@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/development/src/resolvers/types/ProjectTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectApiKeysQuery","ApiKeyResponseFactory","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQF,oCAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIG,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMC,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}
+{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { Authorizator } from '@contember/authorization'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\t/**\n\t * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is\n\t * checked again where it is used, so answering `true` here grants nothing.\n\t *\n\t * The membership-parameterized actions are asked with an empty membership list, the same coarse\n\t * \"do you hold this at all\" question `apiKeys` and `members` already ask — which roles may\n\t * actually be granted is still decided per membership when the mutation runs.\n\t */\n\tasync permissions(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ProjectPermissions> {\n\t\tconst scope = await context.permissionContext.createProjectScope(parent)\n\t\tconst isAllowed = (action: Authorizator.Action) => context.permissionContext.isAllowed({ scope, action })\n\n\t\tconst [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise\n\t\t\t.all([\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_SECRETS),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_SET_SECRET),\n\t\t\t\tisAllowed(PermissionActions.API_KEY_CREATE),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE),\n\t\t\t])\n\n\t\treturn { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate }\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectApiKeysQuery","ApiKeyResponseFactory","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQF,oCAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIG,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACL,QACA,MACA,SAC8B;AAC9B,UAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AACvE,UAAM,YAAY,CAAC,WAAgC,QAAQ,kBAAkB,UAAU,EAAE,OAAO,QAAQ;AAExG,UAAM,CAAC,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,SAAS,IAAI,MAAM,QACvI,IAAI;AAAA,MACJ,UAAUH,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AAAA,MACnD,UAAUA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AAAA,MAClD,UAAUA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAUA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAUA,kBAAAA,kBAAkB,oBAAoB;AAAA,MAChD,UAAUA,kBAAAA,kBAAkB,kBAAkB;AAAA,MAC9C,UAAUA,kBAAAA,kBAAkB,cAAc;AAAA,MAC1C,UAAUA,kBAAAA,kBAAkB,cAAc;AAAA,IAAA,CAC1C;AAEF,WAAO,EAAE,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,UAAA;AAAA,EACzH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMI,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}

package/dist/development/src/resolvers/types/ProjectTypeResolver.js

@@ -10,6 +10,8 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { ProjectApiKeysQuery } from "../../model/queries/apiKey/ApiKeyListQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import { getRoleVariables } from "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import { getRoleVariables } from "@contember/schema-utils";
 import "otpauth";
 import { UserInputError } from "@contember/graphql-utils";
 import { ApiKeyResponseFactory } from "../responseHelpers/ApiKeyResponseFactory.js";
@@ -69,6 +70,29 @@ class ProjectTypeResolver {
       identity: { ...it.identity, projects: [], sessions: [] }
     }));
   }
+  /**
+   * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is
+   * checked again where it is used, so answering `true` here grants nothing.
+   *
+   * The membership-parameterized actions are asked with an empty membership list, the same coarse
+   * "do you hold this at all" question `apiKeys` and `members` already ask — which roles may
+   * actually be granted is still decided per membership when the mutation runs.
+   */
+  async permissions(parent, args, context) {
+    const scope = await context.permissionContext.createProjectScope(parent);
+    const isAllowed = (action) => context.permissionContext.isAllowed({ scope, action });
+    const [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise.all([
+      isAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_VIEW_SECRETS),
+      isAllowed(PermissionActions.PROJECT_SET_SECRET),
+      isAllowed(PermissionActions.API_KEY_CREATE),
+      isAllowed(PermissionActions.PROJECT_UPDATE)
+    ]);
+    return { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate };
+  }
   async roles(parent, args, context) {
     const schema = await this.projectSchemaResolver.getSchema(parent.slug);
     if (!schema) {

package/dist/development/src/resolvers/types/ProjectTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}
+{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { Authorizator } from '@contember/authorization'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\t/**\n\t * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is\n\t * checked again where it is used, so answering `true` here grants nothing.\n\t *\n\t * The membership-parameterized actions are asked with an empty membership list, the same coarse\n\t * \"do you hold this at all\" question `apiKeys` and `members` already ask — which roles may\n\t * actually be granted is still decided per membership when the mutation runs.\n\t */\n\tasync permissions(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ProjectPermissions> {\n\t\tconst scope = await context.permissionContext.createProjectScope(parent)\n\t\tconst isAllowed = (action: Authorizator.Action) => context.permissionContext.isAllowed({ scope, action })\n\n\t\tconst [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise\n\t\t\t.all([\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_SECRETS),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_SET_SECRET),\n\t\t\t\tisAllowed(PermissionActions.API_KEY_CREATE),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE),\n\t\t\t])\n\n\t\treturn { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate }\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACL,QACA,MACA,SAC8B;AAC9B,UAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AACvE,UAAM,YAAY,CAAC,WAAgC,QAAQ,kBAAkB,UAAU,EAAE,OAAO,QAAQ;AAExG,UAAM,CAAC,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,SAAS,IAAI,MAAM,QACvI,IAAI;AAAA,MACJ,UAAU,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AAAA,MACnD,UAAU,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AAAA,MAClD,UAAU,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAU,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAU,kBAAkB,oBAAoB;AAAA,MAChD,UAAU,kBAAkB,kBAAkB;AAAA,MAC9C,UAAU,kBAAkB,cAAc;AAAA,MAC1C,UAAU,kBAAkB,cAAc;AAAA,IAAA,CAC1C;AAEF,WAAO,EAAE,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,UAAA;AAAA,EACzH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}

package/dist/development/src/schema/tenant.graphql.cjs

@@ -118,6 +118,7 @@ const schema = graphqlTag.gql`
 		disableEmailOtp: DisableEmailOtpResponse
 
 		disablePerson(personId: String!): DisablePersonResponse
+		enablePerson(personId: String!): EnablePersonResponse
 		forceSignOutPerson(personId: String!, reason: String): ForceSignOutPersonResponse
 		resetPersonMfa(personId: String!): ResetPersonMfaResponse
 		revokeSession(sessionId: String!): RevokeSessionResponse
@@ -200,6 +201,7 @@ const schema = graphqlTag.gql`
 		login: ConfigLogin!
 		captcha: ConfigCaptcha!
 		rateLimits: ConfigRateLimits!
+		panel: ConfigPanel!
 	}
 
 	type ConfigSignup {
@@ -333,6 +335,21 @@ const schema = graphqlTag.gql`
 		window: Interval!
 	}
 
+	"""
+	Who may enter the management panel. This is an entry gate for the console
+	only, not an authorization system: everything done inside the panel still
+	goes through the tenant ACL, so being allowed in grants no extra rights.
+	An identity may enter when its global roles intersect globalRoles, or when
+	it holds a membership with one of projectRoles in at least one project.
+	Both lists empty means nobody can enter.
+	"""
+	type ConfigPanel {
+		"""Global roles (identity.roles) that may use the management panel."""
+		globalRoles: [String!]!
+		"""Project membership roles that may use the management panel, in any project."""
+		projectRoles: [String!]!
+	}
+
 	input ConfigInput {
 		signup: ConfigSignupInput
 		emailChange: ConfigEmailChangeInput
@@ -341,6 +358,7 @@ const schema = graphqlTag.gql`
 		login: ConfigLoginInput
 		captcha: ConfigCaptchaInput
 		rateLimits: ConfigRateLimitsInput
+		panel: ConfigPanelInput
 	}
 
 	input ConfigSignupInput {
@@ -425,6 +443,15 @@ const schema = graphqlTag.gql`
 		limit: Int
 		window: Interval
 	}
+
+	"""
+	Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+	list closes the panel for that dimension.
+	"""
+	input ConfigPanelInput {
+		globalRoles: [String!]
+		projectRoles: [String!]
+	}
 	
 	type ConfigureResponse {
 		ok: Boolean!
@@ -538,6 +565,11 @@ const schema = graphqlTag.gql`
 		MFA_ENROLLMENT_REQUIRED
 		EMAIL_NOT_VERIFIED
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so password sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -839,6 +871,11 @@ const schema = graphqlTag.gql`
 		NOT_A_PERSON
 		""" The person is not allowed to disconnect their last remaining sign-in method. """
 		LAST_AUTH_METHOD
+		"""
+		The provider has \`disableLocalAuthentication\`, so this connection is the only way
+		the person may sign in and cannot be removed by them — not even while the provider is disabled.
+		"""
+		IDP_REQUIRED
 	}
 
 	type IdentityProvider {
@@ -865,6 +902,13 @@ const schema = graphqlTag.gql`
 		Defaults to false.
 		"""
 		assumeEmailVerified: Boolean!
+		"""
+		When true, a person linked to this provider may authenticate ONLY through it:
+		password sign-in and passwordless sign-in are refused and no password-reset
+		mail is sent. Disabling the provider lifts the restriction, which is the
+		break-glass for an IdP outage. Defaults to false.
+		"""
+		disableLocalAuthentication: Boolean!
 	}
 
 	input IDPOptions {
@@ -873,6 +917,7 @@ const schema = graphqlTag.gql`
 		initReturnsConfig: Boolean
 		requireVerifiedEmail: Boolean
 		assumeEmailVerified: Boolean
+		disableLocalAuthentication: Boolean
 	}
 
 	# === passwordless sign in ===
@@ -894,6 +939,11 @@ const schema = graphqlTag.gql`
 		PASSWORDLESS_DISABLED
 		INVALID_CAPTCHA
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so passwordless sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 	
 	type InitSignInPasswordlessResult {
@@ -931,6 +981,11 @@ const schema = graphqlTag.gql`
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
 		MFA_ENROLLMENT_REQUIRED
+		"""
+		The person became linked to an identity provider with
+		\`disableLocalAuthentication\` after this magic link was issued.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInPasswordlessResult implements CommonSignInResult {
@@ -1234,8 +1289,22 @@ const schema = graphqlTag.gql`
 		email: String
 		name: String
 		otpEnabled: Boolean!
+		""" The person's own opt-in flag; \`null\` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see \`passwordlessAvailable\`. """
 		passwordlessEnabled: Boolean
 		"""
+		Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+		policy resolved against \`passwordlessEnabled\`, i.e. the very same decision \`signIn\` makes. A UI
+		offering an enable/disable toggle must branch on this — under an \`always\` or \`never\` policy the
+		raw opt-in flag says nothing about what will happen.
+		"""
+		passwordlessAvailable: Boolean!
+		"""
+		Whether \`passwordlessEnabled\` is what decides \`passwordlessAvailable\`. False under an \`always\`
+		or \`never\` policy, where the person's own flag is ignored — a UI should then report the state
+		rather than offer a toggle that changes nothing.
+		"""
+		passwordlessSelfManaged: Boolean!
+		"""
 		Whether e-mail based one-time-password 2FA is enabled for this person
 		(see \`initEmailOtp\` / \`confirmEmailOtp\` / \`disableEmailOtp\`). Independent
 		of \`otpEnabled\` (TOTP authenticator), so a UI can show each MFA method's
@@ -1243,6 +1312,11 @@ const schema = graphqlTag.gql`
 		"""
 		emailOtpEnabled: Boolean!
 		emailVerified: Boolean!
+		"""
+		When the account was disabled (see \`disablePerson\`), null while the person
+		is active. Read-only — flip it with \`disablePerson\` / \`enablePerson\`.
+		"""
+		disabledAt: DateTime
 		identity: Identity!
 
 		"""
@@ -1312,9 +1386,60 @@ const schema = graphqlTag.gql`
 		sessions: [SessionInfo!]!
 	}
 
+	"""
+	What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+
+	This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+	boundary, and answering \`true\` here grants nothing. Every operation is still checked when it is
+	called. The distinction matters because permission failure is not uniform across this API: some
+	queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+	"nothing to show" from "not yours to see" by trying.
+	"""
 	type IdentityGlobalPermissions {
 		canCreateProject: Boolean!
 		canDeployEntrypoint: Boolean!
+		""" Read \`configuration\`, which throws otherwise. The other configuration queries gate on their own actions. """
+		canViewConfiguration: Boolean!
+		""" Read \`identityProviders\`. """
+		canListIdentityProviders: Boolean!
+		""" Read \`mailTemplates\`. """
+		canListMailTemplates: Boolean!
+		"""
+		Write the tenant configuration (\`configure\`) and read \`authPolicies\`. The CLI is the usual write path.
+		"""
+		canManageConfiguration: Boolean!
+		""" Read \`authLog\`, which throws otherwise. """
+		canViewAuthLog: Boolean!
+		"""
+		List every person in the tenant. Without it \`persons\` still answers, narrowed to the members
+		of the projects the caller administers — so this marks a full listing, not access to one.
+		"""
+		canListPersons: Boolean!
+		""" Read \`globalApiKeys\`, which answers an empty list otherwise. """
+		canListGlobalApiKeys: Boolean!
+		canCreateGlobalApiKey: Boolean!
+	}
+
+	"""
+	What the calling identity may do in this project. Same contract as
+	\`IdentityGlobalPermissions\`: advisory, evaluated per caller, never a substitute for the checks in
+	the resolvers.
+	"""
+	type ProjectPermissions {
+		""" Read \`members\` and \`apiKeys\`; both answer an empty list otherwise. """
+		canViewMembers: Boolean!
+		""" Invite or add a member (\`invite\`, \`addProjectMember\`). Which roles may be granted is checked per membership. """
+		canAddMember: Boolean!
+		canUpdateMember: Boolean!
+		canRemoveMember: Boolean!
+		""" Read \`secrets\` (their names, never values); answers an empty list otherwise. """
+		canViewSecrets: Boolean!
+		""" Write a project secret (\`setProjectSecret\`). Distinct from viewing: a project admin commonly has one and not the other. """
+		canSetSecret: Boolean!
+		""" Create an API key scoped to this project. """
+		canCreateApiKey: Boolean!
+		""" Update the project itself (\`updateProject\`). """
+		canUpdate: Boolean!
 	}
 
 	type IdentityProjectRelation {
@@ -1349,6 +1474,8 @@ const schema = graphqlTag.gql`
 		+ SUPER_ADMIN by default); returns an empty list otherwise.
 		"""
 		secrets: [ProjectSecretInfo!]!
+		""" What the calling identity may do here. Advisory — for building the UI, not for enforcing it. """
+		permissions: ProjectPermissions!
 	}
 
 	""" Metadata about a project secret — never its value. """
@@ -1540,6 +1667,23 @@ const schema = graphqlTag.gql`
 		PERSON_NOT_FOUND
 	}
 
+	# === enablePerson ===
+
+	type EnablePersonResponse {
+		ok: Boolean!
+		error: EnablePersonError
+	}
+
+	type EnablePersonError {
+		code: EnablePersonErrorCode!
+		developerMessage: String!
+	}
+
+	enum EnablePersonErrorCode {
+		PERSON_ALREADY_ENABLED
+		PERSON_NOT_FOUND
+	}
+
 	# === forceSignOutPerson ===
 
 	type ForceSignOutPersonResponse {