,iBAAiB,OAAO,mBAAmB;AAAA,EAC3C,aAAa,OAAO,eAAe;AAAA,EACnC,kBAAkB,OAAO,oBAAoB;AAAA,EAC7C,mBAAmB,OAAO,qBAAqB;AAChD;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}
+{"version":3,"file":"ConfigurationMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;;"}

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ConfigurationMutationResolver {

package/dist/development/src/resolvers/mutation/configuration/ConfigurationMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}
+{"version":3,"file":"ConfigurationMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts"],"sourcesContent":["import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'\nimport { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { JSONValue } from '@contember/schema'\n\nexport class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {\n\tconstructor(\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t) {\n\t}\n\n\tasync configure(parent: any, { config }: MutationConfigureArgs, context: TenantResolverContext): Promise<ConfigureResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.CONFIGURE,\n\t\t\tmessage: 'You are not allowed to configure',\n\t\t})\n\n\t\tconst result = await this.configurationManager.updateConfiguration(context.db, config)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'tenant_config_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tinput: redactConfigInput(config),\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n\n/**\n * Strip secret-bearing fields from a ConfigInput before it lands in the\n * persistent audit trail. The mere fact that captcha.secret was set is\n * useful forensics; the value never is.\n */\nconst redactConfigInput = (input: ConfigInput): JSONValue => {\n\tconst out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }\n\tif (input.captcha) {\n\t\tout.captcha = {\n\t\t\t...(input.captcha as unknown as Record<string, JSONValue>),\n\t\t\tsecret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''\n\t\t\t\t? '***'\n\t\t\t\t: input.captcha.secret ?? null,\n\t\t}\n\t}\n\treturn out as JSONValue\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,8BAA8E;AAAA,EAC1F,YACkB,sBAChB;AADgB,SAAA,uBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,QAAa,EAAE,OAAA,GAAiC,SAA4D;AAC3H,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,QAAQ,IAAI,MAAM;AAErF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,OAAO,kBAAkB,MAAM;AAAA,MAAA;AAAA,IAChC,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;AAOA,MAAM,oBAAoB,CAAC,UAAkC;AAC5D,QAAM,MAAiC,EAAE,GAAI,MAAA;AAC7C,MAAI,MAAM,SAAS;AAClB,QAAI,UAAU;AAAA,MACb,GAAI,MAAM;AAAA,MACV,QAAQ,MAAM,QAAQ,WAAW,QAAQ,MAAM,QAAQ,WAAW,UAAa,MAAM,QAAQ,WAAW,KACrG,QACA,MAAM,QAAQ,UAAU;AAAA,IAAA;AAAA,EAE7B;AACA,SAAO;AACR;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs

@@ -14,6 +14,8 @@ const PersonByIdentityBatchQuery = require("../../../model/queries/person/Person
 const IdentityQuery = require("../../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class IdentityGlobalRolesMutationResolver {

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}
+{"version":3,"file":"GlobalRolesMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":["PermissionActions","IdentityQuery","createErrorResponse","PersonByIdentityBatchQuery","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQF,kBAAAA,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,cAAAA,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIE,2BAAAA,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;;"}

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js

@@ -12,6 +12,8 @@ import { PersonByIdentityBatchQuery } from "../../../model/queries/person/Person
 import { IdentityQuery } from "../../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class IdentityGlobalRolesMutationResolver {

package/dist/development/src/resolvers/mutation/identity/GlobalRolesMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}
+{"version":3,"file":"GlobalRolesMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts"],"sourcesContent":["import {\n\tAddGlobalIdentityRolesResponse,\n\tMutationAddGlobalIdentityRolesArgs,\n\tMutationRemoveGlobalIdentityRolesArgs,\n\tMutationResolvers,\n\tRemoveGlobalIdentityRolesResponse,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, RolesManager } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'\nimport { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class IdentityGlobalRolesMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly rolesManager: RolesManager,\n\t) {\n\t}\n\n\tasync addGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationAddGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<AddGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to add global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tasync removeGlobalIdentityRoles(\n\t\tparent: any,\n\t\t{ roles, identityId }: MutationRemoveGlobalIdentityRolesArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<RemoveGlobalIdentityRolesResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),\n\t\t\tmessage: 'You are not allowed to remove global roles',\n\t\t})\n\n\t\tconst [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\tresult: {\n\t\t\t\tidentity: { id: identityId, projects: [], sessions: [] },\n\t\t\t},\n\t\t}\n\t}\n\n\tprivate async logRolesChange(\n\t\tcontext: TenantResolverContext,\n\t\tidentityId: string,\n\t\tauditType: 'global_role_grant' | 'global_role_revoke',\n\t\tbeforeRoles: readonly string[],\n\t): Promise<void> {\n\t\tconst [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))\n\t\tawait context.logAuthAction({\n\t\t\ttype: auditType,\n\t\t\tresponse: new ResponseOk(null),\n\t\t\ttargetPersonId: targetPerson?.id,\n\t\t\teventData: {\n\t\t\t\tbefore: { roles: beforeRoles },\n\t\t\t\tafter: { roles: after?.roles ?? [] },\n\t\t\t},\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAeO,MAAM,oCAAiE;AAAA,EAC7E,YACkB,cAChB;AADgB,SAAA,eAAA;AAAA,EAElB;AAAA,EAEA,MAAM,uBACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC0C;AAC1C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,0BAA0B,KAAK;AAAA,MACzD,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,eAAe,QAAQ,IAAI,YAAY,KAAK;AAEnF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,qBAAqB,QAAQ,SAAS,EAAE;AAEvF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAM,0BACL,QACA,EAAE,OAAO,WAAA,GACT,SACA,MAC6C;AAC7C,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,6BAA6B,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,CAAC,MAAM,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACpF,UAAM,SAAS,MAAM,KAAK,aAAa,kBAAkB,QAAQ,IAAI,YAAY,KAAK;AAEtF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,KAAK,eAAe,SAAS,YAAY,sBAAsB,QAAQ,SAAS,EAAE;AAExF,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ;AAAA,QACP,UAAU,EAAE,IAAI,YAAY,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,MAAE;AAAA,IACxD;AAAA,EAEF;AAAA,EAEA,MAAc,eACb,SACA,YACA,WACA,aACgB;AAChB,UAAM,CAAC,KAAK,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACnF,UAAM,CAAC,YAAY,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,CAAC;AACvG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,gBAAgB,cAAc;AAAA,MAC9B,WAAW;AAAA,QACV,QAAQ,EAAE,OAAO,YAAA;AAAA,QACjB,OAAO,EAAE,OAAO,OAAO,SAAS,CAAA,EAAC;AAAA,MAAE;AAAA,IACpC,CACA;AAAA,EACF;AACD;"}

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const audit = require("./audit.cjs");
@@ -42,7 +43,8 @@ class AddIDPMutationResolver {
         exclusive: args.options?.exclusive ?? false,
         initReturnsConfig: args.options?.initReturnsConfig ?? false,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false
       }
     });
     if (!result.ok) {

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","IdentityProviderBySlugQuery","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAOC,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"AddIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","IdentityProviderBySlugQuery","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAOC,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.js

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { idpRowToAuditSnapshot } from "./audit.js";
@@ -40,7 +41,8 @@ class AddIDPMutationResolver {
         exclusive: args.options?.exclusive ?? false,
         initReturnsConfig: args.options?.initReturnsConfig ?? false,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? false
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false
       }
     });
     if (!result.ok) {

package/dist/development/src/resolvers/mutation/idp/AddIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,IAC3D,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"AddIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/AddIDPMutationResolver.ts"],"sourcesContent":["import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class AddIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync addIDP(parent: unknown, args: MutationAddIdpArgs, context: TenantResolverContext): Promise<AddIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ADD,\n\t\t\tmessage: 'You are not allowed to add IDP',\n\t\t})\n\t\tconst result = await this.idpManager.addIDP(context.db, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\tslug: args.identityProvider,\n\t\t\ttype: args.type,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? false,\n\t\t\t\texclusive: args.options?.exclusive ?? false,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? false,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? false,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,\n\t\t\t},\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_create',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: null,\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,uBAAoD;AAAA,EAChE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,OAAO,QAAiB,MAA0B,SAAyD;AAChH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,OAAO,QAAQ,IAAI;AAAA,MACvD,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,CACA;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ;AAAA,QACR,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisableIDPMutationResolver {

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"DisableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisableIDPMutationResolver {

package/dist/development/src/resolvers/mutation/idp/DisableIDPMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"DisableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts"],"sourcesContent":["import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync disableIDP(parent: any, args: MutationDisableIdpArgs, context: TenantResolverContext): Promise<DisableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_DISABLE,\n\t\t\tmessage: 'You are not allowed to disable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.disableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAOO,MAAM,2BAAwD;AAAA,EACpE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,WAAW,QAAa,MAA8B,SAA6D;AACxH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,WAAW,QAAQ,IAAI,KAAK,gBAAgB;AACjF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.cjs

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisconnectMyIdentityProviderMutationResolver {

package/dist/development/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","PersonQuery","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMC,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAOA,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.js

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisconnectMyIdentityProviderMutationResolver {

package/dist/development/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"DisconnectMyIdentityProviderMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts"],"sourcesContent":["import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'\nimport { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync disconnectMyIdentityProvider(\n\t\tparent: unknown,\n\t\targs: MutationDisconnectMyIdentityProviderArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisconnectIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISCONNECT_MY_IDP,\n\t\t\tmessage: 'You are not allowed to disconnect your identity provider',\n\t\t})\n\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')\n\t\t}\n\n\t\tconst result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_disconnect',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\tpersonId: person.id,\n\t\t\teventData: { id: args.id, slug: result.result.slug },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,6CAAgH;AAAA,EAC5H,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,6BACL,QACA,MACA,SACiC;AACjC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,oDAAoD;AAAA,IAChG;AAEA,UAAM,SAAS,MAAM,KAAK,8BAA8B,2BAA2B,QAAQ,IAAI,QAAQ,KAAK,EAAE;AAC9G,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,UAAU,OAAO;AAAA,MACjB,WAAW,EAAE,IAAI,KAAK,IAAI,MAAM,OAAO,OAAO,KAAA;AAAA,IAAK,CACnD;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/EnableIDPMutationResolver.cjs

@@ -12,6 +12,8 @@ const Response = require("../../../model/utils/Response.cjs");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class EnableIDPMutationResolver {

package/dist/development/src/resolvers/mutation/idp/EnableIDPMutationResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EnableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"EnableIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/EnableIDPMutationResolver.js

@@ -10,6 +10,8 @@ import { ResponseOk } from "../../../model/utils/Response.js";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class EnableIDPMutationResolver {