@paroicms/server 1.109.5 → 1.110.0

package/dist/admin-backend/account/account.resolver.js

@@ -1,13 +1,16 @@
 import { ApiError } from "@paroicms/public-server-lib";
 import { siteReadyGuard } from "../../graphql/graphql.types.js";
 import { authGuard, verifyAccessToken } from "../auth/auth.helper.js";
+import { permissionGuard } from "../auth/authorization.helper.js";
+import { loadAccountPermissions, loadAccountRoles } from "../auth/special-account.helper.js";
+import { recordEvent } from "../event-log/event-log.service.js";
 import { formatAccountType } from "./account.formatters.js";
-import { createAccount, deleteAccount, getAccount, getAllAccounts, getAuthenticatedAccount, resetAccountPassword, setAccountPreferences, updateAccount, } from "./account.queries.js";
+import { createAccount, deleteAccount, getAccount, getAllAccounts, getAuthenticatedAccount, resetAccountPassword, setAccountPreferences, updateAccount, updateAccountActive, } from "./account.queries.js";
 export const accountResolvers = {
     Query: {
         account: async (_parent, { id }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.manageUsers");
             const acccount = await getAccount(siteContext, id);
             return acccount;
         },
@@ -25,50 +28,163 @@ export const accountResolvers = {
             return await getAuthenticatedAccount(siteContext, payload.id);
         },
         allAccounts: async (_parent, _values, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.manageUsers");
             return await getAllAccounts(siteContext);
         },
     },
     Mutation: {
         createAccount: async (_parent, { values }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
-            return await createAccount(siteContext, {
+            const authorizedAccount = await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            const newAccount = await createAccount(siteContext, {
                 accountType: formatAccountType(values.accountType),
                 email: values.email,
                 language: values.language,
                 name: values.name ?? undefined,
             });
+            recordEvent(siteContext, {
+                eventType: "account.create",
+                actorId: authorizedAccount.accountId,
+                targetType: "account",
+                targetId: newAccount.id,
+                eventData: {
+                    accountId: newAccount.id,
+                    email: newAccount.email,
+                    name: newAccount.name,
+                },
+            });
+            return newAccount;
         },
         updateAccount: async (_parent, { accountId, values }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
-            return await updateAccount(siteContext, accountId, {
+            const authorizedAccount = await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            const accountToUpdate = await getAccount(siteContext, accountId);
+            if (["localDev", "platformAdmin"].includes(accountToUpdate.loginMethod ?? "")) {
+                throw new ApiError("Cannot update special accounts", 403);
+            }
+            if (!accountToUpdate.active) {
+                throw new ApiError("Cannot update inactive accounts", 403);
+            }
+            const oldAccount = accountToUpdate;
+            const changedFields = [];
+            if (values.name !== undefined && values.name !== oldAccount.name) {
+                changedFields.push("name");
+            }
+            if (values.email !== undefined && values.email !== oldAccount.email) {
+                changedFields.push("email");
+            }
+            const updatedAccount = await updateAccount(siteContext, accountId, {
                 email: values.email ?? undefined,
                 name: values.name ?? undefined,
             });
+            if (changedFields.length > 0) {
+                recordEvent(siteContext, {
+                    eventType: "account.update",
+                    actorId: authorizedAccount.accountId,
+                    targetType: "account",
+                    targetId: accountId,
+                    eventData: {
+                        accountId,
+                        email: updatedAccount.email,
+                        changedFields,
+                    },
+                });
+            }
+            return updatedAccount;
         },
         deleteAccount: async (_parent, { accountId }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            const authorizedAccount = await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            const account = await getAccount(siteContext, accountId);
+            if (!account.active) {
+                throw new ApiError("Cannot delete inactive accounts", 403);
+            }
             await deleteAccount(siteContext, accountId);
+            recordEvent(siteContext, {
+                eventType: "account.delete",
+                actorId: authorizedAccount.accountId,
+                targetType: "account",
+                targetId: accountId,
+                eventData: {
+                    accountId,
+                    email: account.email,
+                    name: account.name,
+                },
+            });
+            return true;
+        },
+        reactivateAccount: async (_parent, { accountId }, { siteContext, httpContext }) => {
+            siteReadyGuard(siteContext);
+            const authorizedAccount = await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            const account = await getAccount(siteContext, accountId);
+            if (account.active) {
+                throw new ApiError("Account is already active", 400);
+            }
+            await updateAccountActive(siteContext, accountId, true);
+            recordEvent(siteContext, {
+                eventType: "account.update",
+                actorId: authorizedAccount.accountId,
+                targetType: "account",
+                targetId: accountId,
+                eventData: {
+                    accountId,
+                    email: account.email,
+                    changedFields: ["active"],
+                },
+            });
             return true;
         },
         resetAccountPassword: async (_parent, { accountId }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            const authorizedAccount = await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            const account = await getAccount(siteContext, accountId);
+            if (account.loginMethod && ["localDev", "platformAdmin"].includes(account.loginMethod)) {
+                throw new ApiError("Cannot reset password for special accounts", 403);
+            }
             await resetAccountPassword(siteContext, accountId);
+            recordEvent(siteContext, {
+                eventType: "account.update",
+                actorId: authorizedAccount.accountId,
+                targetType: "account",
+                targetId: accountId,
+                eventData: {
+                    accountId,
+                    email: account.email,
+                    changedFields: ["passwordReset"],
+                },
+            });
             return true;
         },
         setAccountPreferences: async (_parent, { accountId, values }, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            const account = await permissionGuard(siteContext, httpContext, "document.edit");
+            if (accountId !== account.accountId && !account.permissions.includes("site.manageUsers")) {
+                throw new ApiError("Cannot modify other users' preferences", 403);
+            }
             await setAccountPreferences(siteContext, accountId, {
                 language: values.language ?? undefined,
+                currentAuthorNodeId: values.currentAuthorNodeId ?? undefined,
             });
             return accountId;
         },
     },
+    AuthenticatedAccount: {
+        roles: async (parent, _args, { siteContext }) => {
+            return await loadAccountRoles(siteContext, parent);
+        },
+        permissions: async (parent, _args, { siteContext }) => {
+            return await loadAccountPermissions(siteContext, parent);
+        },
+        active: () => {
+            return true;
+        },
+        loginMethod: (parent) => {
+            if (!parent.loginMethod) {
+                throw new ApiError("loginMethod is required for authenticated accounts", 500);
+            }
+            return parent.loginMethod;
+        },
+    },
 };
 //# sourceMappingURL=account.resolver.js.map

package/dist/admin-backend/account/account.resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.resolver.js","sourceRoot":"","sources":["../../../src/admin-backend/account/account.resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D,KAAK,EAAE;QACL,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC/D,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpE,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,QAAQ,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpE,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;KACF;IACD,QAAQ,EAAE;QACR,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACzE,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,MAAM,aAAa,CAAC,WAAW,EAAE;gBACtC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;gBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpF,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,OAAO,MAAM,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE;gBACjD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5E,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACnF,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACnD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5F,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,qBAAqB,CAAC,WAAW,EAAE,SAAS,EAAE;gBAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;aACvC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF;CACF,CAAC"}
+{"version":3,"file":"account.resolver.js","sourceRoot":"","sources":["../../../src/admin-backend/account/account.resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAC7F,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAMhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EACL,aAAa,EACb,aAAa,EACb,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,aAAa,EACb,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,MAAM,gBAAgB,GAAiC;IAC5D,KAAK,EAAE;QACL,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC/D,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpE,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,QAAQ,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,MAAM,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpE,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpE,OAAO,MAAM,cAAc,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;KACF;IACD,QAAQ,EAAE;QACR,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACzE,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAC9F,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE;gBAClD,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,WAAW,CAAC;gBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC,CAAC;YAEH,WAAW,CAAC,WAAW,EAAE;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,iBAAiB,CAAC,SAAS;gBACpC,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,SAAS,EAAE;oBACT,SAAS,EAAE,UAAU,CAAC,EAAE;oBACxB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,IAAI,EAAE,UAAU,CAAC,IAAI;iBACY;aACpC,CAAC,CAAC;YAEH,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACpF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAE9F,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,GAAG,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,UAAU,GAAG,eAAe,CAAC;YACnC,MAAM,aAAa,GAAa,EAAE,CAAC;YAEnC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACjE,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;gBACpE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE;gBACjE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,SAAS;gBAChC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,SAAS;aAC/B,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,WAAW,EAAE;oBACvB,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,iBAAiB,CAAC,SAAS;oBACpC,UAAU,EAAE,SAAS;oBACrB,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE;wBACT,SAAS;wBACT,KAAK,EAAE,cAAc,CAAC,KAAK;wBAC3B,aAAa;qBACoB;iBACpC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5E,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAE9F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAEzD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,IAAI,QAAQ,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAE5C,WAAW,CAAC,WAAW,EAAE;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,iBAAiB,CAAC,SAAS;gBACpC,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE;oBACT,SAAS;oBACT,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACe;aACpC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAChF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAE9F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAEzD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACnB,MAAM,IAAI,QAAQ,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAExD,WAAW,CAAC,WAAW,EAAE;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,iBAAiB,CAAC,SAAS;gBACpC,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE;oBACT,SAAS;oBACT,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,aAAa,EAAE,CAAC,QAAQ,CAAC;iBACQ;aACpC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YACnF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,iBAAiB,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAE9F,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAEzD,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvF,MAAM,IAAI,QAAQ,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,oBAAoB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAEnD,WAAW,CAAC,WAAW,EAAE;gBACvB,SAAS,EAAE,gBAAgB;gBAC3B,OAAO,EAAE,iBAAiB,CAAC,SAAS;gBACpC,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,SAAS;gBACnB,SAAS,EAAE;oBACT,SAAS;oBACT,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,aAAa,EAAE,CAAC,eAAe,CAAC;iBACC;aACpC,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC5F,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;YACjF,IAAI,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACzF,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,qBAAqB,CAAC,WAAW,EAAE,SAAS,EAAE;gBAClD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;gBACtC,mBAAmB,EAAE,MAAM,CAAC,mBAAmB,IAAI,SAAS;aAC7D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;KACF;IAED,oBAAoB,EAAE;QACpB,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YAC9C,OAAO,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YACpD,OAAO,MAAM,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,GAAG,EAAE;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE;YACtB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;gBACxB,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE,GAAG,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;KACF;CACF,CAAC"}

package/dist/admin-backend/account/author-account.queries.d.ts

@@ -0,0 +1,12 @@
+import type { Account } from "../../common/data-format.js";
+import type { SiteContext } from "../../site-context/site-context.types.js";
+export interface AuthorNode {
+    nodeId: string;
+    title?: string;
+}
+export declare function linkAuthorToAccount(siteContext: Pick<SiteContext, "cn">, authorNodeId: string, accountId: string): Promise<void>;
+export declare function unlinkAuthorFromAccount(siteContext: Pick<SiteContext, "cn">, authorNodeId: string, accountId: string): Promise<void>;
+export declare function getLinkedAuthors(siteContext: Pick<SiteContext, "cn">, accountId: string): Promise<AuthorNode[]>;
+export declare function getLinkedAccounts(siteContext: Pick<SiteContext, "cn">, authorNodeId: string): Promise<Account[]>;
+export declare function setCurrentAuthor(siteContext: Pick<SiteContext, "cn">, accountId: string, authorNodeId: string | undefined): Promise<void>;
+export declare function getCurrentAuthor(siteContext: Pick<SiteContext, "cn">, accountId: string): Promise<AuthorNode | undefined>;

package/dist/admin-backend/account/author-account.queries.js

@@ -0,0 +1,110 @@
+import { type } from "arktype";
+import { AccountPreferencesAT, formatAccount } from "../../common/data-format.js";
+const AuthorNodeRowAT = type({
+    nodeId: "number",
+    title: "string|null",
+    "+": "reject",
+}).pipe((r) => ({
+    nodeId: String(r.nodeId),
+    title: r.title ?? undefined,
+}));
+const AccountRowAT = type({
+    id: "number",
+    email: "string",
+    name: "string|null",
+    preferences: "string|null",
+    passwordResetToken: "string|null",
+    active: "0|1",
+    "+": "reject",
+}).pipe((r) => ({
+    id: String(r.id),
+    email: r.email,
+    name: r.name ?? undefined,
+    preferences: r.preferences ?? undefined,
+    passwordResetToken: r.passwordResetToken ?? undefined,
+    active: r.active === 1,
+}));
+export async function linkAuthorToAccount(siteContext, authorNodeId, accountId) {
+    await siteContext.cn("PaAuthorAccount").insert({
+        authorNodeId,
+        accountId,
+    });
+}
+export async function unlinkAuthorFromAccount(siteContext, authorNodeId, accountId) {
+    await siteContext.cn("PaAuthorAccount").where({ authorNodeId, accountId }).delete();
+}
+export async function getLinkedAuthors(siteContext, accountId) {
+    const rows = await siteContext
+        .cn("PaAuthorAccount as aa")
+        .innerJoin("PaNode as n", "n.id", "aa.authorNodeId")
+        .leftJoin("PaDocument as d", function () {
+        this.on("d.nodeId", "=", "n.id").andOn("d.language", "=", siteContext.cn.raw("?", ["en"]));
+    })
+        .select("n.id as nodeId", "d.title")
+        .where("aa.accountId", accountId);
+    return rows.map((row) => AuthorNodeRowAT.assert(row));
+}
+export async function getLinkedAccounts(siteContext, authorNodeId) {
+    const rows = await siteContext
+        .cn("PaAuthorAccount as aa")
+        .innerJoin("PaAccount as a", "a.id", "aa.accountId")
+        .select("a.id", "a.email", "a.name", "a.preferences", "a.passwordResetToken", "a.active")
+        .where("aa.authorNodeId", authorNodeId);
+    return rows.map((row) => formatAccount(AccountRowAT.assert(row)));
+}
+export async function setCurrentAuthor(siteContext, accountId, authorNodeId) {
+    const account = await siteContext
+        .cn("PaAccount")
+        .select("preferences")
+        .where("id", accountId)
+        .first();
+    if (!account)
+        return;
+    const PreferencesRowAT = type({
+        preferences: "string|null",
+        "+": "reject",
+    }).pipe((r) => ({
+        preferences: r.preferences ?? undefined,
+    }));
+    const validatedRow = PreferencesRowAT.assert(account);
+    const currentPreferences = validatedRow.preferences
+        ? AccountPreferencesAT.assert(JSON.parse(validatedRow.preferences))
+        : {};
+    const newPreferences = {
+        ...currentPreferences,
+        currentAuthorNodeId: authorNodeId,
+    };
+    await siteContext
+        .cn("PaAccount")
+        .where("id", accountId)
+        .update({ preferences: JSON.stringify(newPreferences) });
+}
+export async function getCurrentAuthor(siteContext, accountId) {
+    const linkedAuthors = await getLinkedAuthors(siteContext, accountId);
+    if (linkedAuthors.length === 0)
+        return;
+    if (linkedAuthors.length === 1)
+        return linkedAuthors[0];
+    const account = await siteContext
+        .cn("PaAccount")
+        .select("preferences")
+        .where("id", accountId)
+        .first();
+    if (!account)
+        return;
+    const PreferencesRowAT = type({
+        preferences: "string|null",
+        "+": "reject",
+    }).pipe((r) => ({
+        preferences: r.preferences ?? undefined,
+    }));
+    const validatedRow = PreferencesRowAT.assert(account);
+    if (!validatedRow.preferences)
+        return;
+    const preferences = AccountPreferencesAT.assert(JSON.parse(validatedRow.preferences));
+    if (!preferences.currentAuthorNodeId)
+        return;
+    const currentAuthor = linkedAuthors.find((author) => author.nodeId === preferences.currentAuthorNodeId);
+    return currentAuthor;
+}
+//# sourceMappingURL=author-account.queries.js.map

package/dist/admin-backend/account/author-account.queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"author-account.queries.js","sourceRoot":"","sources":["../../../src/admin-backend/account/author-account.queries.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAQlF,MAAM,eAAe,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,aAAa;IACpB,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACd,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS;CAC5B,CAAC,CAAC,CAAC;AAEJ,MAAM,YAAY,GAAG,IAAI,CAAC;IACxB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,aAAa;IAC1B,kBAAkB,EAAE,aAAa;IACjC,MAAM,EAAE,KAAK;IACb,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACd,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAChB,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,SAAS;IACzB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;IACvC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,IAAI,SAAS;IACrD,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;CACvB,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAoC,EACpC,YAAoB,EACpB,SAAiB;IAEjB,MAAM,WAAW,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;QAC7C,YAAY;QACZ,SAAS;KACV,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAoC,EACpC,YAAoB,EACpB,SAAiB;IAEjB,MAAM,WAAW,CAAC,EAAE,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,WAAW;SAC3B,EAAE,CAAC,uBAAuB,CAAC;SAC3B,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,iBAAiB,CAAC;SACnD,QAAQ,CAAC,iBAAiB,EAAE;QAC3B,IAAI,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC;SACD,MAAM,CAAC,gBAAgB,EAAE,SAAS,CAAC;SACnC,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IAEpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAoC,EACpC,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,WAAW;SAC3B,EAAE,CAAC,uBAAuB,CAAC;SAC3B,SAAS,CAAC,gBAAgB,EAAE,MAAM,EAAE,cAAc,CAAC;SACnD,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,sBAAsB,EAAE,UAAU,CAAC;SACxF,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IAE1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAiB,EACjB,YAAgC;IAEhC,MAAM,OAAO,GAAG,MAAM,WAAW;SAC9B,EAAE,CAAC,WAAW,CAAC;SACf,MAAM,CAAC,aAAa,CAAC;SACrB,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;SACtB,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,gBAAgB,GAAG,IAAI,CAAC;QAC5B,WAAW,EAAE,aAAa;QAC1B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;KACxC,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtD,MAAM,kBAAkB,GAAuB,YAAY,CAAC,WAAW;QACrE,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACnE,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,cAAc,GAAuB;QACzC,GAAG,kBAAkB;QACrB,mBAAmB,EAAE,YAAY;KAClC,CAAC;IAEF,MAAM,WAAW;SACd,EAAE,CAAC,WAAW,CAAC;SACf,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAiB;IAEjB,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAErE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEvC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,WAAW;SAC9B,EAAE,CAAC,WAAW,CAAC;SACf,MAAM,CAAC,aAAa,CAAC;SACrB,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC;SACtB,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,gBAAgB,GAAG,IAAI,CAAC;QAC5B,WAAW,EAAE,aAAa;QAC1B,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACd,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;KACxC,CAAC,CAAC,CAAC;IAEJ,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,YAAY,CAAC,WAAW;QAAE,OAAO;IAEtC,MAAM,WAAW,GAAuB,oBAAoB,CAAC,MAAM,CACjE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,CACrC,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,mBAAmB;QAAE,OAAO;IAE7C,MAAM,aAAa,GAAG,aAAa,CAAC,IAAI,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,mBAAmB,CAC9D,CAAC;IAEF,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/admin-backend/account/author-account.resolver.d.ts

@@ -0,0 +1,3 @@
+import type { GqlResolvers } from "../../graphql/generated-graphql-types.d.ts";
+import { type GraphqlContext } from "../../graphql/graphql.types.js";
+export declare const authorAccountResolvers: GqlResolvers<GraphqlContext>;

package/dist/admin-backend/account/author-account.resolver.js

@@ -0,0 +1,39 @@
+import { siteReadyGuard } from "../../graphql/graphql.types.js";
+import { permissionGuard } from "../auth/authorization.helper.js";
+import { getCurrentAuthor, getLinkedAccounts, getLinkedAuthors, linkAuthorToAccount, setCurrentAuthor, unlinkAuthorFromAccount, } from "./author-account.queries.js";
+export const authorAccountResolvers = {
+    Mutation: {
+        linkAuthorToAccount: async (_parent, { authorNodeId, accountId }, { siteContext, httpContext }) => {
+            siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            await linkAuthorToAccount(siteContext, authorNodeId, accountId);
+            return true;
+        },
+        unlinkAuthorFromAccount: async (_parent, { authorNodeId, accountId }, { siteContext, httpContext }) => {
+            siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            await unlinkAuthorFromAccount(siteContext, authorNodeId, accountId);
+            return true;
+        },
+        setCurrentAuthor: async (_parent, { accountId, authorNodeId }, { siteContext, httpContext }) => {
+            siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.manageUsers");
+            await setCurrentAuthor(siteContext, accountId, authorNodeId ?? undefined);
+            return true;
+        },
+    },
+    Account: {
+        linkedAuthors: async (parent, _args, { siteContext }) => {
+            return await getLinkedAuthors(siteContext, parent.id);
+        },
+        currentAuthor: async (parent, _args, { siteContext }) => {
+            return (await getCurrentAuthor(siteContext, parent.id)) ?? null;
+        },
+    },
+    Author: {
+        linkedAccounts: async (parent, _args, { siteContext }) => {
+            return await getLinkedAccounts(siteContext, parent.nodeId);
+        },
+    },
+};
+//# sourceMappingURL=author-account.resolver.js.map

package/dist/admin-backend/account/author-account.resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"author-account.resolver.js","sourceRoot":"","sources":["../../../src/admin-backend/account/author-account.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC,MAAM,CAAC,MAAM,sBAAsB,GAAiC;IAClE,QAAQ,EAAE;QACR,mBAAmB,EAAE,KAAK,EACxB,OAAO,EACP,EAAE,YAAY,EAAE,SAAS,EAAE,EAC3B,EAAE,WAAW,EAAE,WAAW,EAAE,EAC5B,EAAE;YACF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpE,MAAM,mBAAmB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB,EAAE,KAAK,EAC5B,OAAO,EACP,EAAE,YAAY,EAAE,SAAS,EAAE,EAC3B,EAAE,WAAW,EAAE,WAAW,EAAE,EAC5B,EAAE;YACF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpE,MAAM,uBAAuB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,gBAAgB,EAAE,KAAK,EACrB,OAAO,EACP,EAAE,SAAS,EAAE,YAAY,EAAE,EAC3B,EAAE,WAAW,EAAE,WAAW,EAAE,EAC5B,EAAE;YACF,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;YACpE,MAAM,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;KACF;IAED,OAAO,EAAE;QACP,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YACtD,OAAO,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;QAClE,CAAC;KACF;IAED,MAAM,EAAE;QACN,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YACvD,OAAO,MAAM,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;KACF;CACF,CAAC"}

package/dist/admin-backend/auth/auth.helper.d.ts

@@ -1,9 +1,11 @@
+import type { LoginMethod } from "@paroicms/public-anywhere-lib";
 import type { PaHttpContext } from "@paroicms/public-server-lib";
 import type { Request, Response } from "express";
 export interface BearerTokenPayload {
     id: string;
     email: string;
     fqdn: string;
+    loginMethod: LoginMethod;
 }
 export declare function authGuard(httpContext: PaHttpContext): BearerTokenPayload;
 export interface GoogleUser {

package/dist/admin-backend/auth/auth.helper.js

@@ -1,8 +1,16 @@
 import { isObj } from "@paroicms/public-anywhere-lib";
 import { ApiError } from "@paroicms/public-server-lib";
+import { type } from "arktype";
 import passport from "passport";
 import { jwtExpiresIn, jwtSecret, platformJwtSecret } from "../../context.js";
 const { sign, verify } = (await import("jsonwebtoken")).default;
+const BearerTokenPayloadAT = type({
+    id: "string",
+    email: "string",
+    fqdn: "string",
+    loginMethod: '"local"|"localDev"|"platform"|"platformAdmin"',
+    "+": "ignore",
+});
 export function authGuard(httpContext) {
     const { req } = httpContext;
     const authorization = req.headers.authorization;
@@ -12,7 +20,7 @@ export function authGuard(httpContext) {
     const token = authorization.substring(7);
     let payload;
     try {
-        payload = verify(token, jwtSecret);
+        payload = BearerTokenPayloadAT.assert(verify(token, jwtSecret));
     }
     catch {
         throw new ApiError("Unauthorized", 401);
@@ -38,7 +46,7 @@ function isGoogleUser(user) {
 }
 export function verifyAccessToken(token) {
     try {
-        return verify(token, jwtSecret);
+        return BearerTokenPayloadAT.assert(verify(token, jwtSecret));
     }
     catch {
         throw new ApiError("Invalid token", 401);

package/dist/admin-backend/auth/auth.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/auth.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAEvD,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;AAQhE,MAAM,UAAU,SAAS,CAAC,WAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC;IAC5B,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAEhD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEzC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAuB,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,EAAE,SAAS,CAAuB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAe,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"auth.helper.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/auth.helper.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,+BAA+B,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;AAShE,MAAM,oBAAoB,GAAG,IAAI,CAAC;IAChC,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,+CAA+C;IAC5D,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,MAAM,UAAU,SAAS,CAAC,WAA0B;IAClD,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC;IAC5B,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAEhD,IAAI,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEzC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAMD,MAAM,UAAU,eAAe,CAAC,GAAY,EAAE,GAAa;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACvE,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,MAAM,CAAC,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,aAAqB;IACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAe,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAA2B;IAC7D,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAmB;IACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,MAAM,IAAI,QAAQ,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/admin-backend/auth/auth.service.d.ts

@@ -1,6 +1,6 @@
 import type { SiteContext } from "../../site-context/site-context.types.js";
 import type { LoginFailed, LoginInput, LoginSuccess } from "./auth.types.js";
-export declare function loginUser(siteContext: Pick<SiteContext, "cn" | "logger" | "fqdn">, options: {
+export declare function loginLocalUser(siteContext: Pick<SiteContext, "cn" | "logger" | "fqdn">, options: {
     user: LoginInput;
     defaultLanguage: string;
 }): Promise<LoginSuccess | LoginFailed>;