@paroicms/server 1.109.6 → 1.110.1

package/dist/admin-backend/auth/auth.service.js

@@ -1,39 +1,56 @@
+import { messageOf } from "@paroicms/public-anywhere-lib";
 import { ApiError } from "@paroicms/public-server-lib";
-import { type } from "arktype";
 import { AccountPreferencesAT } from "../../common/data-format.js";
 import { appConf } from "../../context.js";
 import { comparePassword } from "../../helpers/passwordEncrypt-helper.js";
-import { devAccountId, getDevAccount, getPlatformAdminAccount, isDevAccountId, parsePlatformAdminAccountId, } from "../../helpers/special-account.helpers.js";
-import { generateAdminToken } from "../../protected-site/protected-access-token.js";
-import { findAccountByEmail, findAccountByIdAndEmail } from "../account/account.queries.js";
+import { generateAdminUiToken } from "../../protected-site/protected-access-token.js";
+import { findAccountByEmail, findAccountByIdAndEmail, insertSpecialAccount, updateAccountActive, updateAccountLoginMethod, } from "../account/account.queries.js";
+import { recordEvent } from "../event-log/event-log.service.js";
 import { generateAccessToken, verifyAccessToken, verifyPlatformToken, } from "./auth.helper.js";
-const JwtPayloadAT = type({
-    id: "string",
-    email: "string",
-    "+": "reject",
-});
-export async function loginUser(siteContext, options) {
+import { isSpecialAccountEmail } from "./special-account.helper.js";
+export async function loginLocalUser(siteContext, options) {
     const { user, defaultLanguage } = options;
+    const normalizedEmail = user.email.trim().toLowerCase();
+    const isLocalDevAccount = appConf.localDevAccount?.email === normalizedEmail;
     let account;
-    if (appConf.devAccount?.email === user.email) {
-        account = validateDevAccount({
-            user,
-            devAccount: appConf.devAccount,
-        });
+    if (isLocalDevAccount) {
+        if (appConf.localDevAccount?.password !== user.password) {
+            return { message: "Unauthorized", statusCode: 401 };
+        }
+        account = await findAccountByEmail(siteContext, normalizedEmail);
+        if (!account) {
+            account = await createLocalDevAccountInDatabase(siteContext, normalizedEmail);
+        }
+        if (account.loginMethod !== "localDev") {
+            return { message: "Login method mismatch", statusCode: 401 };
+        }
     }
     else {
-        account = await validateUser(siteContext, user);
+        const localAccount = await findAccountByEmail(siteContext, normalizedEmail);
+        if (localAccount?.loginMethod === "localDev" && !isSpecialAccountEmail(localAccount.email)) {
+            return await deactivateLegacySpecialAccount(siteContext, localAccount);
+        }
+        if (localAccount?.passwordHash) {
+            if (!(await comparePassword(user.password, localAccount.passwordHash))) {
+                return { message: "Unauthorized", statusCode: 401 };
+            }
+            account = localAccount;
+        }
     }
     if (!account) {
-        return {
-            message: "Unauthorized",
-            statusCode: 401,
-        };
+        return { message: "Unauthorized", statusCode: 401 };
+    }
+    if (!account.active) {
+        return { message: "Account is not active", statusCode: 401 };
+    }
+    const loginMethod = isLocalDevAccount ? "localDev" : "local";
+    if (account.loginMethod === undefined) {
+        await updateAccountLoginMethod(siteContext, account.id, loginMethod);
     }
     const parsedPreferences = account.preferences
         ? AccountPreferencesAT.assert(JSON.parse(account.preferences))
         : undefined;
-    const adminToken = await generateAdminToken();
+    const adminUiToken = await generateAdminUiToken();
     return {
         id: account.id,
         email: account.email,
@@ -43,8 +60,10 @@ export async function loginUser(siteContext, options) {
             email: account.email,
             id: account.id,
             fqdn: siteContext.fqdn,
+            loginMethod,
         }),
-        adminToken,
+        adminUiToken,
+        loginMethod,
     };
 }
 export async function getVerifiedAccountFromToken(siteContext, options) {
@@ -55,34 +74,30 @@ export async function getVerifiedAccountFromToken(siteContext, options) {
         if (payload.fqdn !== siteContext.fqdn) {
             throw new ApiError("Not the right token", 403);
         }
-        let account;
-        const parsedPlatformAccountId = parsePlatformAdminAccountId(payload.id);
-        if (isDevAccountId(payload.id)) {
-            account = getDevAccount(payload.id);
-        }
-        else if (parsedPlatformAccountId) {
-            account = getPlatformAdminAccount(parsedPlatformAccountId);
-        }
-        else {
-            const validated = JwtPayloadAT.assert(payload);
-            account = await findAccountByIdAndEmail(siteContext, validated);
+        const account = await findAccountByIdAndEmail(siteContext, {
+            id: payload.id,
+            email: payload.email,
+        });
+        if (account.loginMethod !== payload.loginMethod) {
+            throw new ApiError("Login method mismatch", 403);
         }
         const parsedPreferences = account.preferences
             ? AccountPreferencesAT.assert(JSON.parse(account.preferences))
             : undefined;
-        const adminToken = await generateAdminToken();
+        const adminUiToken = await generateAdminUiToken();
         return {
             email: account.email,
             id: account.id,
             language: parsedPreferences?.language ?? defaultLanguage,
             name: account.name,
             token,
-            adminToken,
+            adminUiToken,
+            loginMethod: payload.loginMethod,
         };
     }
-    catch {
+    catch (error) {
         if (payload) {
-            siteContext.logger.warn(`Invalid token: ${JSON.stringify(payload)}`);
+            siteContext.logger.warn(`Invalid token: ${JSON.stringify(payload)}:`, messageOf(error));
         }
         return {
             statusCode: 401,
@@ -94,33 +109,52 @@ export async function loginByPlatformToken(siteContext, options) {
     try {
         const { token, defaultLanguage } = options;
         const payload = verifyPlatformToken(token);
+        const normalizedEmail = payload.email.trim().toLowerCase();
+        const platAdmAccountIndex = (appConf.platformAdminAccounts ?? []).findIndex((acc) => acc.email.trim().toLowerCase() === normalizedEmail);
+        const isPlatformAdmin = platAdmAccountIndex !== -1;
         let account;
-        const platAdmAccountIndex = (appConf.platformAdminAccounts ?? []).findIndex((account) => account.email === payload.email);
-        if (platAdmAccountIndex !== -1) {
-            account = getPlatformAdminAccount({ index: platAdmAccountIndex });
+        if (isPlatformAdmin) {
+            account = await findAccountByEmail(siteContext, normalizedEmail);
+            if (!account) {
+                account = await createPlatformAdminAccountInDatabase(siteContext, normalizedEmail, platAdmAccountIndex);
+            }
+            if (account.loginMethod !== "platformAdmin") {
+                return { message: "Login method mismatch", statusCode: 401 };
+            }
         }
         else {
-            const foundAccount = await findAccountByEmail(siteContext, payload.email);
-            if (!foundAccount) {
+            account = await findAccountByEmail(siteContext, normalizedEmail);
+            if (!account) {
                 throw new ApiError("Account not found", 404);
             }
-            account = foundAccount;
+            if (account.loginMethod === "platformAdmin" && !isSpecialAccountEmail(account.email)) {
+                return await deactivateLegacySpecialAccount(siteContext, account);
+            }
+        }
+        if (!account.active) {
+            return { message: "Account is not active", statusCode: 401 };
+        }
+        const loginMethod = isPlatformAdmin ? "platformAdmin" : "platform";
+        if (account.loginMethod === undefined) {
+            await updateAccountLoginMethod(siteContext, account.id, loginMethod);
         }
         const parsedPreferences = account.preferences
             ? AccountPreferencesAT.assert(JSON.parse(account.preferences))
             : undefined;
-        const adminToken = await generateAdminToken();
+        const adminUiToken = await generateAdminUiToken();
         return {
             id: account.id,
-            email: payload.email,
+            email: normalizedEmail,
             language: parsedPreferences?.language ?? defaultLanguage,
             name: account.name,
             token: generateAccessToken({
-                email: payload.email,
+                email: normalizedEmail,
                 id: account.id,
                 fqdn: siteContext.fqdn,
+                loginMethod,
             }),
-            adminToken,
+            adminUiToken,
+            loginMethod,
         };
     }
     catch (error) {
@@ -131,24 +165,70 @@ export async function loginByPlatformToken(siteContext, options) {
         };
     }
 }
-async function validateUser(siteContext, { email, password }) {
-    const user = await findAccountByEmail(siteContext, email);
-    let samePassword = false;
-    if (user?.passwordHash) {
-        samePassword = await comparePassword(password, user.passwordHash);
-    }
-    const canPass = user?.passwordHash && samePassword;
-    if (!canPass)
-        return;
-    return user;
+async function deactivateLegacySpecialAccount(siteContext, account) {
+    await updateAccountActive(siteContext, account.id, false);
+    recordEvent(siteContext, {
+        eventType: "account.deactivated",
+        actorId: account.id,
+        targetType: "account",
+        targetId: account.id,
+        eventData: {
+            accountId: account.id,
+            email: account.email,
+            reason: "This email is not a special account",
+        },
+    });
+    return { message: "Account deactivated", statusCode: 401 };
 }
-function validateDevAccount({ user, devAccount, }) {
-    if (user.email !== devAccount.email || user.password !== devAccount.password)
-        return;
-    const { password, ...others } = devAccount;
-    return {
-        ...others,
-        id: devAccountId,
-    };
+async function createLocalDevAccountInDatabase(siteContext, email) {
+    if (!appConf.localDevAccount)
+        throw new ApiError("Local dev account not configured", 500);
+    const accountId = await insertSpecialAccount(siteContext, {
+        email: appConf.localDevAccount.email,
+        name: appConf.localDevAccount.name,
+        loginMethod: "localDev",
+    });
+    siteContext.logger.info(`Local dev account created: ${email}`);
+    recordEvent(siteContext, {
+        eventType: "account.create",
+        actorId: accountId,
+        targetType: "account",
+        targetId: accountId,
+        eventData: {
+            accountId,
+            email: appConf.localDevAccount.email,
+            name: appConf.localDevAccount.name,
+        },
+    });
+    const account = await findAccountByIdAndEmail(siteContext, { id: accountId, email });
+    if (!account)
+        throw new ApiError("Failed to create special account", 500);
+    return account;
+}
+async function createPlatformAdminAccountInDatabase(siteContext, email, accountIndex) {
+    const platformAdminAccounts = appConf.platformAdminAccounts;
+    if (!platformAdminAccounts)
+        throw new ApiError("Platform admin accounts not configured", 500);
+    const accountId = await insertSpecialAccount(siteContext, {
+        email,
+        name: platformAdminAccounts[accountIndex].name,
+        loginMethod: "platformAdmin",
+    });
+    siteContext.logger.info(`Platform admin account created: ${email}`);
+    recordEvent(siteContext, {
+        eventType: "account.create",
+        actorId: accountId,
+        targetType: "account",
+        targetId: accountId,
+        eventData: {
+            accountId,
+            email,
+            name: platformAdminAccounts[accountIndex].name,
+        },
+    });
+    const account = await findAccountByIdAndEmail(siteContext, { id: accountId, email });
+    if (!account)
+        throw new ApiError("Failed to create special account", 500);
+    return account;
 }
 //# sourceMappingURL=auth.service.js.map

package/dist/admin-backend/auth/auth.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAGnE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EACL,YAAY,EACZ,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,2BAA2B,GAC5B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC5F,OAAO,EAEL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,YAAY,GAAG,IAAI,CAAC;IACxB,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAwD,EACxD,OAGC;IAED,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE1C,IAAI,OAA+B,CAAC;IACpC,IAAI,OAAO,CAAC,UAAU,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAC7C,OAAO,GAAG,kBAAkB,CAAC;YAC3B,IAAI;YACJ,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,MAAM,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,GAAG;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;QAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAE9C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;QACxD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,mBAAmB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,WAAW,CAAC,IAAI;SACvB,CAAC;QACF,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAwD,EACxD,OAGC;IAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAC3C,IAAI,OAAuC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,OAAmB,CAAC;QACxB,MAAM,uBAAuB,GAAG,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/B,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,uBAAuB,EAAE,CAAC;YACnC,OAAO,GAAG,uBAAuB,CAAC,uBAAuB,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;YAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAE9C,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,cAAc;SACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAwD,EACxD,OAGC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,OAAmB,CAAC;QACxB,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,SAAS,CACzE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAC7C,CAAC;QACF,IAAI,mBAAmB,KAAK,CAAC,CAAC,EAAE,CAAC;YAC/B,OAAO,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YACD,OAAO,GAAG,YAAY,CAAC;QACzB,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;YAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAE9C,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,mBAAmB,CAAC;gBACzB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC;YACF,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,iBAAiB;SAC3B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,WAAoC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAc;IAC/F,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE1D,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;QACvB,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,EAAE,YAAY,IAAI,YAAY,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,EAC1B,IAAI,EACJ,UAAU,GAIX;IACC,IAAI,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;QAAE,OAAO;IACrF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,EAAE,GAAG,UAAU,CAAC;IAC3C,OAAO;QACL,GAAG,MAAM;QACT,EAAE,EAAE,YAAY;KACjB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAKhE,OAAO,EAEL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAwD,EACxD,OAGC;IAED,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAE1C,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,eAAe,EAAE,KAAK,KAAK,eAAe,CAAC;IAC7E,IAAI,OAA+B,CAAC;IAEpC,IAAI,iBAAiB,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,eAAe,EAAE,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACtD,CAAC;QAED,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,MAAM,+BAA+B,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QAED,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACvC,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAE5E,IAAI,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC,qBAAqB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,OAAO,MAAM,8BAA8B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;QAED,IAAI,YAAY,EAAE,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBACvE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YACtD,CAAC;YAED,OAAO,GAAG,YAAY,CAAC;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAG,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;QAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAElD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;QACxD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,mBAAmB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,WAAW;SACZ,CAAC;QACF,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAwD,EACxD,OAGC;IAED,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAC3C,IAAI,OAAuC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE;YACzD,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;YAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAElD,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK;YACL,YAAY;YACZ,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,cAAc;SACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAwD,EACxD,OAGC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;QAC3C,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE3D,MAAM,mBAAmB,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,SAAS,CACzE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,eAAe,CAC5D,CAAC;QACF,MAAM,eAAe,GAAG,mBAAmB,KAAK,CAAC,CAAC,CAAC;QAEnD,IAAI,OAA+B,CAAC;QAEpC,IAAI,eAAe,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,GAAG,MAAM,oCAAoC,CAClD,WAAW,EACX,eAAe,EACf,mBAAmB,CACpB,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,WAAW,KAAK,eAAe,EAAE,CAAC;gBAC5C,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAC/D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,OAAO,CAAC,WAAW,KAAK,eAAe,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrF,OAAO,MAAM,8BAA8B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,OAAO,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACnE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW;YAC3C,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9D,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAElD,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,IAAI,eAAe;YACxD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,mBAAmB,CAAC;gBACzB,KAAK,EAAE,eAAe;gBACtB,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,WAAW;aACZ,CAAC;YACF,YAAY;YACZ,WAAW;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO;YACL,UAAU,EAAE,GAAG;YACf,OAAO,EAAE,iBAAiB;SAC3B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,WAA+C,EAC/C,OAAmB;IAEnB,MAAM,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAE1D,WAAW,CAAC,WAAW,EAAE;QACvB,SAAS,EAAE,qBAAqB;QAChC,OAAO,EAAE,OAAO,CAAC,EAAE;QACnB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,OAAO,CAAC,EAAE;QACpB,SAAS,EAAE;YACT,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,qCAAqC;SACR;KACxC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,WAA+C,EAC/C,KAAa;IAEb,IAAI,CAAC,OAAO,CAAC,eAAe;QAAE,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAE1F,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE;QACxD,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK;QACpC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI;QAClC,WAAW,EAAE,UAAU;KACxB,CAAC,CAAC;IAEH,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;IAE/D,WAAW,CAAC,WAAW,EAAE;QACvB,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE;YACT,SAAS;YACT,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK;YACpC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,IAAI;SACD;KACpC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,oCAAoC,CACjD,WAA+C,EAC/C,KAAa,EACb,YAAoB;IAEpB,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAC5D,IAAI,CAAC,qBAAqB;QAAE,MAAM,IAAI,QAAQ,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE;QACxD,KAAK;QACL,IAAI,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,IAAI;QAC9C,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;IAEH,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC;IAEpE,WAAW,CAAC,WAAW,EAAE;QACvB,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,SAAS;QACrB,QAAQ,EAAE,SAAS;QACnB,SAAS,EAAE;YACT,SAAS;YACT,KAAK;YACL,IAAI,EAAE,qBAAqB,CAAC,YAAY,CAAC,CAAC,IAAI;SACb;KACpC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAC1E,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/admin-backend/auth/auth.types.d.ts

@@ -1,3 +1,4 @@
+import type { LoginMethod } from "@paroicms/public-anywhere-lib";
 export type LoginAction = SignInLoginAction | VerifyLoginAction;
 export interface SignInLoginAction {
     action: "signIn";
@@ -20,7 +21,8 @@ export interface LoginSuccess extends OAuthSuccess {
     name?: string;
     language: string;
     token: string;
-    adminToken?: string;
+    adminUiToken?: string;
+    loginMethod: LoginMethod;
 }
 export interface LoginFailed {
     statusCode: 401;

package/dist/admin-backend/auth/authorization.helper.d.ts

@@ -0,0 +1,11 @@
+import { type PaHttpContext } from "@paroicms/public-server-lib";
+import type { MigrationSiteContext, SiteContext } from "../../site-context/site-context.types.js";
+import { type BearerTokenPayload } from "./auth.helper.js";
+export declare const ADMIN_PERMISSIONS: readonly ["document.edit", "site.editProperties", "site.manageUsers", "site.backup", "site.eventLog", "maintenance"];
+export declare const EDITOR_PERMISSIONS: readonly ["document.edit"];
+export interface AuthorizedAccount extends BearerTokenPayload {
+    accountId: string;
+    roles: string[];
+    permissions: string[];
+}
+export declare function permissionGuard(siteContext: SiteContext | MigrationSiteContext, httpContext: PaHttpContext, requiredPermission: string): Promise<AuthorizedAccount>;

package/dist/admin-backend/auth/authorization.helper.js

@@ -0,0 +1,37 @@
+import { ApiError } from "@paroicms/public-server-lib";
+import { authGuard } from "./auth.helper.js";
+import { loadAccountRoles } from "./special-account.helper.js";
+export const ADMIN_PERMISSIONS = [
+    "document.edit",
+    "site.editProperties",
+    "site.manageUsers",
+    "site.backup",
+    "site.eventLog",
+    "maintenance",
+];
+export const EDITOR_PERMISSIONS = ["document.edit"];
+function getRolePermissions(role) {
+    switch (role) {
+        case "admin":
+            return ADMIN_PERMISSIONS;
+        case "editor":
+            return EDITOR_PERMISSIONS;
+        default:
+            return [];
+    }
+}
+export async function permissionGuard(siteContext, httpContext, requiredPermission) {
+    const payload = authGuard(httpContext);
+    const roles = await loadAccountRoles(siteContext, payload);
+    const permissions = [...new Set(roles.flatMap((role) => getRolePermissions(role)))];
+    if (!permissions.includes(requiredPermission)) {
+        throw new ApiError("Forbidden: insufficient permissions", 403);
+    }
+    return {
+        accountId: payload.id,
+        roles,
+        permissions,
+        ...payload,
+    };
+}
+//# sourceMappingURL=authorization.helper.js.map

package/dist/admin-backend/auth/authorization.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.helper.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/authorization.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAsB,MAAM,6BAA6B,CAAC;AAE3E,OAAO,EAAE,SAAS,EAA2B,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,eAAe;IACf,qBAAqB;IACrB,kBAAkB;IAClB,aAAa;IACb,eAAe;IACf,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,eAAe,CAAU,CAAC;AAE7D,SAAS,kBAAkB,CAAC,IAAY;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAC;QAC5B;YACE,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,WAA+C,EAC/C,WAA0B,EAC1B,kBAA0B;IAE1B,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IACjE,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,KAAK;QACL,WAAW;QACX,GAAG,OAAO;KACX,CAAC;AACJ,CAAC"}

package/dist/admin-backend/auth/special-account.helper.d.ts

@@ -0,0 +1,10 @@
+import type { SiteContext } from "../../site-context/site-context.types.js";
+export declare function isSpecialAccountEmail(email: string): boolean;
+export declare function loadAccountRoles(siteContext: Pick<SiteContext, "cn">, account: {
+    id: string;
+    email: string;
+}): Promise<string[]>;
+export declare function loadAccountPermissions(siteContext: Pick<SiteContext, "cn">, account: {
+    id: string;
+    email: string;
+}): Promise<string[]>;

package/dist/admin-backend/auth/special-account.helper.js

@@ -0,0 +1,38 @@
+import { type } from "arktype";
+import { appConf } from "../../context.js";
+import { ADMIN_PERMISSIONS, EDITOR_PERMISSIONS } from "./authorization.helper.js";
+const permissionMap = {
+    admin: ADMIN_PERMISSIONS,
+    editor: EDITOR_PERMISSIONS,
+};
+const RoleRowAT = type({
+    role: "string",
+    "+": "reject",
+});
+export function isSpecialAccountEmail(email) {
+    if (appConf.localDevAccount?.email === email) {
+        return true;
+    }
+    if (appConf.platformAdminAccounts?.some((acc) => acc.email === email)) {
+        return true;
+    }
+    return false;
+}
+export async function loadAccountRoles(siteContext, account) {
+    const roleRows = await siteContext
+        .cn("PaAccountRole")
+        .select("role")
+        .where("accountId", account.id);
+    const dbRoles = roleRows.map((row) => RoleRowAT.assert(row).role);
+    if (isSpecialAccountEmail(account.email)) {
+        const rolesSet = new Set([...dbRoles, "admin"]);
+        return Array.from(rolesSet);
+    }
+    return dbRoles;
+}
+export async function loadAccountPermissions(siteContext, account) {
+    const roles = await loadAccountRoles(siteContext, account);
+    const permissions = [...new Set(roles.flatMap((role) => permissionMap[role] ?? []))];
+    return permissions;
+}
+//# sourceMappingURL=special-account.helper.js.map

package/dist/admin-backend/auth/special-account.helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"special-account.helper.js","sourceRoot":"","sources":["../../../src/admin-backend/auth/special-account.helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAElF,MAAM,aAAa,GAAsC;IACvD,KAAK,EAAE,iBAAiB;IACxB,MAAM,EAAE,kBAAkB;CAC3B,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,QAAQ;IACd,GAAG,EAAE,QAAQ;CACd,CAAC,CAAC;AAMH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,IAAI,OAAO,CAAC,eAAe,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,OAAsC;IAEtC,MAAM,QAAQ,GAAG,MAAM,WAAW;SAC/B,EAAE,CAAC,eAAe,CAAC;SACnB,MAAM,CAAC,MAAM,CAAC;SACd,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAElE,IAAI,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,WAAoC,EACpC,OAAsC;IAEtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/admin-backend/backup/backup.resolver.js

@@ -1,12 +1,12 @@
 import { siteReadyGuard } from "../../graphql/graphql.types.js";
-import { authGuard } from "../auth/auth.helper.js";
+import { permissionGuard } from "../auth/authorization.helper.js";
 import { createDownloadToken } from "./backup.helper.js";
 import { executeHardenedBackup } from "./hardened-backup.service.js";
 export const backupResolvers = {
     Mutation: {
         initializeBackup: async (_parent, _values, { siteContext, httpContext }) => {
-            authGuard(httpContext);
             siteReadyGuard(siteContext);
+            await permissionGuard(siteContext, httpContext, "site.backup");
             const { zipFileWeight, zipFileName } = await executeHardenedBackup(siteContext);
             const accessToken = createDownloadToken({
                 backupFile: zipFileName,

package/dist/admin-backend/backup/backup.resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.resolver.js","sourceRoot":"","sources":["../../../src/admin-backend/backup/backup.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAOrE,MAAM,CAAC,MAAM,eAAe,GAAiC;IAC3D,QAAQ,EAAE;QACR,gBAAgB,EAAE,KAAK,EACrB,OAAO,EACP,OAAO,EACP,EAAE,WAAW,EAAE,WAAW,EAAE,EACP,EAAE;YACvB,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,mBAAmB,CAAC;gBACtC,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,uBAAuB,WAAW,OAAO,WAAW,EAAE,CAAC;YAE3E,OAAO;gBACL,WAAW;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;KACF;CACF,CAAC"}
+{"version":3,"file":"backup.resolver.js","sourceRoot":"","sources":["../../../src/admin-backend/backup/backup.resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAOrE,MAAM,CAAC,MAAM,eAAe,GAAiC;IAC3D,QAAQ,EAAE;QACR,gBAAgB,EAAE,KAAK,EACrB,OAAO,EACP,OAAO,EACP,EAAE,WAAW,EAAE,WAAW,EAAE,EACP,EAAE;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;YAC/D,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAChF,MAAM,WAAW,GAAG,mBAAmB,CAAC;gBACtC,UAAU,EAAE,WAAW;gBACvB,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,uBAAuB,WAAW,OAAO,WAAW,EAAE,CAAC;YAE3E,OAAO;gBACL,WAAW;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAC;QACJ,CAAC;KACF;CACF,CAAC"}

package/dist/admin-backend/document/document.resolver.extend.js

@@ -1,11 +1,9 @@
 import { toDocumentSeed } from "../../common/data-format.js";
 import { siteReadyGuard } from "../../graphql/graphql.types.js";
-import { authGuard } from "../auth/auth.helper.js";
 import { findOneDocument } from "./load-documents.queries.js";
 export const extendWithDocumentResolver = {
     LNodeWrap: {
-        document: async (parent, _args, { siteContext, httpContext }) => {
-            authGuard(httpContext);
+        document: async (parent, _args, { siteContext }) => {
             siteReadyGuard(siteContext);
             const document = await findOneDocument(siteContext, {
                 nodeId: parent.nodeId,

package/dist/admin-backend/document/document.resolver.extend.js.map

@@ -1 +1 @@
-{"version":3,"file":"document.resolver.extend.js","sourceRoot":"","sources":["../../../src/admin-backend/document/document.resolver.extend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACtE,SAAS,EAAE;QACT,QAAQ,EAAE,KAAK,EAAE,MAAqB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE;YAC7E,SAAS,CAAC,WAAW,CAAC,CAAC;YACvB,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF;CACF,CAAC"}
+{"version":3,"file":"document.resolver.extend.js","sourceRoot":"","sources":["../../../src/admin-backend/document/document.resolver.extend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAuB,MAAM,gCAAgC,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACtE,SAAS,EAAE;QACT,QAAQ,EAAE,KAAK,EAAE,MAAqB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;YAChE,cAAc,CAAC,WAAW,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE;gBAClD,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpD,CAAC;KACF;CACF,CAAC"}