@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/production/src/resolvers/types/IdentityTypeResolver.cjs

@@ -15,6 +15,8 @@ const PersonByIdentityBatchQuery = require("../../model/queries/person/PersonByI
 const IdentityQuery = require("../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -22,10 +24,10 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const array = require("../../utils/array.cjs");
 const PersonResponseFactory = require("../responseHelpers/PersonResponseFactory.cjs");
+const ProjectResponseFactory = require("../responseHelpers/ProjectResponseFactory.cjs");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
@@ -79,7 +81,7 @@ class IdentityTypeResolver {
           return null;
         }
         return {
-          project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+          project: ProjectResponseFactory.ProjectResponseFactory.createProjectResponse(it),
           memberships
         };
       })
@@ -118,9 +120,40 @@ class IdentityTypeResolver {
     if (!permissionsContext) {
       return null;
     }
+    const [
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
+    ] = await Promise.all([
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PROJECT_CREATE }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.CONFIG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.IDP_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.MAIL_TEMPLATE_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.CONFIGURE }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.AUTH_LOG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PERSON_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.API_KEY_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.API_KEY_CREATE_GLOBAL() })
+    ]);
     return {
-      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.PROJECT_CREATE }),
-      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.PermissionActions.ENTRYPOINT_DEPLOY })
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
     };
   }
   async sessions(parent, args, context) {

package/dist/production/src/resolvers/types/IdentityTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","notEmpty","PermissionActions","ApiKeySessionsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,UACjE;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQA,kBAAAA,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,oBAAAA,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;;"}
+{"version":3,"file":"IdentityTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: ProjectResponseFactory.createProjectResponse(it),\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Advisory only — every one of these is checked again where it is used. It exists so a UI can\n\t\t// stop offering what it cannot deliver: the operations behind these flags fail in three\n\t\t// different ways (empty list, thrown query, thrown mutation), so probing is not an option.\n\t\tconst [\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t] = await Promise.all([\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),\n\t\t])\n\n\t\treturn {\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":["batchLoader","PersonByIdentityBatchQuery","IdentityQuery","PersonResponseFactory","ProjectResponseFactory","notEmpty","PermissionActions","ApiKeySessionsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAeA,WAAAA;AAAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,2BAAAA,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAcD,WAAAA;AAAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAGC,sBAAAA,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAASC,uBAAAA,uBAAuB,sBAAsB,EAAE;AAAA,UACxD;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAOC,MAAAA,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQC,oCAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAKA,UAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,IACG,MAAM,QAAQ,IAAI;AAAA,MACrB,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,gBAAgB;AAAA,MACzE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,mBAAmB;AAAA,MAC5E,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,UAAU;AAAA,MACnE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,oBAAoB;AAAA,MAC7E,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,WAAW;AAAA,MACpE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,eAAe;AAAA,MACxE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,cAAc;AAAA,MACvE,mBAAmB,UAAU,EAAE,QAAQA,kBAAAA,kBAAkB,sBAAA,GAAyB;AAAA,IAAA,CAClF;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQA,kBAAAA,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAIC,oBAAAA,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;;"}

package/dist/production/src/resolvers/types/IdentityTypeResolver.js

@@ -13,6 +13,8 @@ import { PersonByIdentityBatchQuery } from "../../model/queries/person/PersonByI
 import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -20,10 +22,10 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 import { notEmpty } from "../../utils/array.js";
 import { PersonResponseFactory } from "../responseHelpers/PersonResponseFactory.js";
+import { ProjectResponseFactory } from "../responseHelpers/ProjectResponseFactory.js";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
@@ -77,7 +79,7 @@ class IdentityTypeResolver {
           return null;
         }
         return {
-          project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+          project: ProjectResponseFactory.createProjectResponse(it),
           memberships
         };
       })
@@ -116,9 +118,40 @@ class IdentityTypeResolver {
     if (!permissionsContext) {
       return null;
     }
+    const [
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
+    ] = await Promise.all([
+      permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+      permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+      permissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),
+      permissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),
+      permissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),
+      permissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() })
+    ]);
     return {
-      canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
-      canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY })
+      canCreateProject,
+      canDeployEntrypoint,
+      canViewConfiguration,
+      canListIdentityProviders,
+      canListMailTemplates,
+      canManageConfiguration,
+      canViewAuthLog,
+      canListPersons,
+      canListGlobalApiKeys,
+      canCreateGlobalApiKey
     };
   }
   async sessions(parent, args, context) {

package/dist/production/src/resolvers/types/IdentityTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\treturn {\n\t\t\tcanCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tcanDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,EAAE,GAAG,IAAI,SAAS,CAAA,GAAI,OAAO,CAAA,GAAI,SAAS,IAAI,SAAS,CAAA,EAAC;AAAA,UACjE;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAEA,WAAO;AAAA,MACN,kBAAkB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACjG,qBAAqB,MAAM,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,IAAA;AAAA,EAEzG;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;"}
+{"version":3,"file":"IdentityTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/IdentityTypeResolver.ts"],"sourcesContent":["import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'\nimport {\n\tIdentityQuery,\n\tPermissionActions,\n\tPermissionContextFactory,\n\tPersonByIdentityBatchQuery,\n\tPersonRow,\n\tProjectManager,\n\tProjectMemberManager,\n} from '../../model/index.js'\nimport { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { notEmpty } from '../../utils/array.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\nimport { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'\nimport { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'\n\nexport class IdentityTypeResolver implements IdentityResolvers {\n\tprivate personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(\n\t\tasync (ids, db) => {\n\t\t\tconst persons = await db.queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\t\treturn Object.fromEntries(persons.map(it => [it.identity_id, it]))\n\t\t},\n\t\t(id, result) => result[id],\n\t)\n\tprivate rolesLoader = batchLoader<string, Record<string, string[]>, string[]>(\n\t\tasync (ids, db) => {\n\t\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(ids))\n\t\t\treturn Object.fromEntries(identities.map(it => [it.id, it.roles]))\n\t\t},\n\t\t(id, result) => result[id] ?? [],\n\t)\n\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {\n\t}\n\n\tasync person(parent: Identity, args: unknown, context: TenantResolverContext): Promise<Maybe<Person>> {\n\t\tconst person = await context.db.batchLoad(this.personLoader, parent.id)\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...PersonResponseFactory.createPersonResponse(person),\n\t\t\tidentity: parent,\n\t\t}\n\t}\n\n\tasync projects(\n\t\tparent: { id: string; projects: readonly IdentityProjectRelation[] },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly IdentityProjectRelation[]> {\n\t\tif (parent.projects.length > 0) {\n\t\t\treturn parent.projects\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tconst roles = isSelf ? context.identity.roles : []\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(context.db, parent.id, context.permissionContext)\n\t\treturn (\n\t\t\tawait Promise.all(\n\t\t\t\tprojects.map(async (it): Promise<IdentityProjectRelation | null> => {\n\t\t\t\t\tconst verifier = isSelf\n\t\t\t\t\t\t? undefined\n\t\t\t\t\t\t: context.permissionContext.createAccessVerifier(await context.permissionContext.createProjectScope(it))\n\t\t\t\t\tconst memberships = await this.projectMemberManager.getAllProjectMemberships(\n\t\t\t\t\t\tcontext.db,\n\t\t\t\t\t\t{ id: it.id },\n\t\t\t\t\t\t{ id: parent.id, roles },\n\t\t\t\t\t\tverifier,\n\t\t\t\t\t)\n\t\t\t\t\tif (memberships.length === 0) {\n\t\t\t\t\t\treturn null\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tproject: ProjectResponseFactory.createProjectResponse(it),\n\t\t\t\t\t\tmemberships: memberships,\n\t\t\t\t\t}\n\t\t\t\t}),\n\t\t\t)\n\t\t).filter(notEmpty)\n\t}\n\n\tasync roles(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly string[] | null> {\n\t\tif (parent.roles) {\n\t\t\treturn parent.roles\n\t\t}\n\t\tconst isSelf = parent.id === context.identity.id\n\t\tif (isSelf) {\n\t\t\treturn context.identity.roles\n\t\t}\n\t\tconst canViewRoles = await context.permissionContext.isAllowed({ action: PermissionActions.IDENTITY_VIEW_PERMISSIONS })\n\t\tif (canViewRoles) {\n\t\t\treturn await context.db.batchLoad(this.rolesLoader, parent.id)\n\t\t} else {\n\t\t\treturn null\n\t\t}\n\t}\n\n\tasync permissions(\n\t\tparent: { id: string; permissions?: IdentityGlobalPermissions | undefined | null; roles?: readonly string[] | undefined | null },\n\t\t{}: any,\n\t\tcontext: TenantResolverContext,\n\t): Promise<IdentityGlobalPermissions | null> {\n\t\tif (parent.permissions) {\n\t\t\treturn parent.permissions\n\t\t}\n\n\t\tconst permissionsContext = await (async () => {\n\t\t\tconst isSelf = parent.id === context.identity.id\n\t\t\tif (isSelf) {\n\t\t\t\treturn context.permissionContext\n\t\t\t}\n\t\t\tconst roles = await this.roles(parent, {}, context)\n\t\t\tif (roles === null) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn this.permissionContextFactory.create(context.db, { id: parent.id, roles })\n\t\t})()\n\n\t\tif (!permissionsContext) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Advisory only — every one of these is checked again where it is used. It exists so a UI can\n\t\t// stop offering what it cannot deliver: the operations behind these flags fail in three\n\t\t// different ways (empty list, thrown query, thrown mutation), so probing is not an option.\n\t\tconst [\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t] = await Promise.all([\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),\n\t\t\tpermissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),\n\t\t])\n\n\t\treturn {\n\t\t\tcanCreateProject,\n\t\t\tcanDeployEntrypoint,\n\t\t\tcanViewConfiguration,\n\t\t\tcanListIdentityProviders,\n\t\t\tcanListMailTemplates,\n\t\t\tcanManageConfiguration,\n\t\t\tcanViewAuthLog,\n\t\t\tcanListPersons,\n\t\t\tcanListGlobalApiKeys,\n\t\t\tcanCreateGlobalApiKey,\n\t\t}\n\t}\n\n\tasync sessions(\n\t\tparent: { id: string; roles?: readonly string[] | undefined | null },\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<SessionInfo[]> {\n\t\t// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS\n\t\t// against the target's roles, so PROJECT_ADMIN can peek at members but\n\t\t// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).\n\t\t// Return [] instead of throwing — listing many identities should not\n\t\t// abort just because the viewer lacks visibility for one of them.\n\t\tif (parent.id !== context.identity.id) {\n\t\t\tconst targetRoles = await this.roles(parent, {}, context)\n\t\t\tif (targetRoles === null) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(\n\t\t\tnew ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),\n\t\t)\n\t\treturn rows.map(row => ({\n\t\t\tid: row.id,\n\t\t\tcreatedAt: row.created_at,\n\t\t\texpiresAt: row.expires_at,\n\t\t\tlastUsedAt: row.last_used_at,\n\t\t\tlastIp: row.last_ip,\n\t\t\tlastUserAgent: row.last_user_agent,\n\t\t\tcreatedIp: row.created_ip,\n\t\t\tcreatedUserAgent: row.created_user_agent,\n\t\t\tisCurrent: row.id === context.apiKeyId,\n\t\t\ttrustForwardedClientInfo: row.trust_forwarded_info,\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAkD;AAAA,EAgB9D,YACkB,sBACA,gBACA,0BAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AAlBlB,kBAAA,MAAQ,gBAAe;AAAA,MACtB,OAAO,KAAK,OAAO;AAClB,cAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC/E,eAAO,OAAO,YAAY,QAAQ,IAAI,CAAA,OAAM,CAAC,GAAG,aAAa,EAAE,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE;AAAA,IAAA,CAC1B;AACA,kBAAA,MAAQ,eAAc;AAAA,MACrB,OAAO,KAAK,OAAO;AAClB,cAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,GAAG,CAAC;AACrE,eAAO,OAAO,YAAY,WAAW,IAAI,CAAA,OAAM,CAAC,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC;AAAA,MAClE;AAAA,MACA,CAAC,IAAI,WAAW,OAAO,EAAE,KAAK,CAAA;AAAA,IAAC,CAChC;AAAA,EAOA;AAAA,EAEA,MAAM,OAAO,QAAkB,MAAe,SAAwD;AACrG,UAAM,SAAS,MAAM,QAAQ,GAAG,UAAU,KAAK,cAAc,OAAO,EAAE;AACtE,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,sBAAsB,qBAAqB,MAAM;AAAA,MACpD,UAAU;AAAA,IAAA;AAAA,EAEZ;AAAA,EAEA,MAAM,SACL,QACA,CAAA,GACA,SAC8C;AAC9C,QAAI,OAAO,SAAS,SAAS,GAAG;AAC/B,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAM,QAAQ,SAAS,QAAQ,SAAS,QAAQ,CAAA;AAChD,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,QAAQ,IAAI,OAAO,IAAI,QAAQ,iBAAiB;AACjH,YACC,MAAM,QAAQ;AAAA,MACb,SAAS,IAAI,OAAO,OAAgD;AACnE,cAAM,WAAW,SACd,SACA,QAAQ,kBAAkB,qBAAqB,MAAM,QAAQ,kBAAkB,mBAAmB,EAAE,CAAC;AACxG,cAAM,cAAc,MAAM,KAAK,qBAAqB;AAAA,UACnD,QAAQ;AAAA,UACR,EAAE,IAAI,GAAG,GAAA;AAAA,UACT,EAAE,IAAI,OAAO,IAAI,MAAA;AAAA,UACjB;AAAA,QAAA;AAED,YAAI,YAAY,WAAW,GAAG;AAC7B,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,UACN,SAAS,uBAAuB,sBAAsB,EAAE;AAAA,UACxD;AAAA,QAAA;AAAA,MAEF,CAAC;AAAA,IAAA,GAED,OAAO,QAAQ;AAAA,EAClB;AAAA,EAEA,MAAM,MACL,QACA,CAAA,GACA,SACoC;AACpC,QAAI,OAAO,OAAO;AACjB,aAAO,OAAO;AAAA,IACf;AACA,UAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,QAAI,QAAQ;AACX,aAAO,QAAQ,SAAS;AAAA,IACzB;AACA,UAAM,eAAe,MAAM,QAAQ,kBAAkB,UAAU,EAAE,QAAQ,kBAAkB,2BAA2B;AACtH,QAAI,cAAc;AACjB,aAAO,MAAM,QAAQ,GAAG,UAAU,KAAK,aAAa,OAAO,EAAE;AAAA,IAC9D,OAAO;AACN,aAAO;AAAA,IACR;AAAA,EACD;AAAA,EAEA,MAAM,YACL,QACA,CAAA,GACA,SAC4C;AAC5C,QAAI,OAAO,aAAa;AACvB,aAAO,OAAO;AAAA,IACf;AAEA,UAAM,qBAAqB,OAAO,YAAY;AAC7C,YAAM,SAAS,OAAO,OAAO,QAAQ,SAAS;AAC9C,UAAI,QAAQ;AACX,eAAO,QAAQ;AAAA,MAChB;AACA,YAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AAClD,UAAI,UAAU,MAAM;AACnB,eAAO;AAAA,MACR;AACA,aAAO,KAAK,yBAAyB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,IAAI,OAAO;AAAA,IACjF,GAAA;AAEA,QAAI,CAAC,oBAAoB;AACxB,aAAO;AAAA,IACR;AAKA,UAAM;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,IACG,MAAM,QAAQ,IAAI;AAAA,MACrB,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,gBAAgB;AAAA,MACzE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,mBAAmB;AAAA,MAC5E,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,UAAU;AAAA,MACnE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,oBAAoB;AAAA,MAC7E,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,WAAW;AAAA,MACpE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,eAAe;AAAA,MACxE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,aAAa;AAAA,MACtE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,cAAc;AAAA,MACvE,mBAAmB,UAAU,EAAE,QAAQ,kBAAkB,sBAAA,GAAyB;AAAA,IAAA,CAClF;AAED,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAM,SACL,QACA,MACA,SACyB;AAMzB,QAAI,OAAO,OAAO,QAAQ,SAAS,IAAI;AACtC,YAAM,cAAc,MAAM,KAAK,MAAM,QAAQ,CAAA,GAAI,OAAO;AACxD,UAAI,gBAAgB,MAAM;AACzB,eAAO,CAAA;AAAA,MACR;AACA,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,qBAAqB,WAAW;AAAA,MAAA,CAC1D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa;AAAA,MAC1C,IAAI,8BAA8B,OAAO,IAAI,EAAE,KAAK,QAAQ,GAAG,UAAU,MAAI,CAAG;AAAA,IAAA;AAEjF,WAAO,KAAK,IAAI,CAAA,SAAQ;AAAA,MACvB,IAAI,IAAI;AAAA,MACR,WAAW,IAAI;AAAA,MACf,WAAW,IAAI;AAAA,MACf,YAAY,IAAI;AAAA,MAChB,QAAQ,IAAI;AAAA,MACZ,eAAe,IAAI;AAAA,MACnB,WAAW,IAAI;AAAA,MACf,kBAAkB,IAAI;AAAA,MACtB,WAAW,IAAI,OAAO,QAAQ;AAAA,MAC9B,0BAA0B,IAAI;AAAA,IAAA,EAC7B;AAAA,EACH;AACD;"}

package/dist/production/src/resolvers/types/PersonTypeResolver.cjs

@@ -9,9 +9,13 @@ require("../../model/type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
 require("../../model/queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../model/queries/configuration/ConfigurationQuery.cjs");
 const IdentityQuery = require("../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
+const isPasswordlessEnabled = require("../../model/service/helpers/isPasswordlessEnabled.cjs");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,11 +23,36 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
 class PersonTypeResolver {
   constructor(personIdentityProviderManager) {
     this.personIdentityProviderManager = personIdentityProviderManager;
+    __publicField(this, "configurationByRequest", /* @__PURE__ */ new WeakMap());
+  }
+  /**
+   * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a
+   * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,
+   * which an ordinary person does not have).
+   */
+  async passwordlessAvailable(parent, args, context) {
+    const config = await this.configuration(context);
+    return isPasswordlessEnabled.isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null);
+  }
+  async passwordlessSelfManaged(parent, args, context) {
+    const config = await this.configuration(context);
+    return config.passwordless.enabled === "optIn" || config.passwordless.enabled === "optOut";
+  }
+  configuration(context) {
+    const cached = this.configurationByRequest.get(context);
+    if (cached) {
+      return cached;
+    }
+    const pending = context.db.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(context.db.providers));
+    this.configurationByRequest.set(context, pending);
+    return pending;
   }
   async identityProviders(parent, args, context) {
     if (parent.identity.id !== context.identity.id) {

package/dist/production/src/resolvers/types/PersonTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/PersonTypeResolver.ts"],"sourcesContent":["import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'\nimport { IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {\n\t\t// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the\n\t\t// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.\n\t\t// Return [] instead of throwing so listing many persons does not abort on a\n\t\t// single forbidden target — mirrors `Identity.sessions`.\n\t\tif (parent.identity.id !== context.identity.id) {\n\t\t\tconst [identity] = await context.db.queryHandler.fetch(new IdentityQuery([parent.identity.id]))\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_IDP(identity?.roles ?? []),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\n\t\tconst connections = await this.personIdentityProviderManager.listPersonIdentityProviders(context.db, parent.id)\n\t\treturn connections.map(it => ({\n\t\t\tid: it.id,\n\t\t\tcreatedAt: it.createdAt,\n\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\tidentityProvider: {\n\t\t\t\tslug: it.identityProviderSlug,\n\t\t\t\ttype: it.identityProviderType,\n\t\t\t\tdisabledAt: it.identityProviderDisabledAt,\n\t\t\t},\n\t\t}))\n\t}\n}\n"],"names":["IdentityQuery","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,mBAAyE;AAAA,EACrF,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAgB,MAAe,SAAmE;AAKzH,QAAI,OAAO,SAAS,OAAO,QAAQ,SAAS,IAAI;AAC/C,YAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIA,cAAAA,cAAc,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;AAC9F,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQC,kBAAAA,kBAAkB,gBAAgB,UAAU,SAAS,CAAA,CAAE;AAAA,MAAA,CAC/D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,8BAA8B,4BAA4B,QAAQ,IAAI,OAAO,EAAE;AAC9G,WAAO,YAAY,IAAI,CAAA,QAAO;AAAA,MAC7B,IAAI,GAAG;AAAA,MACP,WAAW,GAAG;AAAA,MACd,oBAAoB,GAAG;AAAA,MACvB,kBAAkB;AAAA,QACjB,MAAM,GAAG;AAAA,QACT,MAAM,GAAG;AAAA,QACT,YAAY,GAAG;AAAA,MAAA;AAAA,IAChB,EACC;AAAA,EACH;AACD;;"}
+{"version":3,"file":"PersonTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/PersonTypeResolver.ts"],"sourcesContent":["import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'\nimport { type Config, ConfigurationQuery, IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'\nimport { isPasswordlessEnabled } from '../../model/service/helpers/isPasswordlessEnabled.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders' | 'passwordlessAvailable' | 'passwordlessSelfManaged'> {\n\t/**\n\t * One configuration read per request rather than per person: `person$$` selects every scalar, so\n\t * listing N people would otherwise issue N identical config queries. Keyed on the resolver context,\n\t * which is built once per operation and collected with it.\n\t */\n\tprivate readonly configurationByRequest = new WeakMap<TenantResolverContext, Promise<Config>>()\n\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\t/**\n\t * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a\n\t * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,\n\t * which an ordinary person does not have).\n\t */\n\tasync passwordlessAvailable(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {\n\t\tconst config = await this.configuration(context)\n\t\treturn isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null)\n\t}\n\n\tasync passwordlessSelfManaged(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {\n\t\tconst config = await this.configuration(context)\n\t\treturn config.passwordless.enabled === 'optIn' || config.passwordless.enabled === 'optOut'\n\t}\n\n\tprivate configuration(context: TenantResolverContext): Promise<Config> {\n\t\tconst cached = this.configurationByRequest.get(context)\n\t\tif (cached) {\n\t\t\treturn cached\n\t\t}\n\t\tconst pending = context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tthis.configurationByRequest.set(context, pending)\n\t\treturn pending\n\t}\n\n\tasync identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {\n\t\t// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the\n\t\t// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.\n\t\t// Return [] instead of throwing so listing many persons does not abort on a\n\t\t// single forbidden target — mirrors `Identity.sessions`.\n\t\tif (parent.identity.id !== context.identity.id) {\n\t\t\tconst [identity] = await context.db.queryHandler.fetch(new IdentityQuery([parent.identity.id]))\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_IDP(identity?.roles ?? []),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\n\t\tconst connections = await this.personIdentityProviderManager.listPersonIdentityProviders(context.db, parent.id)\n\t\treturn connections.map(it => ({\n\t\t\tid: it.id,\n\t\t\tcreatedAt: it.createdAt,\n\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\tidentityProvider: {\n\t\t\t\tslug: it.identityProviderSlug,\n\t\t\t\ttype: it.identityProviderType,\n\t\t\t\tdisabledAt: it.identityProviderDisabledAt,\n\t\t\t},\n\t\t}))\n\t}\n}\n"],"names":["isPasswordlessEnabled","ConfigurationQuery","IdentityQuery","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,mBAA+H;AAAA,EAQ3I,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAHlB,kBAAA,MAAiB,8CAA6B,QAAA,CAAgD;AAAA,EAK9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,sBAAsB,QAAgB,MAAe,SAAkD;AAC5G,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,WAAOA,sBAAAA,sBAAsB,OAAO,aAAa,SAAS,OAAO,uBAAuB,IAAI;AAAA,EAC7F;AAAA,EAEA,MAAM,wBAAwB,QAAgB,MAAe,SAAkD;AAC9G,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,WAAO,OAAO,aAAa,YAAY,WAAW,OAAO,aAAa,YAAY;AAAA,EACnF;AAAA,EAEQ,cAAc,SAAiD;AACtE,UAAM,SAAS,KAAK,uBAAuB,IAAI,OAAO;AACtD,QAAI,QAAQ;AACX,aAAO;AAAA,IACR;AACA,UAAM,UAAU,QAAQ,GAAG,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAC1F,SAAK,uBAAuB,IAAI,SAAS,OAAO;AAChD,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,kBAAkB,QAAgB,MAAe,SAAmE;AAKzH,QAAI,OAAO,SAAS,OAAO,QAAQ,SAAS,IAAI;AAC/C,YAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,cAAAA,cAAc,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;AAC9F,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQC,kBAAAA,kBAAkB,gBAAgB,UAAU,SAAS,CAAA,CAAE;AAAA,MAAA,CAC/D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,8BAA8B,4BAA4B,QAAQ,IAAI,OAAO,EAAE;AAC9G,WAAO,YAAY,IAAI,CAAA,QAAO;AAAA,MAC7B,IAAI,GAAG;AAAA,MACP,WAAW,GAAG;AAAA,MACd,oBAAoB,GAAG;AAAA,MACvB,kBAAkB;AAAA,QACjB,MAAM,GAAG;AAAA,QACT,MAAM,GAAG;AAAA,QACT,YAAY,GAAG;AAAA,MAAA;AAAA,IAChB,EACC;AAAA,EACH;AACD;;"}

package/dist/production/src/resolvers/types/PersonTypeResolver.js

@@ -7,9 +7,13 @@ import "../../model/type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../model/queries/configuration/ConfigurationQuery.js";
 import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
+import { isPasswordlessEnabled } from "../../model/service/helpers/isPasswordlessEnabled.js";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,11 +21,36 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
 class PersonTypeResolver {
   constructor(personIdentityProviderManager) {
     this.personIdentityProviderManager = personIdentityProviderManager;
+    __publicField(this, "configurationByRequest", /* @__PURE__ */ new WeakMap());
+  }
+  /**
+   * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a
+   * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,
+   * which an ordinary person does not have).
+   */
+  async passwordlessAvailable(parent, args, context) {
+    const config = await this.configuration(context);
+    return isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null);
+  }
+  async passwordlessSelfManaged(parent, args, context) {
+    const config = await this.configuration(context);
+    return config.passwordless.enabled === "optIn" || config.passwordless.enabled === "optOut";
+  }
+  configuration(context) {
+    const cached = this.configurationByRequest.get(context);
+    if (cached) {
+      return cached;
+    }
+    const pending = context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers));
+    this.configurationByRequest.set(context, pending);
+    return pending;
   }
   async identityProviders(parent, args, context) {
     if (parent.identity.id !== context.identity.id) {

package/dist/production/src/resolvers/types/PersonTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/PersonTypeResolver.ts"],"sourcesContent":["import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'\nimport { IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders'> {\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\tasync identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {\n\t\t// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the\n\t\t// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.\n\t\t// Return [] instead of throwing so listing many persons does not abort on a\n\t\t// single forbidden target — mirrors `Identity.sessions`.\n\t\tif (parent.identity.id !== context.identity.id) {\n\t\t\tconst [identity] = await context.db.queryHandler.fetch(new IdentityQuery([parent.identity.id]))\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_IDP(identity?.roles ?? []),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\n\t\tconst connections = await this.personIdentityProviderManager.listPersonIdentityProviders(context.db, parent.id)\n\t\treturn connections.map(it => ({\n\t\t\tid: it.id,\n\t\t\tcreatedAt: it.createdAt,\n\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\tidentityProvider: {\n\t\t\t\tslug: it.identityProviderSlug,\n\t\t\t\ttype: it.identityProviderType,\n\t\t\t\tdisabledAt: it.identityProviderDisabledAt,\n\t\t\t},\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAIO,MAAM,mBAAyE;AAAA,EACrF,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAAA,EAElB;AAAA,EAEA,MAAM,kBAAkB,QAAgB,MAAe,SAAmE;AAKzH,QAAI,OAAO,SAAS,OAAO,QAAQ,SAAS,IAAI;AAC/C,YAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;AAC9F,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,gBAAgB,UAAU,SAAS,CAAA,CAAE;AAAA,MAAA,CAC/D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,8BAA8B,4BAA4B,QAAQ,IAAI,OAAO,EAAE;AAC9G,WAAO,YAAY,IAAI,CAAA,QAAO;AAAA,MAC7B,IAAI,GAAG;AAAA,MACP,WAAW,GAAG;AAAA,MACd,oBAAoB,GAAG;AAAA,MACvB,kBAAkB;AAAA,QACjB,MAAM,GAAG;AAAA,QACT,MAAM,GAAG;AAAA,QACT,YAAY,GAAG;AAAA,MAAA;AAAA,IAChB,EACC;AAAA,EACH;AACD;"}
+{"version":3,"file":"PersonTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/PersonTypeResolver.ts"],"sourcesContent":["import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'\nimport { type Config, ConfigurationQuery, IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'\nimport { isPasswordlessEnabled } from '../../model/service/helpers/isPasswordlessEnabled.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\n\nexport class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders' | 'passwordlessAvailable' | 'passwordlessSelfManaged'> {\n\t/**\n\t * One configuration read per request rather than per person: `person$$` selects every scalar, so\n\t * listing N people would otherwise issue N identical config queries. Keyed on the resolver context,\n\t * which is built once per operation and collected with it.\n\t */\n\tprivate readonly configurationByRequest = new WeakMap<TenantResolverContext, Promise<Config>>()\n\n\tconstructor(\n\t\tprivate readonly personIdentityProviderManager: PersonIdentityProviderManager,\n\t) {\n\t}\n\n\t/**\n\t * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a\n\t * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,\n\t * which an ordinary person does not have).\n\t */\n\tasync passwordlessAvailable(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {\n\t\tconst config = await this.configuration(context)\n\t\treturn isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null)\n\t}\n\n\tasync passwordlessSelfManaged(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {\n\t\tconst config = await this.configuration(context)\n\t\treturn config.passwordless.enabled === 'optIn' || config.passwordless.enabled === 'optOut'\n\t}\n\n\tprivate configuration(context: TenantResolverContext): Promise<Config> {\n\t\tconst cached = this.configurationByRequest.get(context)\n\t\tif (cached) {\n\t\t\treturn cached\n\t\t}\n\t\tconst pending = context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))\n\t\tthis.configurationByRequest.set(context, pending)\n\t\treturn pending\n\t}\n\n\tasync identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {\n\t\t// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the\n\t\t// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.\n\t\t// Return [] instead of throwing so listing many persons does not abort on a\n\t\t// single forbidden target — mirrors `Identity.sessions`.\n\t\tif (parent.identity.id !== context.identity.id) {\n\t\t\tconst [identity] = await context.db.queryHandler.fetch(new IdentityQuery([parent.identity.id]))\n\t\t\tconst canView = await context.permissionContext.isAllowed({\n\t\t\t\taction: PermissionActions.PERSON_VIEW_IDP(identity?.roles ?? []),\n\t\t\t})\n\t\t\tif (!canView) {\n\t\t\t\treturn []\n\t\t\t}\n\t\t}\n\n\t\tconst connections = await this.personIdentityProviderManager.listPersonIdentityProviders(context.db, parent.id)\n\t\treturn connections.map(it => ({\n\t\t\tid: it.id,\n\t\t\tcreatedAt: it.createdAt,\n\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\tidentityProvider: {\n\t\t\t\tslug: it.identityProviderSlug,\n\t\t\t\ttype: it.identityProviderType,\n\t\t\t\tdisabledAt: it.identityProviderDisabledAt,\n\t\t\t},\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAKO,MAAM,mBAA+H;AAAA,EAQ3I,YACkB,+BAChB;AADgB,SAAA,gCAAA;AAHlB,kBAAA,MAAiB,8CAA6B,QAAA,CAAgD;AAAA,EAK9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,sBAAsB,QAAgB,MAAe,SAAkD;AAC5G,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,WAAO,sBAAsB,OAAO,aAAa,SAAS,OAAO,uBAAuB,IAAI;AAAA,EAC7F;AAAA,EAEA,MAAM,wBAAwB,QAAgB,MAAe,SAAkD;AAC9G,UAAM,SAAS,MAAM,KAAK,cAAc,OAAO;AAC/C,WAAO,OAAO,aAAa,YAAY,WAAW,OAAO,aAAa,YAAY;AAAA,EACnF;AAAA,EAEQ,cAAc,SAAiD;AACtE,UAAM,SAAS,KAAK,uBAAuB,IAAI,OAAO;AACtD,QAAI,QAAQ;AACX,aAAO;AAAA,IACR;AACA,UAAM,UAAU,QAAQ,GAAG,aAAa,MAAM,IAAI,mBAAmB,QAAQ,GAAG,SAAS,CAAC;AAC1F,SAAK,uBAAuB,IAAI,SAAS,OAAO;AAChD,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,kBAAkB,QAAgB,MAAe,SAAmE;AAKzH,QAAI,OAAO,SAAS,OAAO,QAAQ,SAAS,IAAI;AAC/C,YAAM,CAAC,QAAQ,IAAI,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,cAAc,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC;AAC9F,YAAM,UAAU,MAAM,QAAQ,kBAAkB,UAAU;AAAA,QACzD,QAAQ,kBAAkB,gBAAgB,UAAU,SAAS,CAAA,CAAE;AAAA,MAAA,CAC/D;AACD,UAAI,CAAC,SAAS;AACb,eAAO,CAAA;AAAA,MACR;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,8BAA8B,4BAA4B,QAAQ,IAAI,OAAO,EAAE;AAC9G,WAAO,YAAY,IAAI,CAAA,QAAO;AAAA,MAC7B,IAAI,GAAG;AAAA,MACP,WAAW,GAAG;AAAA,MACd,oBAAoB,GAAG;AAAA,MACvB,kBAAkB;AAAA,QACjB,MAAM,GAAG;AAAA,QACT,MAAM,GAAG;AAAA,QACT,YAAY,GAAG;AAAA,MAAA;AAAA,IAChB,EACC;AAAA,EACH;AACD;"}

package/dist/production/src/resolvers/types/ProjectTypeResolver.cjs

@@ -12,6 +12,8 @@ require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 const ApiKeyListQuery = require("../../model/queries/apiKey/ApiKeyListQuery.cjs");
 require("node:assert");
 require("../../model/service/idp/IDPRevalidation.cjs");
+require("../../model/service/idp/ClaimMapping.cjs");
+const schemaUtils = require("@contember/schema-utils");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -19,7 +21,6 @@ require("../../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
-const schemaUtils = require("@contember/schema-utils");
 require("otpauth");
 const graphqlUtils = require("@contember/graphql-utils");
 const ApiKeyResponseFactory = require("../responseHelpers/ApiKeyResponseFactory.cjs");
@@ -71,6 +72,29 @@ class ProjectTypeResolver {
       identity: { ...it.identity, projects: [], sessions: [] }
     }));
   }
+  /**
+   * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is
+   * checked again where it is used, so answering `true` here grants nothing.
+   *
+   * The membership-parameterized actions are asked with an empty membership list, the same coarse
+   * "do you hold this at all" question `apiKeys` and `members` already ask — which roles may
+   * actually be granted is still decided per membership when the mutation runs.
+   */
+  async permissions(parent, args, context) {
+    const scope = await context.permissionContext.createProjectScope(parent);
+    const isAllowed = (action) => context.permissionContext.isAllowed({ scope, action });
+    const [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise.all([
+      isAllowed(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([])),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([])),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([])),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([])),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_VIEW_SECRETS),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_SET_SECRET),
+      isAllowed(PermissionActions.PermissionActions.API_KEY_CREATE),
+      isAllowed(PermissionActions.PermissionActions.PROJECT_UPDATE)
+    ]);
+    return { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate };
+  }
   async roles(parent, args, context) {
     const schema$1 = await this.projectSchemaResolver.getSchema(parent.slug);
     if (!schema$1) {

package/dist/production/src/resolvers/types/ProjectTypeResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectApiKeysQuery","ApiKeyResponseFactory","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQF,oCAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIG,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMC,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}
+{"version":3,"file":"ProjectTypeResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { Authorizator } from '@contember/authorization'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\t/**\n\t * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is\n\t * checked again where it is used, so answering `true` here grants nothing.\n\t *\n\t * The membership-parameterized actions are asked with an empty membership list, the same coarse\n\t * \"do you hold this at all\" question `apiKeys` and `members` already ask — which roles may\n\t * actually be granted is still decided per membership when the mutation runs.\n\t */\n\tasync permissions(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ProjectPermissions> {\n\t\tconst scope = await context.permissionContext.createProjectScope(parent)\n\t\tconst isAllowed = (action: Authorizator.Action) => context.permissionContext.isAllowed({ scope, action })\n\n\t\tconst [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise\n\t\t\t.all([\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_SECRETS),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_SET_SECRET),\n\t\t\t\tisAllowed(PermissionActions.API_KEY_CREATE),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE),\n\t\t\t])\n\n\t\treturn { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate }\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":["PermissionActions","ProjectApiKeysQuery","ApiKeyResponseFactory","UserInputError","schema","getRoleVariables","Acl"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAIC,gBAAAA,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAOC,sBAAAA,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQF,oCAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAIG,aAAAA,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAIA,aAAAA,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAIA,aAAAA,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACL,QACA,MACA,SAC8B;AAC9B,UAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AACvE,UAAM,YAAY,CAAC,WAAgC,QAAQ,kBAAkB,UAAU,EAAE,OAAO,QAAQ;AAExG,UAAM,CAAC,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,SAAS,IAAI,MAAM,QACvI,IAAI;AAAA,MACJ,UAAUH,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AAAA,MACnD,UAAUA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AAAA,MAClD,UAAUA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAUA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAUA,kBAAAA,kBAAkB,oBAAoB;AAAA,MAChD,UAAUA,kBAAAA,kBAAkB,kBAAkB;AAAA,MAC9C,UAAUA,kBAAAA,kBAAkB,cAAc;AAAA,MAC1C,UAAUA,kBAAAA,kBAAkB,cAAc;AAAA,IAAA,CAC1C;AAEF,WAAO,EAAE,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,UAAA;AAAA,EACzH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAMI,WAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAACA,UAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQA,SAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQC,YAAAA,iBAAiB,MAAMD,SAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAKE,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAKA,OAAAA,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;;"}

package/dist/production/src/resolvers/types/ProjectTypeResolver.js

@@ -10,6 +10,8 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { ProjectApiKeysQuery } from "../../model/queries/apiKey/ApiKeyListQuery.js";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import { getRoleVariables } from "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -17,7 +19,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import { getRoleVariables } from "@contember/schema-utils";
 import "otpauth";
 import { UserInputError } from "@contember/graphql-utils";
 import { ApiKeyResponseFactory } from "../responseHelpers/ApiKeyResponseFactory.js";
@@ -69,6 +70,29 @@ class ProjectTypeResolver {
       identity: { ...it.identity, projects: [], sessions: [] }
     }));
   }
+  /**
+   * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is
+   * checked again where it is used, so answering `true` here grants nothing.
+   *
+   * The membership-parameterized actions are asked with an empty membership list, the same coarse
+   * "do you hold this at all" question `apiKeys` and `members` already ask — which roles may
+   * actually be granted is still decided per membership when the mutation runs.
+   */
+  async permissions(parent, args, context) {
+    const scope = await context.permissionContext.createProjectScope(parent);
+    const isAllowed = (action) => context.permissionContext.isAllowed({ scope, action });
+    const [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise.all([
+      isAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),
+      isAllowed(PermissionActions.PROJECT_VIEW_SECRETS),
+      isAllowed(PermissionActions.PROJECT_SET_SECRET),
+      isAllowed(PermissionActions.API_KEY_CREATE),
+      isAllowed(PermissionActions.PROJECT_UPDATE)
+    ]);
+    return { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate };
+  }
   async roles(parent, args, context) {
     const schema = await this.projectSchemaResolver.getSchema(parent.slug);
     if (!schema) {

package/dist/production/src/resolvers/types/ProjectTypeResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAQO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}
+{"version":3,"file":"ProjectTypeResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/resolvers/types/ProjectTypeResolver.ts"],"sourcesContent":["import { ApiKey, ProjectIdentityRelation, ProjectMembersArgs, ProjectPermissions, ProjectResolvers, ProjectSecretInfo } from '../../schema/index.js'\nimport { Authorizator } from '@contember/authorization'\nimport { TenantResolverContext } from '../TenantResolverContext.js'\nimport { PermissionActions, Project, ProjectApiKeysQuery, ProjectMemberManager, ProjectSchemaResolver, SecretsManager } from '../../model/index.js'\nimport { getRoleVariables } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\nimport { UserInputError } from '@contember/graphql-utils'\nimport { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'\n\nexport class ProjectTypeResolver implements ProjectResolvers {\n\tconstructor(\n\t\tprivate readonly projectMemberManager: ProjectMemberManager,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly secretsManager: SecretsManager,\n\t) {}\n\n\tasync apiKeys(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ApiKey[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_MEMBER([]) }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await context.db.queryHandler.fetch(new ProjectApiKeysQuery(parent.id))\n\t\treturn rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))\n\t}\n\n\tasync secrets(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectSecretInfo[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tif (!(await context.permissionContext.isAllowed({ scope: projectScope, action: PermissionActions.PROJECT_VIEW_SECRETS }))) {\n\t\t\treturn []\n\t\t}\n\t\tconst rows = await this.secretsManager.listSecretKeys(context.db, parent.id)\n\t\treturn rows.map(it => ({ key: it.key, createdAt: it.created_at, updatedAt: it.updated_at }))\n\t}\n\n\tasync members(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: ProjectMembersArgs,\n\t\tcontext: TenantResolverContext,\n\t): Promise<readonly ProjectIdentityRelation[]> {\n\t\tconst projectScope = await context.permissionContext.createProjectScope(parent)\n\t\tconst verifier = context.permissionContext.createAccessVerifier(projectScope)\n\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([])))) {\n\t\t\treturn []\n\t\t}\n\t\tif (args.input?.filter?.email && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use email filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.input?.filter?.personId && args.input.filter.memberType === 'API_KEY') {\n\t\t\tthrow new UserInputError(`Cannot use personId  filter for ApiKey member type.`)\n\t\t}\n\t\tif (args.memberType && args.input) {\n\t\t\tthrow new UserInputError(`Cannot use both deprecated memberType parameter and new input parameter`)\n\t\t}\n\n\t\tconst members = await this.projectMemberManager.getProjectMembers(\n\t\t\tcontext.db,\n\t\t\tparent.id,\n\t\t\tverifier,\n\t\t\targs.input ?? { filter: { memberType: args.memberType } },\n\t\t)\n\t\treturn members.map(it => ({\n\t\t\t...it,\n\t\t\tidentity: { ...it.identity, projects: [], sessions: [] },\n\t\t}))\n\t}\n\n\t/**\n\t * Advisory, for building a UI that does not offer what it cannot deliver. Every one of these is\n\t * checked again where it is used, so answering `true` here grants nothing.\n\t *\n\t * The membership-parameterized actions are asked with an empty membership list, the same coarse\n\t * \"do you hold this at all\" question `apiKeys` and `members` already ask — which roles may\n\t * actually be granted is still decided per membership when the mutation runs.\n\t */\n\tasync permissions(\n\t\tparent: Omit<Project, 'config'>,\n\t\targs: unknown,\n\t\tcontext: TenantResolverContext,\n\t): Promise<ProjectPermissions> {\n\t\tconst scope = await context.permissionContext.createProjectScope(parent)\n\t\tconst isAllowed = (action: Authorizator.Action) => context.permissionContext.isAllowed({ scope, action })\n\n\t\tconst [canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate] = await Promise\n\t\t\t.all([\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_ADD_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_REMOVE_MEMBER([])),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_VIEW_SECRETS),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_SET_SECRET),\n\t\t\t\tisAllowed(PermissionActions.API_KEY_CREATE),\n\t\t\t\tisAllowed(PermissionActions.PROJECT_UPDATE),\n\t\t\t])\n\n\t\treturn { canViewMembers, canAddMember, canUpdateMember, canRemoveMember, canViewSecrets, canSetSecret, canCreateApiKey, canUpdate }\n\t}\n\n\tasync roles(parent: Omit<Project, 'config'>, args: unknown, context: TenantResolverContext) {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(parent.slug)\n\t\tif (!schema) {\n\t\t\treturn []\n\t\t}\n\t\treturn Object.entries(schema.acl.roles).map(([role, def]) => ({\n\t\t\tname: role,\n\t\t\tvariables: Object.entries(getRoleVariables(role, schema.acl)).map(([name, variableDef]) => {\n\t\t\t\tswitch (variableDef.type) {\n\t\t\t\t\tcase Acl.VariableType.entity:\n\t\t\t\t\t\treturn { __typename: 'RoleEntityVariableDefinition' as const, name, entityName: variableDef.entityName }\n\t\t\t\t\tcase Acl.VariableType.predefined:\n\t\t\t\t\t\treturn { __typename: 'RolePredefinedVariableDefinition' as const, name, value: variableDef.value }\n\t\t\t\t\tcase Acl.VariableType.condition:\n\t\t\t\t\t\treturn { __typename: 'RoleConditionVariableDefinition' as const, name }\n\t\t\t\t}\n\t\t\t}),\n\t\t}))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AASO,MAAM,oBAAgD;AAAA,EAC5D,YACkB,sBACA,uBACA,gBAChB;AAHgB,SAAA,uBAAA;AACA,SAAA,wBAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,QACA,MACA,SAC6B;AAC7B,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,oBAAoB,CAAA,CAAE,EAAA,CAAG,GAAI;AAC7H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,QAAQ,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,EAAE,CAAC;AACnF,WAAO,KAAK,IAAI,CAAA,QAAO,sBAAsB,qBAAqB,GAAG,CAAC;AAAA,EACvE;AAAA,EAEA,MAAM,QACL,QACA,MACA,SACwC;AACxC,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,QAAI,CAAE,MAAM,QAAQ,kBAAkB,UAAU,EAAE,OAAO,cAAc,QAAQ,kBAAkB,qBAAA,CAAsB,GAAI;AAC1H,aAAO,CAAA;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,eAAe,eAAe,QAAQ,IAAI,OAAO,EAAE;AAC3E,WAAO,KAAK,IAAI,CAAA,QAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,YAAY,WAAW,GAAG,aAAa;AAAA,EAC5F;AAAA,EAEA,MAAM,QACL,QACA,MACA,SAC8C;AAC9C,UAAM,eAAe,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AAC9E,UAAM,WAAW,QAAQ,kBAAkB,qBAAqB,YAAY;AAC5E,QAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAA,CAAE,CAAC,GAAI;AACjE,aAAO,CAAA;AAAA,IACR;AACA,QAAI,KAAK,OAAO,QAAQ,SAAS,KAAK,MAAM,OAAO,eAAe,WAAW;AAC5E,YAAM,IAAI,eAAe,iDAAiD;AAAA,IAC3E;AACA,QAAI,KAAK,OAAO,QAAQ,YAAY,KAAK,MAAM,OAAO,eAAe,WAAW;AAC/E,YAAM,IAAI,eAAe,qDAAqD;AAAA,IAC/E;AACA,QAAI,KAAK,cAAc,KAAK,OAAO;AAClC,YAAM,IAAI,eAAe,yEAAyE;AAAA,IACnG;AAEA,UAAM,UAAU,MAAM,KAAK,qBAAqB;AAAA,MAC/C,QAAQ;AAAA,MACR,OAAO;AAAA,MACP;AAAA,MACA,KAAK,SAAS,EAAE,QAAQ,EAAE,YAAY,KAAK,aAAW;AAAA,IAAE;AAEzD,WAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MACzB,GAAG;AAAA,MACH,UAAU,EAAE,GAAG,GAAG,UAAU,UAAU,CAAA,GAAI,UAAU,CAAA,EAAC;AAAA,IAAE,EACtD;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,YACL,QACA,MACA,SAC8B;AAC9B,UAAM,QAAQ,MAAM,QAAQ,kBAAkB,mBAAmB,MAAM;AACvE,UAAM,YAAY,CAAC,WAAgC,QAAQ,kBAAkB,UAAU,EAAE,OAAO,QAAQ;AAExG,UAAM,CAAC,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,SAAS,IAAI,MAAM,QACvI,IAAI;AAAA,MACJ,UAAU,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AAAA,MACnD,UAAU,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AAAA,MAClD,UAAU,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAU,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAAA,MACrD,UAAU,kBAAkB,oBAAoB;AAAA,MAChD,UAAU,kBAAkB,kBAAkB;AAAA,MAC9C,UAAU,kBAAkB,cAAc;AAAA,MAC1C,UAAU,kBAAkB,cAAc;AAAA,IAAA,CAC1C;AAEF,WAAO,EAAE,gBAAgB,cAAc,iBAAiB,iBAAiB,gBAAgB,cAAc,iBAAiB,UAAA;AAAA,EACzH;AAAA,EAEA,MAAM,MAAM,QAAiC,MAAe,SAAgC;AAC3F,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,OAAO,IAAI;AACrE,QAAI,CAAC,QAAQ;AACZ,aAAO,CAAA;AAAA,IACR;AACA,WAAO,OAAO,QAAQ,OAAO,IAAI,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;AAAA,MAC7D,MAAM;AAAA,MACN,WAAW,OAAO,QAAQ,iBAAiB,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,WAAW,MAAM;AAC1F,gBAAQ,YAAY,MAAA;AAAA,UACnB,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,gCAAyC,MAAM,YAAY,YAAY,WAAA;AAAA,UAC7F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,oCAA6C,MAAM,OAAO,YAAY,MAAA;AAAA,UAC5F,KAAK,IAAI,aAAa;AACrB,mBAAO,EAAE,YAAY,mCAA4C,KAAA;AAAA,QAAK;AAAA,MAEzE,CAAC;AAAA,IAAA,EACA;AAAA,EACH;AACD;"}