npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.3 → 2.2.0-alpha.6 - Mend

@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1316) hide show

package/dist/development/src/resolvers/mutation/idp/EnableIDPMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"EnableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;~~AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"EnableIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts"],"sourcesContent":["import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class EnableIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync enableIDP(parent: any, args: MutationEnableIdpArgs, context: TenantResolverContext): Promise<EnableIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_ENABLE,\n\t\t\tmessage: 'You are not allowed to enable IDP',\n\t\t})\n\t\tconst result = await this.idpManager.enableIDP(context.db, args.identityProvider)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_enable',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: { slug: args.identityProvider },\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,gBAAgB;AAChF,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW,EAAE,MAAM,KAAK,iBAAA;AAAA,IAAiB,CACzC;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/UpdateIDPMutationResolver.cjs CHANGED Viewed

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const IdentityProviderBySlugQuery = require("../../../model/queries/idp/IdentityProviderBySlugQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 const audit = require("./audit.cjs");
@@ -42,7 +43,8 @@ class UpdateIDPMutationResolver {
         exclusive: args.options?.exclusive ?? void 0,
         initReturnsConfig: args.options?.initReturnsConfig ?? void 0,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? void 0,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? void 0
       }
     }, args.mergeConfiguration ?? false);
     if (!result.ok) {

package/dist/development/src/resolvers/mutation/idp/UpdateIDPMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UpdateIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","IdentityProviderBySlugQuery","createErrorResponse","ResponseOk","idpRowToAuditSnapshot"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;~~AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,~~IAC3D~~,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQC,MAAAA,sBAAsB,MAAM;AAAA,QACpC,OAAOA,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
1	+ {"version":3,"file":"UpdateIDPMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PermissionActions","IdentityProviderBySlugQuery","createErrorResponse","ResponseOk","idpRowToAuditSnapshot"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAID,4BAAAA,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQC,MAAAA,sBAAsB,MAAM;AAAA,QACpC,OAAOA,MAAAA,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/idp/UpdateIDPMutationResolver.js CHANGED Viewed

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { IdentityProviderBySlugQuery } from "../../../model/queries/idp/IdentityProviderBySlugQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 import { idpRowToAuditSnapshot } from "./audit.js";
@@ -40,7 +41,8 @@ class UpdateIDPMutationResolver {
         exclusive: args.options?.exclusive ?? void 0,
         initReturnsConfig: args.options?.initReturnsConfig ?? void 0,
         requireVerifiedEmail: args.options?.requireVerifiedEmail ?? void 0,
-        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0
+        assumeEmailVerified: args.options?.assumeEmailVerified ?? void 0,
+        disableLocalAuthentication: args.options?.disableLocalAuthentication ?? void 0
       }
     }, args.mergeConfiguration ?? false);
     if (!result.ok) {

package/dist/development/src/resolvers/mutation/idp/UpdateIDPMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UpdateIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;~~AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,MAAA;AAAA,~~IAC3D~~,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ,sBAAsB,MAAM;AAAA,QACpC,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"UpdateIDPMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts"],"sourcesContent":["import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'\nimport { PermissionActions } from '../../../model/index.js'\nimport { IDPManager } from '../../../model/service/idp/IDPManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\nimport { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'\nimport { idpRowToAuditSnapshot } from './audit.js'\n\nexport class UpdateIDPMutationResolver implements MutationResolvers {\n\tconstructor(private readonly idpManager: IDPManager) {\n\t}\n\n\tasync updateIDP(parent: any, args: MutationUpdateIdpArgs, context: TenantResolverContext): Promise<UpdateIdpResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.IDP_UPDATE,\n\t\t\tmessage: 'You are not allowed to update IDP',\n\t\t})\n\t\tconst before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tconst result = await this.idpManager.updateIDP(context.db, args.identityProvider, {\n\t\t\tconfiguration: args.configuration as any,\n\t\t\ttype: args.type ?? undefined,\n\t\t\toptions: {\n\t\t\t\tautoSignUp: args.options?.autoSignUp ?? undefined,\n\t\t\t\texclusive: args.options?.exclusive ?? undefined,\n\t\t\t\tinitReturnsConfig: args.options?.initReturnsConfig ?? undefined,\n\t\t\t\trequireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,\n\t\t\t\tassumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,\n\t\t\t\tdisableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,\n\t\t\t},\n\t\t}, args.mergeConfiguration ?? false)\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\tconst after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'idp_update',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\tslug: args.identityProvider,\n\t\t\t\tbefore: idpRowToAuditSnapshot(before),\n\t\t\t\tafter: idpRowToAuditSnapshot(after),\n\t\t\t},\n\t\t})\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,0BAAuD;AAAA,EACnE,YAA6B,YAAwB;AAAxB,SAAA,aAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,UAAU,QAAa,MAA6B,SAA4D;AACrH,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACzG,UAAM,SAAS,MAAM,KAAK,WAAW,UAAU,QAAQ,IAAI,KAAK,kBAAkB;AAAA,MACjF,eAAe,KAAK;AAAA,MACpB,MAAM,KAAK,QAAQ;AAAA,MACnB,SAAS;AAAA,QACR,YAAY,KAAK,SAAS,cAAc;AAAA,QACxC,WAAW,KAAK,SAAS,aAAa;AAAA,QACtC,mBAAmB,KAAK,SAAS,qBAAqB;AAAA,QACtD,sBAAsB,KAAK,SAAS,wBAAwB;AAAA,QAC5D,qBAAqB,KAAK,SAAS,uBAAuB;AAAA,QAC1D,4BAA4B,KAAK,SAAS,8BAA8B;AAAA,MAAA;AAAA,IACzE,GACE,KAAK,sBAAsB,KAAK;AACnC,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,UAAM,QAAQ,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,4BAA4B,KAAK,gBAAgB,CAAC;AACxG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,MAAM,KAAK;AAAA,QACX,QAAQ,sBAAsB,MAAM;AAAA,QACpC,OAAO,sBAAsB,KAAK;AAAA,MAAA;AAAA,IACnC,CACA;AAED,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/idp/audit.cjs CHANGED Viewed

@@ -13,6 +13,7 @@ const idpRowToAuditSnapshot = (row) => {
     initReturnsConfig: row.initReturnsConfig,
     requireVerifiedEmail: row.requireVerifiedEmail,
     assumeEmailVerified: row.assumeEmailVerified,
+    disableLocalAuthentication: row.disableLocalAuthentication,
     configurationKeys: Object.keys(row.configuration).sort()
   };
 };

package/dist/development/src/resolvers/mutation/idp/audit.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow \| null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;;"}
1	+ {"version":3,"file":"audit.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow \| null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tdisableLocalAuthentication: row.disableLocalAuthentication,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,4BAA4B,IAAI;AAAA,IAChC,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;;"}

package/dist/development/src/resolvers/mutation/idp/audit.js CHANGED Viewed

@@ -11,6 +11,7 @@ const idpRowToAuditSnapshot = (row) => {
     initReturnsConfig: row.initReturnsConfig,
     requireVerifiedEmail: row.requireVerifiedEmail,
     assumeEmailVerified: row.assumeEmailVerified,
+    disableLocalAuthentication: row.disableLocalAuthentication,
     configurationKeys: Object.keys(row.configuration).sort()
   };
 };

package/dist/development/src/resolvers/mutation/idp/audit.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"audit.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow \| null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;"}
1	+ {"version":3,"file":"audit.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/idp/audit.ts"],"sourcesContent":["import { JSONValue } from '@contember/schema'\nimport { IdentityProviderRow } from '../../../model/queries/idp/types.js'\n\nexport const idpRowToAuditSnapshot = (row: IdentityProviderRow \| null): JSONValue => {\n\tif (!row) {\n\t\treturn null\n\t}\n\treturn {\n\t\tslug: row.slug,\n\t\ttype: row.type,\n\t\tdisabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,\n\t\tautoSignUp: row.autoSignUp,\n\t\texclusive: row.exclusive,\n\t\tinitReturnsConfig: row.initReturnsConfig,\n\t\trequireVerifiedEmail: row.requireVerifiedEmail,\n\t\tassumeEmailVerified: row.assumeEmailVerified,\n\t\tdisableLocalAuthentication: row.disableLocalAuthentication,\n\t\tconfigurationKeys: Object.keys(row.configuration).sort(),\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,wBAAwB,CAAC,QAA+C;AACpF,MAAI,CAAC,KAAK;AACT,WAAO;AAAA,EACR;AACA,SAAO;AAAA,IACN,MAAM,IAAI;AAAA,IACV,MAAM,IAAI;AAAA,IACV,YAAY,IAAI,aAAa,IAAI,WAAW,gBAAgB;AAAA,IAC5D,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,mBAAmB,IAAI;AAAA,IACvB,sBAAsB,IAAI;AAAA,IAC1B,qBAAqB,IAAI;AAAA,IACzB,4BAA4B,IAAI;AAAA,IAChC,mBAAmB,OAAO,KAAK,IAAI,aAAa,EAAE,KAAA;AAAA,EAAK;AAEzD;"}

package/dist/development/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.cjs CHANGED Viewed

@@ -14,6 +14,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const type = require("../../../model/mailing/type.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -21,7 +23,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class MailTemplateMutationResolver {

package/dist/development/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MailTemplateMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() \|\| null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["type","PermissionActions","createProjectNotFoundResponse","validateEmail","createErrorResponse","mailTypeFromSchemaToDb","ResponseOk"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAA,MAASA,QAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAACC,oBAAc,OAAO,GAAG;AACvC,aAAOC,WAAAA,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAMC,KAAAA,uBAAuBL,MAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIM,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAA,MAAaA,QAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAMG,KAAAA,uBAAuBL,MAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAOI,WAAAA,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}
1	+ {"version":3,"file":"MailTemplateMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() \|\| null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":["type","PermissionActions","createProjectNotFoundResponse","validateEmail","createErrorResponse","mailTypeFromSchemaToDb","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAA,MAASA,QAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAACC,oBAAc,OAAO,GAAG;AACvC,aAAOC,WAAAA,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAMC,KAAAA,uBAAuBL,MAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIM,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAA,MAAaA,QAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQC,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAOC,WAAAA,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAMG,KAAAA,uBAAuBL,MAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAOI,WAAAA,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAIE,SAAAA,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAUN;AAAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;;"}

package/dist/development/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js CHANGED Viewed

@@ -12,6 +12,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { mailTypeFromSchemaToDb } from "../../../model/mailing/type.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -19,7 +21,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createProjectNotFoundResponse, createErrorResponse } from "../../errorUtils.js";
 class MailTemplateMutationResolver {

package/dist/development/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"MailTemplateMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() \|\| null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;~~AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAS,MAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAAC,cAAc,OAAO,GAAG;AACvC,aAAO,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAa,MAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAO,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}
1	+ {"version":3,"file":"MailTemplateMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/mailTemplates/MailTemplateMutationResolver.ts"],"sourcesContent":["import {\n\tAddMailTemplateResponse,\n\tMutationAddProjectMailTemplateArgs,\n\tMutationRemoveProjectMailTemplateArgs,\n\tMutationResolvers,\n\tRemoveMailTemplateResponse,\n} from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { MailTemplateManager, mailTypeFromSchemaToDb, PermissionActions, ProjectManager } from '../../../model/index.js'\nimport { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'\nimport { validateEmail } from '../../../model/utils/email.js'\nimport { ResponseOk } from '../../../model/utils/Response.js'\n\nexport class MailTemplateMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly mailTemplateManager: MailTemplateManager,\n\t) {}\n\n\tasync addMailTemplate(\n\t\tparent: any,\n\t\t{ template: { content, projectSlug, subject, type, useLayout, variant, replyTo } }: MutationAddProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<AddMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_ADD,\n\t\t\tmessage: 'You are not allowed to add a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\t\tif (replyTo && !validateEmail(replyTo)) {\n\t\t\treturn createErrorResponse('INVALID_REPLY_EMAIL_FORMAT', 'Reply-to email address is not in a valid format')\n\t\t}\n\n\t\tawait this.mailTemplateManager.addMailTemplate(context.db, {\n\t\t\tcontent,\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tsubject,\n\t\t\tuseLayout: typeof useLayout === 'boolean' ? useLayout : true,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t\treplyTo: replyTo?.trim() \|\| null,\n\t\t})\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'add',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n\n\tasync removeMailTemplate(\n\t\tparent: any,\n\t\t{ templateIdentifier: { projectSlug, type, variant } }: MutationRemoveProjectMailTemplateArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<RemoveMailTemplateResponse> {\n\t\tconst project = projectSlug ? await this.projectManager.getProjectBySlug(context.db, projectSlug) : null\n\t\tawait context.requireAccess({\n\t\t\tscope: project ? await context.permissionContext.createProjectScope(project) : undefined,\n\t\t\taction: PermissionActions.MAIL_TEMPLATE_REMOVE,\n\t\t\tmessage: 'You are not allowed to remove a mail template',\n\t\t})\n\t\tif (projectSlug && !project) {\n\t\t\treturn createProjectNotFoundResponse('PROJECT_NOT_FOUND', projectSlug)\n\t\t}\n\n\t\tconst removed = await this.mailTemplateManager.removeMailTemplate(context.db, {\n\t\t\tprojectId: project?.id ?? null,\n\t\t\tvariant: variant \|\| '',\n\t\t\ttype: mailTypeFromSchemaToDb(type),\n\t\t})\n\t\tif (!removed) {\n\t\t\treturn createErrorResponse('PROJECT_NOT_FOUND', 'Mail template not found')\n\t\t}\n\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'mail_template_change',\n\t\t\tresponse: new ResponseOk(null),\n\t\t\teventData: {\n\t\t\t\taction: 'remove',\n\t\t\t\tprojectSlug: project?.slug ?? null,\n\t\t\t\tmailType: type,\n\t\t\t\tvariant: variant \|\| '',\n\t\t\t},\n\t\t})\n\n\t\treturn {\n\t\t\tok: true,\n\t\t\terrors: [],\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAaO,MAAM,6BAA0D;AAAA,EACtE,YACkB,gBACA,qBAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,sBAAA;AAAA,EACf;AAAA,EAEH,MAAM,gBACL,QACA,EAAE,UAAU,EAAE,SAAS,aAAa,SAAS,MAAM,WAAW,SAAS,QAAA,EAAQ,GAC/E,SACmC;AACnC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AACA,QAAI,WAAW,CAAC,cAAc,OAAO,GAAG;AACvC,aAAO,oBAAoB,8BAA8B,iDAAiD;AAAA,IAC3G;AAEA,UAAM,KAAK,oBAAoB,gBAAgB,QAAQ,IAAI;AAAA,MAC1D;AAAA,MACA,WAAW,SAAS,MAAM;AAAA,MAC1B;AAAA,MACA,WAAW,OAAO,cAAc,YAAY,YAAY;AAAA,MACxD,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,MACjC,SAAS,SAAS,UAAU;AAAA,IAAA,CAC5B;AAED,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AAAA,EAEA,MAAM,mBACL,QACA,EAAE,oBAAoB,EAAE,aAAa,MAAM,UAAQ,GACnD,SACsC;AACtC,UAAM,UAAU,cAAc,MAAM,KAAK,eAAe,iBAAiB,QAAQ,IAAI,WAAW,IAAI;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,UAAU,MAAM,QAAQ,kBAAkB,mBAAmB,OAAO,IAAI;AAAA,MAC/E,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,QAAI,eAAe,CAAC,SAAS;AAC5B,aAAO,8BAA8B,qBAAqB,WAAW;AAAA,IACtE;AAEA,UAAM,UAAU,MAAM,KAAK,oBAAoB,mBAAmB,QAAQ,IAAI;AAAA,MAC7E,WAAW,SAAS,MAAM;AAAA,MAC1B,SAAS,WAAW;AAAA,MACpB,MAAM,uBAAuB,IAAI;AAAA,IAAA,CACjC;AACD,QAAI,CAAC,SAAS;AACb,aAAO,oBAAoB,qBAAqB,yBAAyB;AAAA,IAC1E;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU,IAAI,WAAW,IAAI;AAAA,MAC7B,WAAW;AAAA,QACV,QAAQ;AAAA,QACR,aAAa,SAAS,QAAQ;AAAA,QAC9B,UAAU;AAAA,QACV,SAAS,WAAW;AAAA,MAAA;AAAA,IACrB,CACA;AAED,WAAO;AAAA,MACN,IAAI;AAAA,MACJ,QAAQ,CAAA;AAAA,IAAC;AAAA,EAEX;AACD;"}

package/dist/development/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs CHANGED Viewed

@@ -13,6 +13,8 @@ require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -20,7 +22,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ChangePasswordMutationResolver {

package/dist/development/src/resolvers/mutation/person/ChangePasswordMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ChangePasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;~~AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
1	+ {"version":3,"file":"ChangePasswordMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAOF,WAAAA,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ChangePasswordMutationResolver.js CHANGED Viewed

@@ -11,6 +11,8 @@ import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +20,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ChangePasswordMutationResolver {

package/dist/development/src/resolvers/mutation/person/ChangePasswordMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ChangePasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;~~AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"ChangePasswordMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyPasswordResponse,\n\tChangePasswordResponse,\n\tMutationChangeMyPasswordArgs,\n\tMutationChangePasswordArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { IdentityScope, PasswordChangeManager, PermissionActions, PersonQuery } from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class ChangePasswordMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly passwordChangeManager: PasswordChangeManager,\n\t) {}\n\n\tasync changePassword(\n\t\tparent: unknown,\n\t\targs: MutationChangePasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangePasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changePassword(context.db, person, args.password)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true, errors: [] }\n\t}\n\n\tasync changeMyPassword(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyPasswordArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyPasswordResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a password')\n\t\t}\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PASSWORD,\n\t\t\tmessage: 'You are not allowed to change password',\n\t\t})\n\t\tconst response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'password_change',\n\t\t\tresponse: response,\n\t\t\tpersonId: person.id,\n\t\t})\n\n\t\tif (!response.ok) {\n\t\t\treturn createErrorResponse(response)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAYO,MAAM,+BAA4D;AAAA,EACxE,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,QACA,MACA,SACA,MACkC;AAClC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,uBAAuB,OAAO,KAAK;AAAA,MAC7D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,eAAe,QAAQ,IAAI,QAAQ,KAAK,QAAQ;AAClG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,MAAM,QAAQ,CAAA,EAAC;AAAA,EAC7B;AAAA,EAEA,MAAM,iBACL,QACA,MACA,SACA,MACoC;AACpC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,iBAAiB,QAAQ,IAAI,QAAQ,KAAK,iBAAiB,KAAK,WAAW;AAC7H,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN;AAAA,MACA,UAAU,OAAO;AAAA,IAAA,CACjB;AAED,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO,oBAAoB,QAAQ;AAAA,IACpC;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs CHANGED Viewed

@@ -15,6 +15,8 @@ const ConfigurationQuery = require("../../../model/queries/configuration/Configu
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,7 +24,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class ChangeProfileMutationResolver {

package/dist/development/src/resolvers/mutation/person/ChangeProfileMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ChangeProfileMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' \| 'changeProfile' \| 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification \|\| person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions","ConfigurationQuery","normalizeEmail","result"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMC,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAOL,WAAAA,oBAAoBK,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOL,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}
1	+ {"version":3,"file":"ChangeProfileMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' \| 'changeProfile' \| 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification \|\| person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["PersonQuery","createErrorResponse","IdentityScope","PermissionActions","ConfigurationQuery","normalizeEmail","result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMA,YAAAA,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAIC,cAAAA,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQC,kBAAAA,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAMD,YAAAA,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAOC,WAAAA,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAOA,WAAAA,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,sCAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMC,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAOL,WAAAA,oBAAoBK,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAOL,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQE,kBAAAA,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOF,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/resolvers/mutation/person/ChangeProfileMutationResolver.js CHANGED Viewed

@@ -13,6 +13,8 @@ import { ConfigurationQuery } from "../../../model/queries/configuration/Configu
 import { PersonQuery } from "../../../model/queries/person/PersonQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,7 +22,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class ChangeProfileMutationResolver {

package/dist/development/src/resolvers/mutation/person/ChangeProfileMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' \| 'changeProfile' \| 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification \|\| person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["result"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;~~AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQ,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMA,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAO,oBAAoBA,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}
1	+ {"version":3,"file":"ChangeProfileMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts"],"sourcesContent":["import {\n\tChangeMyProfileResponse,\n\tChangeProfileResponse,\n\tConfirmEmailChangeResponse,\n\tMutationChangeMyProfileArgs,\n\tMutationChangeProfileArgs,\n\tMutationConfirmEmailChangeArgs,\n\tMutationResolvers,\n} from '../../../schema/index.js'\nimport { GraphQLResolveInfo } from 'graphql'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport {\n\tConfigurationQuery,\n\tEmailChangeManager,\n\tIdentityScope,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonManager,\n\tPersonQuery,\n} from '../../../model/index.js'\nimport { createErrorResponse } from '../../errorUtils.js'\nimport { normalizeEmail } from '../../../model/utils/email.js'\n\nexport class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' \| 'changeProfile' \| 'confirmEmailChange'> {\n\tconstructor(\n\t\tprivate readonly personManager: PersonManager,\n\t\tprivate readonly emailChangeManager: EmailChangeManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\tasync changeProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byId(args.personId))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('PERSON_NOT_FOUND', 'Person not found')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\tscope: new IdentityScope(person.identity_id),\n\t\t\taction: PermissionActions.PERSON_CHANGE_PROFILE(person.roles),\n\t\t\tmessage: 'You are not allowed to change a profile',\n\t\t})\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync changeMyProfile(\n\t\tparent: unknown,\n\t\targs: MutationChangeMyProfileArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ChangeMyProfileResponse> {\n\t\tconst person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))\n\t\tif (!person) {\n\t\t\treturn createErrorResponse('NOT_A_PERSON', 'Only a person can change a profile.')\n\t\t}\n\t\tif (args.email === null) {\n\t\t\treturn createErrorResponse('INVALID_EMAIL_FORMAT', 'E-mail address cannot be null.')\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_CHANGE_MY_PROFILE,\n\t\t\tmessage: 'You are not allowed to change profile',\n\t\t})\n\n\t\tconst config = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\t// Compare normalized: a resubmit that only differs in casing/whitespace is\n\t\t// not a real change and must not trigger a confirmation mail.\n\t\tconst normalizedNewEmail = args.email ? normalizeEmail(args.email) : null\n\t\tconst emailChanging = normalizedNewEmail !== null && normalizedNewEmail !== person.email\n\n\t\t// When e-mail-change verification applies, an e-mail change is not\n\t\t// applied immediately: it goes through confirmEmailChange against a token\n\t\t// mailed to the new address (the old address stays active until then). The\n\t\t// name change (if any) is applied atomically with the token —\n\t\t// validation/rate-limiting run first, so a rejected e-mail never leaves a\n\t\t// half-applied profile.\n\t\t//\n\t\t// This fires when EITHER the tenant opts in via require_email_change_verification,\n\t\t// OR this account is already subject to verification (email_verification_required,\n\t\t// set when it signed up while signup verification was on). The latter is what\n\t\t// keeps the \"email_verified_at implies THIS address was proven\" invariant intact:\n\t\t// without it, a verification-required account could swap to an arbitrary address\n\t\t// via the direct path and inherit the old verified status, defeating the sign-in\n\t\t// gate. signup verification ⇒ change verification, regardless of the change flag.\n\t\tif (emailChanging && (config.emailChange.requireVerification \|\| person.email_verification_required)) {\n\t\t\tconst permissionContext = await this.permissionContextFactory.create(context.db, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst result = await this.emailChangeManager.requestEmailChange(\n\t\t\t\tcontext.db,\n\t\t\t\tpermissionContext,\n\t\t\t\tperson,\n\t\t\t\tnormalizedNewEmail,\n\t\t\t\t{},\n\t\t\t\targs.name !== undefined\n\t\t\t\t\t? async db => {\n\t\t\t\t\t\tawait this.personManager.changeProfile(db, person, { name: args.name === '' ? null : args.name })\n\t\t\t\t\t}\n\t\t\t\t\t: undefined,\n\t\t\t)\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change_init',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t\t// Log the normalized address so it matches the per-recipient backoff key.\n\t\t\t\tpersonInput: normalizedNewEmail,\n\t\t\t})\n\t\t\tif (!result.ok) {\n\t\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t\t}\n\t\t\treturn { ok: true }\n\t\t}\n\n\t\tconst result = await this.personManager.changeProfile(context.db, person, {\n\t\t\temail: args.email,\n\t\t\tname: args.name === '' ? null : args.name,\n\t\t})\n\t\tif (args.email) {\n\t\t\tawait context.logAuthAction({\n\t\t\t\ttype: 'email_change',\n\t\t\t\tresponse: result,\n\t\t\t\tpersonId: person.id,\n\t\t\t})\n\t\t}\n\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn { ok: true }\n\t}\n\n\tasync confirmEmailChange(\n\t\tparent: unknown,\n\t\targs: MutationConfirmEmailChangeArgs,\n\t\tcontext: TenantResolverContext,\n\t\tinfo: GraphQLResolveInfo,\n\t): Promise<ConfirmEmailChangeResponse> {\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_RESET_PASSWORD,\n\t\t\tmessage: 'You are not allowed to confirm an e-mail change',\n\t\t})\n\n\t\tconst result = await this.emailChangeManager.confirmEmailChange(context.db, args.token)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'email_change_complete',\n\t\t\t// personId/tokenId ride along in the AuthLog bag on both success and\n\t\t\t// the uniqueness/validation failure paths (see EmailChangeManager).\n\t\t\tresponse: result,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\t\treturn { ok: true }\n\t}\n}\n"],"names":["result"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAuBO,MAAM,8BAA6H;AAAA,EACzI,YACkB,eACA,oBACA,0BAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACA,MACiC;AACjC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,KAAK,KAAK,QAAQ,CAAC;AAClF,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,oBAAoB,kBAAkB;AAAA,IAClE;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,OAAO,IAAI,cAAc,OAAO,WAAW;AAAA,MAC3C,QAAQ,kBAAkB,sBAAsB,OAAO,KAAK;AAAA,MAC5D,SAAS;AAAA,IAAA,CACT;AACD,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,MAAA,CACV;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,gBACL,QACA,MACA,SACA,MACmC;AACnC,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,YAAY,WAAW,QAAQ,SAAS,EAAE,CAAC;AAC9F,QAAI,CAAC,QAAQ;AACZ,aAAO,oBAAoB,gBAAgB,qCAAqC;AAAA,IACjF;AACA,QAAI,KAAK,UAAU,MAAM;AACxB,aAAO,oBAAoB,wBAAwB,gCAAgC;AAAA,IACpF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAG/F,UAAM,qBAAqB,KAAK,QAAQ,eAAe,KAAK,KAAK,IAAI;AACrE,UAAM,gBAAgB,uBAAuB,QAAQ,uBAAuB,OAAO;AAgBnF,QAAI,kBAAkB,OAAO,YAAY,uBAAuB,OAAO,8BAA8B;AACpG,YAAM,oBAAoB,MAAM,KAAK,yBAAyB,OAAO,QAAQ,IAAI;AAAA,QAChF,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAMA,UAAS,MAAM,KAAK,mBAAmB;AAAA,QAC5C,QAAQ;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA,CAAA;AAAA,QACA,KAAK,SAAS,SACX,OAAM,OAAM;AACb,gBAAM,KAAK,cAAc,cAAc,IAAI,QAAQ,EAAE,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK,MAAM;AAAA,QACjG,IACE;AAAA,MAAA;AAEJ,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAUA;AAAAA,QACV,UAAU,OAAO;AAAA;AAAA,QAEjB,aAAa;AAAA,MAAA,CACb;AACD,UAAI,CAACA,QAAO,IAAI;AACf,eAAO,oBAAoBA,QAAO,OAAOA,QAAO,YAAY;AAAA,MAC7D;AACA,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AAEA,UAAM,SAAS,MAAM,KAAK,cAAc,cAAc,QAAQ,IAAI,QAAQ;AAAA,MACzE,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK,SAAS,KAAK,OAAO,KAAK;AAAA,IAAA,CACrC;AACD,QAAI,KAAK,OAAO;AACf,YAAM,QAAQ,cAAc;AAAA,QAC3B,MAAM;AAAA,QACN,UAAU;AAAA,QACV,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AAAA,EAEA,MAAM,mBACL,QACA,MACA,SACA,MACsC;AACtC,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB;AAAA,MAC1B,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,QAAQ,IAAI,KAAK,KAAK;AACtF,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA;AAAA;AAAA,MAGN,UAAU;AAAA,IAAA,CACV;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AACA,WAAO,EAAE,IAAI,KAAA;AAAA,EACd;AACD;"}

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs CHANGED Viewed

@@ -11,6 +11,8 @@ require("node:crypto");
 require("../../../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -18,7 +20,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class DisablePersonMutationResolver {
@@ -41,11 +42,11 @@ class DisablePersonMutationResolver {
       action: PermissionActions.PermissionActions.PERSON_DISABLE(targetPerson.roles),
       message: "You are not allowed to disable person account"
     });
-    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger);
     await context.logAuthAction({
       type: "person_disable",
       response: result,
-      personId: targetPerson.id
+      targetPersonId: targetPerson.id
     });
     if (!result.ok) {
       return errorUtils.createErrorResponse(result.error, result.errorMessage);

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: ~~any~~,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\~~tpersonId~~: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,~~YAAY~~;~~AACpF~~,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,~~UAAU~~,aAAa;AAAA,IAAA,~~CACvB~~;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}
1	+ {"version":3,"file":"DisablePersonMutationResolver.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: unknown,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":["PermissionActions","createErrorResponse"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQA,kBAAAA,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,cAAc,QAAQ,MAAM;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAOC,WAAAA,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;;"}

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.js CHANGED Viewed

@@ -9,6 +9,8 @@ import "node:crypto";
 import "../../../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../../../model/service/idp/IDPRevalidation.js";
+import "../../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -16,7 +18,6 @@ import "../../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../../model/service/idp/providers/FacebookProvider.js";
 import "../../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { createErrorResponse } from "../../errorUtils.js";
 class DisablePersonMutationResolver {
@@ -39,11 +40,11 @@ class DisablePersonMutationResolver {
       action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
       message: "You are not allowed to disable person account"
     });
-    const result = await this.personAccessManager.disablePerson(context.db, targetPerson);
+    const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger);
     await context.logAuthAction({
       type: "person_disable",
       response: result,
-      personId: targetPerson.id
+      targetPersonId: targetPerson.id
     });
     if (!result.ok) {
       return createErrorResponse(result.error, result.errorMessage);

package/dist/development/src/resolvers/mutation/person/DisablePersonMutationResolver.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: ~~any~~,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\~~tpersonId~~: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;~~AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,~~YAAY~~;~~AACpF~~,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,~~UAAU~~,aAAa;AAAA,IAAA,~~CACvB~~;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}
1	+ {"version":3,"file":"DisablePersonMutationResolver.js","sources":["../../../../../../../packages/engine-tenant-api/src/resolvers/mutation/person/DisablePersonMutationResolver.ts"],"sourcesContent":["import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'\nimport { TenantResolverContext } from '../../TenantResolverContext.js'\nimport { PermissionActions, PersonAccessManager } from '../../../model/index.js'\nimport { PersonManager } from '../../../model/service/PersonManager.js'\nimport { createErrorResponse } from '../../errorUtils.js'\n\nexport class DisablePersonMutationResolver implements MutationResolvers {\n\tconstructor(\n\t\tprivate readonly personAccessManager: PersonAccessManager,\n\t\tprivate readonly personManager: PersonManager,\n\t) {}\n\n\tasync disablePerson(\n\t\tparent: unknown,\n\t\targs: MutationDisablePersonArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<DisablePersonResponse> {\n\t\tconst targetPerson = await this.personManager.findPersonById(context.db, args.personId)\n\n\t\tif (targetPerson === null) {\n\t\t\treturn {\n\t\t\t\tok: false,\n\t\t\t\terror: {\n\t\t\t\t\tcode: 'PERSON_NOT_FOUND',\n\t\t\t\t\tdeveloperMessage: `Person <${args.personId}> was not found`,\n\t\t\t\t},\n\t\t\t}\n\t\t}\n\n\t\tawait context.requireAccess({\n\t\t\taction: PermissionActions.PERSON_DISABLE(targetPerson.roles),\n\t\t\tmessage: 'You are not allowed to disable person account',\n\t\t})\n\n\t\tconst result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)\n\t\tawait context.logAuthAction({\n\t\t\ttype: 'person_disable',\n\t\t\tresponse: result,\n\t\t\ttargetPersonId: targetPerson.id,\n\t\t})\n\t\tif (!result.ok) {\n\t\t\treturn createErrorResponse(result.error, result.errorMessage)\n\t\t}\n\n\t\treturn {\n\t\t\tok: true,\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAMO,MAAM,8BAA2D;AAAA,EACvE,YACkB,qBACA,eAChB;AAFgB,SAAA,sBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,cACL,QACA,MACA,SACiC;AACjC,UAAM,eAAe,MAAM,KAAK,cAAc,eAAe,QAAQ,IAAI,KAAK,QAAQ;AAEtF,QAAI,iBAAiB,MAAM;AAC1B,aAAO;AAAA,QACN,IAAI;AAAA,QACJ,OAAO;AAAA,UACN,MAAM;AAAA,UACN,kBAAkB,WAAW,KAAK,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,IAEF;AAEA,UAAM,QAAQ,cAAc;AAAA,MAC3B,QAAQ,kBAAkB,eAAe,aAAa,KAAK;AAAA,MAC3D,SAAS;AAAA,IAAA,CACT;AAED,UAAM,SAAS,MAAM,KAAK,oBAAoB,cAAc,QAAQ,IAAI,cAAc,QAAQ,MAAM;AACpG,UAAM,QAAQ,cAAc;AAAA,MAC3B,MAAM;AAAA,MACN,UAAU;AAAA,MACV,gBAAgB,aAAa;AAAA,IAAA,CAC7B;AACD,QAAI,CAAC,OAAO,IAAI;AACf,aAAO,oBAAoB,OAAO,OAAO,OAAO,YAAY;AAAA,IAC7D;AAEA,WAAO;AAAA,MACN,IAAI;AAAA,IAAA;AAAA,EAEN;AACD;"}

package/dist/development/src/resolvers/mutation/person/EmailOtpMutationResolver.cjs CHANGED Viewed

@@ -16,6 +16,8 @@ const ConfigurationQuery = require("../../../model/queries/configuration/Configu
 const PersonQuery = require("../../../model/queries/person/PersonQuery.cjs");
 require("node:assert");
 require("../../../model/service/idp/IDPRevalidation.cjs");
+require("../../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -23,7 +25,6 @@ require("../../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const errorUtils = require("../../errorUtils.cjs");
 class EmailOtpMutationResolver {