@things-factory/auth-base 10.1.232 → 10.1.241

package/dist-server/service/web-auth-credential/web-auth-credential-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-auth-credential-mutation.js","sourceRoot":"","sources":["../../../server/service/web-auth-credential/web-auth-credential-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AAErF,iDAA6E;AAE7E,kEAA8D;AAC9D,qEAA4D;AAE5D;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,OAAwB;IAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAElC,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/G,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAA;IAC9F,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,6DAA6D;IAGvD,AAAN,KAAK,CAAC,yBAAyB,CAClB,EAAU,EACR,IAAY,EAClB,OAAwB;QAE/B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAClC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAEhD,OAAO,MAAM,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACrD,GAAG,UAAU;YACb,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI;YACtC,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAED,4FAA4F;IAGtF,AAAN,KAAK,CAAC,yBAAyB,CAAY,EAAU,EAAS,OAAwB;QACpF,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAClC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAA;QAEvD,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACjE,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QAClD,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAC5F,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAClC,CAAA;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AApCY,8DAAyB;AAI9B;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,0CAAiB,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IAEpG,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IACT,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0EAUP;AAKK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,uEAAuE,EAAE,CAAC;IACtF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0EAa5D;oCAnCU,yBAAyB;IAFrC,IAAA,uBAAQ,EAAC,0CAAiB,CAAC;IAC3B,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,yBAAyB,CAoCrC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\n\nimport { getRepository, Refusal, SpeakRefusals } from '@things-factory/shell'\n\nimport { recordAuditAction } from '../audit/audit-recorder.js'\nimport { WebAuthCredential } from './web-auth-credential.js'\n\n/**\n * The caller's own passkeys (ADR-0156 decision 6). Another person's id is answered as one that does\n * not exist - the answer does not tell whether it is somebody else's.\n */\nasync function ownPasskey(id: string, context: ResolverContext): Promise<WebAuthCredential> {\n  const { user, tx } = context.state\n\n  const credential = await getRepository(WebAuthCredential, tx).findOne({ where: { id, user: { id: user.id } } })\n  if (!credential) {\n    throw new Refusal('passkey-not-found', { id }, 'There is no passkey of yours with this id.')\n  }\n\n  return credential\n}\n\n@Resolver(WebAuthCredential)\n@UseMiddleware(SpeakRefusals)\nexport class WebAuthCredentialMutation {\n  /** Open by design: renames only the caller's own passkey. */\n  @Directive('@transaction')\n  @Mutation(returns => WebAuthCredential, { description: \"To rename one of the caller's own passkeys.\" })\n  async updateMyWebAuthCredential(\n    @Arg('id') id: string,\n    @Arg('name') name: string,\n    @Ctx() context: ResolverContext\n  ): Promise<WebAuthCredential> {\n    const { user, tx } = context.state\n    const credential = await ownPasskey(id, context)\n\n    return await getRepository(WebAuthCredential, tx).save({\n      ...credential,\n      name: name.trim().slice(0, 64) || null,\n      updater: user\n    })\n  }\n\n  /** Open by design: removes only the caller's own passkey. It signs nobody in afterwards. */\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: \"To remove one of the caller's own passkeys. It can no longer sign in.\" })\n  async deleteMyWebAuthCredential(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { user, tx } = context.state\n    const credential = await ownPasskey(id, context)\n    const repository = getRepository(WebAuthCredential, tx)\n\n    await repository.update({ id: credential.id }, { updater: user })\n    await repository.softDelete({ id: credential.id })\n    await recordAuditAction(\n      { kind: 'webauthn.remove', targetKind: 'User', targetIds: [user.id], targetRole: 'handled' },\n      { manager: tx, actorId: user.id }\n    )\n\n    return true\n  }\n}\n"]}
+{"version":3,"file":"web-auth-credential-mutation.js","sourceRoot":"","sources":["../../../server/service/web-auth-credential/web-auth-credential-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AAErF,iDAA6E;AAE7E,kEAA8D;AAC9D,qEAA4D;AAE5D;;;GAGG;AACH,6EAA6E;AAChE,QAAA,gBAAgB,GAAG,EAAE,CAAA;AAElC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,OAAwB;IAC5D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAElC,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IAC/G,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,eAAO,CAAC,mBAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,4CAA4C,CAAC,CAAA;IAC9F,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAIM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,6DAA6D;IAGvD,AAAN,KAAK,CAAC,yBAAyB,CAClB,EAAU,EACR,IAAY,EAClB,OAAwB;QAE/B,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAClC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAChD,+GAA+G;QAC/G,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAgB,EAAE,CAAC;YACpC,MAAM,IAAI,eAAO,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,wBAAgB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,8BAA8B,wBAAgB,cAAc,CAAC,CAAA;QAC3J,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACrD,GAAG,UAAU;YACb,IAAI,EAAE,KAAK,IAAI,IAAI;YACnB,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAED,4FAA4F;IAGtF,AAAN,KAAK,CAAC,yBAAyB,CAAY,EAAU,EAAS,OAAwB;QACpF,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAClC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;QAChD,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0CAAiB,EAAE,EAAE,CAAC,CAAA;QAEvD,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;QACjE,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;QAClD,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAC5F,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAClC,CAAA;QAED,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AAzCY,8DAAyB;AAI9B;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,0CAAiB,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IAEpG,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IACT,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0EAeP;AAKK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,uEAAuE,EAAE,CAAC;IACtF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0EAa5D;oCAxCU,yBAAyB;IAFrC,IAAA,uBAAQ,EAAC,0CAAiB,CAAC;IAC3B,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,yBAAyB,CAyCrC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\n\nimport { getRepository, Refusal, SpeakRefusals } from '@things-factory/shell'\n\nimport { recordAuditAction } from '../audit/audit-recorder.js'\nimport { WebAuthCredential } from './web-auth-credential.js'\n\n/**\n * The caller's own passkeys (ADR-0156 decision 6). Another person's id is answered as one that does\n * not exist - the answer does not tell whether it is somebody else's.\n */\n/** A passkey name's bound - the screen's maxlength (auth-ui my-passkeys). */\nexport const PASSKEY_NAME_MAX = 64\n\nasync function ownPasskey(id: string, context: ResolverContext): Promise<WebAuthCredential> {\n  const { user, tx } = context.state\n\n  const credential = await getRepository(WebAuthCredential, tx).findOne({ where: { id, user: { id: user.id } } })\n  if (!credential) {\n    throw new Refusal('passkey-not-found', { id }, 'There is no passkey of yours with this id.')\n  }\n\n  return credential\n}\n\n@Resolver(WebAuthCredential)\n@UseMiddleware(SpeakRefusals)\nexport class WebAuthCredentialMutation {\n  /** Open by design: renames only the caller's own passkey. */\n  @Directive('@transaction')\n  @Mutation(returns => WebAuthCredential, { description: \"To rename one of the caller's own passkeys.\" })\n  async updateMyWebAuthCredential(\n    @Arg('id') id: string,\n    @Arg('name') name: string,\n    @Ctx() context: ResolverContext\n  ): Promise<WebAuthCredential> {\n    const { user, tx } = context.state\n    const credential = await ownPasskey(id, context)\n    /* A longer name was cut at 64 without a word (inline help audit 2026-10-30) - it is refused with the bound. */\n    const given = name.trim()\n    if (given.length > PASSKEY_NAME_MAX) {\n      throw new Refusal('passkey-name-too-long', { max: PASSKEY_NAME_MAX, length: given.length }, `A passkey name takes up to ${PASSKEY_NAME_MAX} characters.`)\n    }\n\n    return await getRepository(WebAuthCredential, tx).save({\n      ...credential,\n      name: given || null,\n      updater: user\n    })\n  }\n\n  /** Open by design: removes only the caller's own passkey. It signs nobody in afterwards. */\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: \"To remove one of the caller's own passkeys. It can no longer sign in.\" })\n  async deleteMyWebAuthCredential(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { user, tx } = context.state\n    const credential = await ownPasskey(id, context)\n    const repository = getRepository(WebAuthCredential, tx)\n\n    await repository.update({ id: credential.id }, { updater: user })\n    await repository.softDelete({ id: credential.id })\n    await recordAuditAction(\n      { kind: 'webauthn.remove', targetKind: 'User', targetIds: [user.id], targetRole: 'handled' },\n      { manager: tx, actorId: user.id }\n    )\n\n    return true\n  }\n}\n"]}