@things-factory/auth-base 10.1.278 → 10.1.280

package/dist-server/router/auth-private-process-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-private-process-router.js","sourceRoot":"","sources":["../../server/router/auth-private-process-router.ts"],"names":[],"mappings":";;;;AAAA,qCAA+B;AAC/B,oEAA+B;AAE/B,6CAA4C;AAC5C,iDAA6D;AAE7D,gEAAwD;AACxD,kEAA0D;AAC1D,0DAAyD;AACzD,qDAA8C;AAC9C,4EAA8F;AAC9F,sEAA6D;AAC7D,8DAAsD;AAEtD,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAA;AAEvC,QAAA,wBAAwB,GAAG,IAAI,oBAAM,CAAC;IACjD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,gCAAwB;KACrB,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5C,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEnE,MAAM,KAAK,GAAG,MAAM,IAAA,yBAAS,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAA;IAEhG,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;IAEtD,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;AACtC,CAAC,CAAC;KACD,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC/C,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IACxC,MAAM,KAAK,GAAG,MAAM,IAAA,0BAAa,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IAClE,yEAAyE;IACzE,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,EAAE,CAAA;IAExD,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,mCAAmC,CAAC,CAAA;IAC3F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,mCAAmC,CAAC,CAAA;IACvD,CAAC;AACH,CAAC,CAAC;KACD,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5C,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC9B,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAC5B,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAEzB,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEjD,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEpC,IAAI,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QACpC,KAAK,EAAE,EAAE,QAAQ,EAAE;QACnB,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;YACjC,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,EAAE,IAAI,MAAM,IAAI,CAAC,cAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,MAAM,IAAA,2BAAU,EAAC,IAAI,CAAC,CAAA;IAEtB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAC/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;AACjC,CAAC,CAAC;KACD,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvC,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,IAAI,OAAO,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;IAE3D;;;OAGG;IACH,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ;QAC5B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,UAAU,GAAG,MAAM,cAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAE/D,IAAI,oBAAoB,EAAE,CAAC;QACzB,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;YACvD,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAA;QACzF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,IAAI,EAAE,IAAA,6BAAW,EAAC,IAAI,EAAE;YACtB,KAAK,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC;YACrD,KAAK,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC;YACnD,QAAQ;YACR,UAAU;SACX,CAAC;QACF,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE;YAC5F,OAAO;gBACL,IAAI;gBACJ,WAAW;gBACX,SAAS;gBACT,OAAO;aACR,CAAA;QACH,CAAC,CAAC;QACF,MAAM,EAAE,MAAM,IAAI;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,IAAI,EAAE,MAAM,CAAC,OAAO;YACpB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS;YACvC;;;;;;;;;;eAUG;YACH,MAAM,EAAE,MAAM,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;SACrE;QACD,SAAS;KACV,CAAA;AACH,CAAC,CAAC,CAAA","sourcesContent":["import { ILike } from 'typeorm'\nimport Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { changePwd } from '../controllers/change-pwd.js'\nimport { deleteUser } from '../controllers/delete-user.js'\nimport { updateProfile } from '../controllers/profile.js'\nimport { User } from '../service/user/user.js'\nimport { clearAccessTokenCookie, setAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\nimport { profileUser } from '../utils/profile-user.js'\n\nconst languages = config.get('i18n/languages') || []\n\nexport const authPrivateProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPrivateProcessRouter\n  .post('/change-pass', async (context, next) => {\n    const { t } = context\n    let { current_pass, new_pass, confirm_pass } = context.request.body\n\n    const token = await changePwd(context.state.user, current_pass, new_pass, confirm_pass, context)\n\n    context.body = t('text.password changed successfully')\n\n    setAccessTokenCookie(context, token)\n  })\n  .post('/update-profile', async (context, next) => {\n    const { i18next, t } = context\n    const newProfiles = context.request.body\n    const saved = await updateProfile(context.state.user, newProfiles)\n    // update session user so subsequent /auth/profile returns updated values\n    context.state.user = { ...context.state.user, ...saved }\n\n    if (newProfiles.locale) {\n      context.body = i18next.getFixedT(newProfiles.locale)('text.profile changed successfully')\n    } else {\n      context.body = t('text.profile changed successfully')\n    }\n  })\n  .post('/delete-user', async (context, next) => {\n    const { t, session } = context\n    var { user } = context.state\n    var { id: userId } = user\n\n    var { password, username } = context.request.body\n\n    const userRepo = getRepository(User)\n\n    var userInfo = await userRepo.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!userInfo && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      userInfo = await userRepo.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (userInfo.id != userId || !User.verify(userInfo.password, password, userInfo.salt)) {\n      context.status = 401\n      context.body = t('error.user validation failed')\n      return\n    }\n\n    await deleteUser(user)\n\n    context.body = t('text.delete account succeed')\n    clearAccessTokenCookie(context)\n  })\n  .get('/profile', async (context, next) => {\n    const { t } = context\n    const { domain, user, unsafeIP, prohibitedPrivileges } = context.state\n\n    if (!domain) {\n      context.status = 401\n      context.body = t('error.user validation failed')\n      return\n    }\n\n    let domains: Partial<Domain>[] = await getUserDomains(user)\n\n    /*\n     * The request domain carries `parentId` but not the parent itself — `getDomainFromURL`\n     * loads no relations. One cached lookup, and only when there is a parent to look up.\n     */\n    const parent = domain.parentId\n      ? await getRepository(Domain).findOne({ where: { id: domain.parentId }, cache: true })\n      : null\n\n    var privileges = await User.getPrivilegesByDomain(user, domain)\n\n    if (prohibitedPrivileges) {\n      prohibitedPrivileges.forEach(({ category, privilege }) => {\n        privileges = privileges.filter(p => p.category != category || p.privilege != privilege)\n      })\n    }\n\n    context.body = {\n      user: profileUser(user, {\n        owner: await process.domainOwnerGranted(domain, user),\n        super: await process.superUserGranted(domain, user),\n        unsafeIP,\n        privileges\n      }),\n      domains: domains.map(({ id, name, description, subdomain, extType, brandName, brandImage }) => {\n        return {\n          name,\n          description,\n          subdomain,\n          extType\n        }\n      }),\n      domain: domain && {\n        name: domain.name,\n        subdomain: domain.subdomain,\n        type: domain.extType,\n        theme: domain.theme,\n        themeVars: domain.attributes?.themeVars,\n        /*\n         * Where this domain inherits from, or `null` when it is a root.\n         *\n         * A screen that offers \"inherited\" as a scope has to be able to say which domain that\n         * means, and to say when the answer is nobody. Without this the role list showed an\n         * \"inherited\" filter in a root domain that could only ever come back empty, and the\n         * query behind it used to fail outright on postgres.\n         *\n         * `null` is the answer for a root domain, not the absence of one. The client tells the\n         * two apart by the key being present.\n         */\n        parent: parent && { name: parent.name, subdomain: parent.subdomain }\n      },\n      languages\n    }\n  })\n"]}

package/dist-server/router/auth-public-process-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-public-process-router.js","sourceRoot":"","sources":["../../server/router/auth-public-process-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,qCAA+B;AAE/B,6CAA4C;AAC5C,iDAAsE;AAEtE,wEAAwF;AACxF,kEAA0D;AAC1D,oEAAgF;AAChF,qDAA8C;AAC9C,oDAA6C;AAC7C,0EAAsE;AACtE,+DAAgD;AAChD,4EAAwE;AAExE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,uBAAuB,GAAG,IAAI,oBAAM,CAAC;IAChD,MAAM,EAAE,OAAO;CAChB,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IAEtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC1B,SAAS,EAAE,CAAC,SAAS,CAAC;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC9B,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE;YAC9B,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAA;IACpD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,QAAQ,CAAC,yBAAyB,KAAK,UAAU,KAAK,EAAE,CAAC,CAAA;IACnE,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,8BAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,8FAA8F;IAC9F,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,2BAA2B,CAAC,CAAA;IAE7C,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC,IAAA,uBAAe,EAAC,OAAO,CAAC,CAAC,CAAA;IAC5C,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAA;IAEvC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,iBAAiB;QAC9B,aAAa,EAAE,0BAA0B;QACzC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,+BAAuB,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,gBAAgB;QAC7B,aAAa,EAAE,yBAAyB;QACxC,IAAI,EAAE;YACJ,YAAY;YACZ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,sBAAsB;QACrC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAA;IAEhC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,mBAAmB;QAClC,IAAI,EAAE;YACJ,KAAK;YACL,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF;;;;GAIG;AACH,+BAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7D,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,OAAe,CAAA;IAEnB,IAAI,CAAC;QACH,MAAM,IAAA,wBAAM,EAAC,KAAK,CAAC,CAAA;QACnB,OAAO,GAAG,CAAC,CAAC,kCAAkC,CAAC,CAAA;IACjD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;IAChD,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;IAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO;gBACP,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,+BAAuB,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACjF,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAE5C,IAAI,CAAC,MAAM,IAAA,yCAAuB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IACrB,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEtC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,EAAE,CAAA;IAEzB,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;QAClC,KAAK,EAAE;YACL,KAAK;SACN;KACF,CAAC,CAAA;IAEF,IAAI,IAAI,IAAI,CAAC,CAAC,MAAM,IAAA,0CAAsB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,8BAA8B,CAAC,CAAA;QAChD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;IACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,gCAAgC,CAAC,CAAA;AACpD,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEvD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;YAErD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;YACpB,OAAO,CAAC,IAAI,GAAG;gBACb,OAAO;aACR,CAAA;YAED,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBAChC,WAAW,EAAE,gBAAgB;oBAC7B,aAAa,EAAE,yBAAyB;oBACxC,IAAI,EAAE;wBACJ,KAAK;wBACL,OAAO;wBACP,YAAY;wBACZ,wBAAwB;wBACxB,0BAA0B;wBAC1B,SAAS;qBACV;iBACF,CAAC,CAAA;YACJ,CAAC;YAED,OAAM;QACR,CAAC;QAED,MAAM,IAAA,iCAAa,EAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAEpD,IAAI,OAAO,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QACrD,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;QAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;QAExB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,gBAAgB;gBAC7B,aAAa,EAAE,yBAAyB;gBACxC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY;oBACZ,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,+BAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACnE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC7B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;IAEhD;;uCAEmC;IACnC,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,oCAAoC,CAAC,CAAA;QAEtD,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAU,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAEjD;;;;;;OAMG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,iCAAiC,CAAC,CAAA;QAEpD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;QAEtB,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,sBAAsB;gBACrC,IAAI,EAAE;oBACJ,KAAK;oBACL,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QAED,OAAM;IACR,CAAC;IAED,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,6BAA6B,CAAC,CAAA;IAE/C,IAAA,+CAAsB,EAAC,OAAO,CAAC,CAAA;IAE/B,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,OAAO,EAAE,CAAC,CAAC,6BAA6B,CAAC;gBACzC,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport { ILike } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, getSiteRootPath } from '@things-factory/shell'\n\nimport { resetPassword, sendPasswordResetEmail } from '../controllers/reset-password.js'\nimport { unlockUser } from '../controllers/unlock-user.js'\nimport { resendVerificationEmail, verify } from '../controllers/verification.js'\nimport { User } from '../service/user/user.js'\nimport { accepts } from '../utils/accepts.js'\nimport { recordAuditAction } from '../service/audit/audit-recorder.js'\nimport { findAuth } from './site-root-router.js'\nimport { clearAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authPublicProcessRouter = new Router({\n  prefix: '/auth'\n})\n\nauthPublicProcessRouter.post('/join', async (context, next) => {\n  const { email } = context.request.body || {}\n\n  const repository = getRepository(User)\n\n  var user = await repository.findOne({\n    where: { username: email },\n    relations: ['domains']\n  })\n\n  if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n    user = await repository.findOne({\n      where: { email: ILike(email) },\n      relations: ['domains']\n    })\n  }\n\n  if (user) {\n    context.redirect(`/auth/signin?username=${email}`)\n  } else {\n    context.redirect(`/auth/signup?username=${email}&email=${email}`)\n  }\n})\n\nauthPublicProcessRouter.all('/signout', findAuth, async (context, next) => {\n  const { header, t } = context\n  clearAccessTokenCookie(context)\n\n  /* After the cookie is gone: an audit failure never keeps anyone signed in (ADR-0141 §4-2). */\n  if (context.state.user) {\n    await recordAuditAction({ kind: 'auth.signout', outcome: 'ok' }, { domainId: null })\n  }\n\n  context.body = t('text.signout successfully')\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    context.redirect(getSiteRootPath(context))\n  }\n})\n\nauthPublicProcessRouter.get('/forgot-password', async (context, next) => {\n  const { email } = context.request.query\n\n  await context.render('auth-page', {\n    pageElement: 'forgot-password',\n    elementScript: '/auth/forgot-password.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * The mailed link is `/auth/reset-password#<token>` (and the same shape for unlock and verify). The\n * page reads the token from the fragment; this request never carries it, so nothing here reads one.\n */\nauthPublicProcessRouter.get('/reset-password', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'reset-password',\n    elementScript: '/auth/reset-password.js',\n    data: {\n      passwordRule,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/unlock-user', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'unlock-user',\n    elementScript: '/auth/unlock-user.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.get('/activate/:email', async (context, next) => {\n  const { email } = context.params\n\n  await context.render('auth-page', {\n    pageElement: 'auth-activate',\n    elementScript: '/auth/activate.js',\n    data: {\n      email,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n/*\n * Confirming an address is a POST from the page, not the GET of the link. The link used to be\n * `/auth/verify/<token>` and opening it confirmed — so did any mail scanner that fetched it, and the\n * token sat in every access log on the way.\n */\nauthPublicProcessRouter.get('/verify', async (context, next) => {\n  await context.render('auth-page', {\n    pageElement: 'auth-verify',\n    elementScript: '/auth/verify.js',\n    data: {\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthPublicProcessRouter.post('/verify', async (context, next) => {\n  const { header, t } = context\n  const { token } = context.request.body || {}\n\n  let message: string\n\n  try {\n    await verify(token)\n    message = t('text.user activated successfully')\n  } catch (e) {\n    context.status = 404\n    message = t('text.invalid verification token')\n  }\n\n  context.body = message\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n\n/*\n * This and forgot-password give one answer whether or not the address has an account to mail - a\n * different one would tell anyone which addresses are registered. Only a mail that was due and did\n * not go is a failure. Both used to set nothing in those cases, and koa answered a bare 404 that the\n * page showed as \"Not Found\".\n */\nauthPublicProcessRouter.post('/resend-verification-email', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body || {}\n\n  if ((await resendVerificationEmail(email, context)) == 'failed') {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.verification email sent')\n})\n\nauthPublicProcessRouter.post('/forgot-password', async (context, next) => {\n  const { t } = context\n  const { email } = context.request.body\n\n  if (!email) return next()\n\n  const userRepo = getRepository(User)\n  const user = await userRepo.findOne({\n    where: {\n      email\n    }\n  })\n\n  if (user && !(await sendPasswordResetEmail({ user, context }))) {\n    context.status = 503\n    context.body = t('error.mail could not be sent')\n    return\n  }\n\n  context.status = 200\n  context.body = t('text.password reset email sent')\n})\n\nauthPublicProcessRouter.post('/reset-password', async (context, next) => {\n  const { header, t } = context\n  const { password, token, email } = context.request.body\n\n  try {\n    if (!(token && password && email)) {\n      let message = t('error.token or password is invalid')\n\n      context.status = 404\n      context.body = {\n        message\n      }\n\n      if (accepts(header.accept, ['text/html', '*/*'])) {\n        await context.render('auth-page', {\n          pageElement: 'reset-password',\n          elementScript: '/auth/reset-password.js',\n          data: {\n            token,\n            message,\n            passwordRule,\n            disableUserSignupProcess,\n            disableUserFavoredLanguage,\n            languages\n          }\n        })\n      }\n\n      return\n    }\n\n    await resetPassword(token, password, email, context)\n\n    var message = t('text.password changed successfully')\n    context.body = message\n\n    clearAccessTokenCookie(context)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  } catch (e) {\n    context.status = 404\n    context.body = e.message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'reset-password',\n        elementScript: '/auth/reset-password.js',\n        data: {\n          token,\n          message: e.message,\n          passwordRule,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n  }\n})\n\nauthPublicProcessRouter.post('/unlock-user', async (context, next) => {\n  const { header, t } = context\n  const { password, token } = context.request.body\n\n  /* Both are required, the way `/auth/reset-password` requires them. This read `||`, so a body\n     carrying a password and no token passed the guard and reached the unlock with no token —\n     see the note in `unlockUser`. */\n  if (!(token && password)) {\n    context.status = 404\n    context.body = t('error.token or password is invalid')\n\n    return\n  }\n\n  const succeed = await unlockUser(token, password)\n\n  /*\n   * Say what happened. The success page used to render whether or not the unlock took, so a\n   * reused link, a token for another account, or an account that was never locked all read as\n   * \"account is reactivated\" — and the person then could not sign in.\n   *\n   * A refusal returns to the form with a reason, the shape `/auth/reset-password` already uses.\n   */\n  if (!succeed) {\n    const message = t('text.invalid verification token')\n\n    context.status = 404\n    context.body = message\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'unlock-user',\n        elementScript: '/auth/unlock-user.js',\n        data: {\n          token,\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n\n    return\n  }\n\n  context.body = t('text.password reset succeed')\n\n  clearAccessTokenCookie(context)\n\n  if (accepts(header.accept, ['text/html', '*/*'])) {\n    await context.render('auth-page', {\n      pageElement: 'auth-result',\n      elementScript: '/auth/result.js',\n      data: {\n        message: t('text.account is reactivated'),\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages\n      }\n    })\n  }\n})\n"]}

package/dist-server/router/auth-signin-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-signin-router.js","sourceRoot":"","sources":["../../server/router/auth-signin-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAC5C,sDAA0D;AAC1D,oDAA6C;AAC7C,4EAAsE;AAEtE,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAS,CAAC,CAAA;AAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACtC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC;KAC1C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;IACvB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACxB,CAAC,CAAC,CAAA;AAES,QAAA,gBAAgB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE5C,wBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC3D,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE/C,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,aAAa;QAC1B,aAAa,EAAE,iBAAiB;QAChC,IAAI,EAAE;YACJ,QAAQ;YACR,UAAU,EAAE,WAAW;YACvB,QAAQ,EAAE,QAAQ;YAClB,wBAAwB;YACxB,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,wBAAgB,CAAC,IAAI,CACnB,cAAc,EACd,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IAClB,6FAA6F;IAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACzD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAA;IACpD,CAAC;IACD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,EACD,2BAAgB,EAChB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtB,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;IAC9B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IACvC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAEzC,IAAI,CAAC,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,IAAI,GAAG,KAAK,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,UAAU,GAAG,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CACrG,OAAO,CAAC,UAAU,IAAI,GAAG,CAC1B,EAAE,CAAA;IAEH,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,mCAAmC,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;AACvF,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\nimport { signinMiddleware } from '../middlewares/index.js'\nimport { accepts } from '../utils/accepts.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\nconst SSOConfig = config.get('sso', {} as any)\nconst SSOLinks = Object.values(SSOConfig)\n  .filter(({ link, title }) => link && title)\n  .map(({ link, title }) => {\n    return { link, title }\n  })\n\nexport const authSigninRouter = new Router()\n\nauthSigninRouter.get('/auth/signin', async (context, next) => {\n  const { redirect_to, username } = context.query\n\n  await context.render('auth-page', {\n    pageElement: 'auth-signin',\n    elementScript: '/auth/signin.js',\n    data: {\n      username,\n      redirectTo: redirect_to,\n      ssoLinks: SSOLinks,\n      disableUserSignupProcess,\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\nauthSigninRouter.post(\n  '/auth/signin',\n  async (ctx, next) => {\n    /* For backward compatibility, cover the case of logging in with email instead of username */\n    if (!ctx.request.body.username && ctx.request.body.email) {\n      ctx.request.body.username = ctx.request.body.email\n    }\n    await next()\n  },\n  signinMiddleware,\n  async (context, next) => {\n    const { request, t } = context\n    const { token, domain } = context.state\n    const { body: reqBody, header } = request\n\n    if (!accepts(header.accept, ['text/html', '*/*'])) {\n      context.body = token\n      return\n    }\n\n    var redirectTo = `/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(\n      reqBody.redirectTo || '/'\n    )}`\n\n    setAccessTokenCookie(context, token)\n\n    /* A person who typed a password is offered a passkey on the way in (ADR-0156 decision 5). */\n    context.redirect(`/auth/passkey-offer?redirect_to=${encodeURIComponent(redirectTo)}`)\n  }\n)\n"]}

package/dist-server/router/auth-signup-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth-signup-router.js","sourceRoot":"","sources":["../../server/router/auth-signup-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,6CAA4C;AAE5C,wDAAiD;AACjD,oDAA6C;AAC7C,4EAAsE;AACtE,kGAAwF;AAExF,MAAM,wBAAwB,GAAG,YAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,KAAK,CAAC,CAAA;AAC9E,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AACrD,MAAM,gBAAgB,GAAG,YAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAExD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAEY,QAAA,gBAAgB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE5C,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAC9B,wBAAgB,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC3D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEzC,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,aAAa;YAC1B,aAAa,EAAE,iBAAiB;YAChC,IAAI,EAAE;gBACJ,QAAQ;gBACR,KAAK;gBACL,YAAY;gBACZ,wBAAwB;gBACxB,0BAA0B;gBAC1B,SAAS;gBACT,gBAAgB;aACjB;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,wBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAA,yDAAwB,EAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC5G,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,OAAO,CAAA;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAA;QAEjC,QAAQ;QACR,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,kBAAM,EAC5B;YACE,GAAG,IAAI;YACP,OAAO;YACP,MAAM;SACP,EACD,IAAI,CACL,CAAA;QAED,MAAM,OAAO,GAAG,CAAC,CAAC,mCAAmC,CAAC,CAAA;QACtD,OAAO,CAAC,IAAI,GAAG;YACb,OAAO;YACP,KAAK;SACN,CAAA;QAED,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAEpC,IAAI,IAAA,oBAAO,EAAC,MAAM,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;gBAChC,WAAW,EAAE,aAAa;gBAC1B,aAAa,EAAE,iBAAiB;gBAChC,IAAI,EAAE;oBACJ,OAAO;oBACP,wBAAwB;oBACxB,0BAA0B;oBAC1B,SAAS;iBACV;aACF,CAAC,CAAA;QACJ,CAAC;QACD,gBAAgB;QAChB,yBAAyB;QACzB,6BAA6B;QAE7B,wDAAwD;QACxD,0CAA0C;QAC1C,oCAAoC;QACpC,0CAA0C;QAC1C,gBAAgB;QAChB,iFAAiF;QACjF,uBAAuB;QACvB,UAAU;QACV,SAAS;QACT,MAAM;QACN,IAAI;IACN,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import Router from 'koa-router'\n\nimport { config } from '@things-factory/env'\n\nimport { signup } from '../controllers/signup.js'\nimport { accepts } from '../utils/accepts.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { verifyRecaptcaMiddleware } from '../middlewares/verify-recaptcha-middleware.js'\n\nconst disableUserSignupProcess = config.get('disableUserSignupProcess', false)\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\nconst recaptchaSiteKey = config.get('recaptcha/siteKey')\n\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\nexport const authSignupRouter = new Router()\n\nif (!disableUserSignupProcess) {\n  authSignupRouter.get('/auth/signup', async (context, next) => {\n    const { username, email } = context.query\n\n    await context.render('auth-page', {\n      pageElement: 'auth-signup',\n      elementScript: '/auth/signup.js',\n      data: {\n        username,\n        email,\n        passwordRule,\n        disableUserSignupProcess,\n        disableUserFavoredLanguage,\n        languages,\n        recaptchaSiteKey\n      }\n    })\n  })\n\n  authSignupRouter.post('/auth/signup', verifyRecaptcaMiddleware({ action: 'signup' }), async (context, next) => {\n    const { header, t } = context\n    const { domain } = context.state\n    const user = context.request.body\n\n    // try {\n    const { token } = await signup(\n      {\n        ...user,\n        context,\n        domain\n      },\n      true\n    )\n\n    const message = t('text.user registered successfully')\n    context.body = {\n      message,\n      token\n    }\n\n    setAccessTokenCookie(context, token)\n\n    if (accepts(header.accept, ['text/html', '*/*'])) {\n      await context.render('auth-page', {\n        pageElement: 'auth-result',\n        elementScript: '/auth/result.js',\n        data: {\n          message,\n          disableUserSignupProcess,\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n    }\n    // } catch (e) {\n    //   context.status = 401\n    //   context.body = e.message\n\n    //   if (accepts(header.accept, ['text/html', '*/*'])) {\n    //     await context.render('auth-page', {\n    //       pageElement: 'auth-signup',\n    //       elementScript: '/auth/signup.js',\n    //       data: {\n    //         message: e instanceof AuthError ? t(`error.${e.message}`) : e.message,\n    //         passwordRule\n    //       }\n    //     })\n    //   }\n    // }\n  })\n}\n"]}

package/dist-server/router/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/router/index.ts"],"names":[],"mappings":";;;AAAA,2EAAgD;AAChD,0EAA+C;AAC/C,uEAA4C;AAC5C,gEAAqC;AACrC,4DAAiC;AACjC,mEAAwC;AACxC,kEAAuC;AACvC,kEAAuC;AACvC,+DAAoC","sourcesContent":["export * from './auth-private-process-router.js'\nexport * from './auth-public-process-router.js'\nexport * from './path-base-domain-router.js'\nexport * from './site-root-router.js'\nexport * from './oauth2/index.js'\nexport * from './auth-checkin-router.js'\nexport * from './auth-signin-router.js'\nexport * from './auth-signup-router.js'\nexport * from './webauthn-router.js'\n"]}

package/dist-server/router/oauth2/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/router/oauth2/index.ts"],"names":[],"mappings":";;;AAAA,uEAA4C;AAC5C,6DAAkC","sourcesContent":["export * from './oauth2-authorize-router.js'\nexport * from './oauth2-router.js'\n"]}

package/dist-server/router/oauth2/oauth2-authorize-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-authorize-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-authorize-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAE/B,iDAAqD;AACrD,6CAA4C;AAE5C,6EAAsE;AACtE,yDAA2E;AAE9D,QAAA,qBAAqB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEjD,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD,8BAA8B;AAC9B,EAAE;AACF,oEAAoE;AACpE,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,6EAA6E;AAC7E,8EAA8E;AAC9E,0DAA0D;AAC1D,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,0CAA0C;AAE1C,6BAAqB,CAAC,GAAG,CACvB,YAAY,EACZ,yBAAiB,CAAC,SAAS,CAAC,KAAK,WAAW,QAAQ,EAAE,WAAW;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QACxD,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAA;IACF,oCAAoC;IACpC,4CAA4C;IAC5C,iBAAiB;IACjB,IAAI;IAEJ,OAAO,CAAC,MAAM,IAAI,4BAAS,EAAE,WAAW,CAAC,CAAA;AAC3C,CAAC,CAAC,EACF,KAAK,WAAW,OAAO,EAAE,IAAI;IAC3B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAE9C,IAAI,WAAW,GAAW,iBAAiB,CAAA;IAC3C,IAAI,aAAa,GAAW,iCAAiC,CAAA;IAE7D,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,4BAAS,CAAC,EAAE,EAAE,CAAC;QACtC,WAAW,GAAG,uBAAuB,CAAA;QACrC,aAAa,GAAG,uCAAuC,CAAA;IACzD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAClC,WAAW;YACX,aAAa;YACb,IAAI,EAAE;gBACJ,MAAM;gBACN,MAAM,EAAE;oBACN,GAAG,MAAM;oBACT,IAAI,EAAE;wBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;wBAClB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;wBACtB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;qBACzB;iBACF;gBACD,0BAA0B;gBAC1B,SAAS;aACV;SACF,CAAC,CAAA;QACF,uCAAuC;QACvC,oBAAoB;QACpB,2HAA2H;QAC3H,oBAAoB;QACpB,KAAK;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CACF,CAAA","sourcesContent":["import Router from 'koa-router'\n\nimport { getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { Application } from '../../service/application/application.js'\nimport { NonClient, server as oauth2orizeServer } from './oauth2-server.js'\n\nexport const oauth2AuthorizeRouter = new Router()\n\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\n// user authorization endpoint\n//\n// `authorization` middleware accepts a `validate` callback which is\n// responsible for validating the client making the authorization request.  In\n// doing so, is recommended that the `redirectURI` be checked against a\n// registered value, although security requirements may vary accross\n// implementations.  Once validated, the `done` callback must be invoked with\n// a `client` instance, as well as the `redirectURI` to which the user will be\n// redirected after an authorization decision is obtained.\n//\n// This middleware simply initializes a new authorization transaction.  It is\n// the application's responsibility to authenticate the user and render a dialog\n// to obtain their approval (displaying details about the client requesting\n// authorization).  We accomplish that here by routing through `ensureLoggedIn()`\n// first, and rendering the `dialog` view.\n\noauth2AuthorizeRouter.get(\n  '/authorize',\n  oauth2orizeServer.authorize(async function (clientID, redirectURI) {\n    const client = await getRepository(Application).findOneBy({\n      appKey: clientID\n    })\n    // CONFIRM-ME redirectUrl 의 허용 범위는 ?\n    // if (!client.redirectUrl != redirectURI) {\n    //   return false\n    // }\n\n    return [client || NonClient, redirectURI]\n  }),\n  async function (context, next) {\n    const { oauth2, user, domain } = context.state\n\n    let pageElement: string = 'oauth2-decision'\n    let elementScript: string = '/oauth2/oauth2-decision-page.js'\n\n    if (oauth2.client.id === NonClient.id) {\n      pageElement = 'oauth2-decision-error'\n      elementScript = '/oauth2/oauth2-decision-error-page.js'\n    }\n\n    try {\n      await context.render('oauth2-page', {\n        pageElement,\n        elementScript,\n        data: {\n          domain,\n          oauth2: {\n            ...oauth2,\n            user: {\n              id: oauth2.user.id,\n              name: oauth2.user.name,\n              email: oauth2.user.email\n            }\n          },\n          disableUserFavoredLanguage,\n          languages\n        }\n      })\n      // await context.render(decisionPage, {\n      //   domain: domain,\n      //   ...oauth2, // client, redirectURI, req { type, clientID, redirectURI, scope, state}, user, transactionID, info, locals\n      //   availableScopes\n      // })\n    } catch (e) {\n      throw e\n    }\n  }\n)\n"]}

package/dist-server/router/oauth2/oauth2-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-router.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-router.ts"],"names":[],"mappings":";;;;AAAA,wEAA8B;AAC9B,sEAAiC;AACjC,wEAAmC;AACnC,oEAA+B;AAE/B,iDAA6D;AAE7D,yDAAsE;AACtE,6EAAsE;AACtE,wDAA6D;AAC7D,+EAAyE;AACzE,6DAAkD;AAClD,yDAAgE;AAChE,6FAAyF;AAU5E,QAAA,YAAY,GAAG,IAAI,oBAAM,EAAE,CAAA;AAExC,sBAAQ,CAAC,GAAG,CACV,wBAAwB,EACxB,IAAI,6CAAsB,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE;IAC9D,IAAA,qBAAa,EAAC,4BAAW,CAAC;SACvB,SAAS,CAAC;QACT,MAAM,EAAE,QAAQ;KACjB,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,EAAE;QACb,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACjB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpB,CAAC,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC5B,CAAC,CAAC,CACH,CAAA;AAED,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,cAAc;AAEd,oBAAY,CAAC,IAAI,CACf,WAAW,EACX,oCAAyB,EACzB,IAAA,qBAAO,EACL,yBAAiB,CAAC,QAAQ,CAAC,KAAK,WAAW,OAAO;IAChD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAE3B,OAAO,OAAO,CAAC,IAAI,CAAA;AACrB,CAAC,CAAC,CACH,CACF,CAAA;AAED,iBAAiB;AACjB,EAAE;AACF,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,sDAAsD;AAEtD,oBAAY,CAAC,IAAI,CACf,eAAe,EACf,sBAAQ,CAAC,YAAY,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACnE,yBAAiB,CAAC,KAAK,EAAE,EACzB,yBAAiB,CAAC,YAAY,EAAE,CACjC,CAAA;AAED,oBAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1D,MAAM,YAAY,GAAuB,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAA;IAC5E,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAE3D,MAAM,OAAO,GAAqB,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACpE,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAEtD,IAAI,CAAC;QACH,sBAAG,CAAC,MAAM,CAAC,YAAY,EAAE,sBAAM,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,YAAY,CAAQ,CAAA;QAC/C,MAAM,SAAS,GAAW,OAAO,CAAC,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,MAAM,GAAuB,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,OAAO,CAAC;YACrE,KAAK,EAAE,EAAE,SAAS,EAAE;SACrB,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAA;QACnD,MAAM,MAAM,GAAW,OAAO,CAAC,WAAW,CAAC,MAAM,CAAA;QACjD,MAAM,MAAM,GAAU,OAAO,CAAC,KAAK,CAAA;QAEnC;;;;WAIG;QACH,MAAM,cAAc,GAAW,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QACnG,MAAM,eAAe,GAAW,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAA;QAErG,OAAO,CAAC,QAAQ,GAAG,eAAe,CAAA;QAClC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,IAAA,6CAAoB,EAAC,OAAO,EAAE,cAAc,CAAC,CAAA;QAE7C,OAAO,CAAC,IAAI,GAAG;YACb,WAAW,EAAE,cAAc;YAC3B,YAAY,EAAE,eAAe;SAC9B,CAAA;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAA;IAC1B,CAAC;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,GAAG,CAAC,UAAU,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACjE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,EAAE,CAAA;IAEnG,IAAI,WAAW,GAAG,EAAE,CAAA;IACpB,IAAI,IAAI,IAAI,aAAa,EAAE,CAAC;QAC1B,wDAAwD;QACxD,WAAW,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,GAAG;QACb,OAAO,EAAE;YACP,IAAI;YACJ,WAAW;YACX,KAAK;YACL,IAAI,CAAC,wCAAwC;YAC7C,MAAM,EAAE;gBACN,IAAI,EAAE,UAAU;gBAChB,SAAS;gBACT,SAAS;gBACT,UAAU;gBACV,YAAY;gBACZ,QAAQ;aACT;YACD,WAAW;SACZ;KACF,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,oBAAY,CAAC,IAAI,CAAC,aAAa,EAAE,oCAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,IAAI,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,CAAA;YACjB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAA;YACf,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,OAAO,CAAA;YAChC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAA;IACrB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,CAAA;IACT,CAAC;AACH,CAAC,CAAC,CAAA","sourcesContent":["import jwt from 'jsonwebtoken'\nimport compose from 'koa-compose'\nimport passport from 'koa-passport'\nimport Router from 'koa-router'\n\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { jwtAuthenticateMiddleware } from '../../middlewares/index.js'\nimport { Application } from '../../service/application/application.js'\nimport { User, UserStatus } from '../../service/user/user.js'\nimport { setAccessTokenCookie } from '../../utils/access-token-cookie.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { server as oauth2orizeServer } from './oauth2-server.js'\nimport { Strategy as ClientPasswordStrategy } from './passport-oauth2-client-password.js'\n\ndeclare global {\n  namespace NodeJS {\n    interface Process {\n      oauthDisconnect: (user: User) => Promise<void>\n    }\n  }\n}\n\nexport const oauth2Router = new Router()\n\npassport.use(\n  'oauth2-client-password',\n  new ClientPasswordStrategy({}, (clientId, clientSecret, done) => {\n    getRepository(Application)\n      .findOneBy({\n        appKey: clientId\n      })\n      .then(client => {\n        if (!client || client.appSecret != clientSecret) {\n          done(null, false)\n          return\n        }\n\n        done(null, client)\n      })\n      .catch(err => done(err))\n  })\n)\n\n// user decision endpoint\n//\n// `decision` middleware processes a user's decision to allow or deny access\n// requested by a client application.  Based on the grant type requested by the\n// client, the above grant middleware configured above will be invoked to send\n// a response.\n\noauth2Router.post(\n  '/decision',\n  jwtAuthenticateMiddleware,\n  compose(\n    oauth2orizeServer.decision(async function (context) {\n      const { request } = context\n\n      return request.body\n    })\n  )\n)\n\n// token endpoint\n//\n// `token` middleware handles client requests to exchange authorization grants\n// for access tokens.  Based on the grant type being exchanged, the above\n// exchange middleware will be invoked to handle the request.  Clients must\n// authenticate when making requests to this endpoint.\n\noauth2Router.post(\n  '/access-token',\n  passport.authenticate('oauth2-client-password', { session: false }),\n  oauth2orizeServer.token(),\n  oauth2orizeServer.errorHandler()\n)\n\noauth2Router.post('/refresh-token', async (context, next) => {\n  const refreshToken: string | undefined = context.request?.body?.refreshToken\n  if (!refreshToken) throw new Error('Missing refresh token')\n\n  const appUser: User | undefined = await getRepository(User).findOneBy({\n    password: refreshToken\n  })\n\n  if (!appUser) throw new Error('App user is not found')\n\n  try {\n    jwt.verify(refreshToken, SECRET)\n    const decoded = jwt.decode(refreshToken) as any\n    const subdomain: string = decoded.domain.subdomain\n    const domain: Domain | undefined = await getRepository(Domain).findOne({\n      where: { subdomain }\n    })\n    if (!domain) throw new Error('Domain is not found')\n    const appKey: string = decoded.application.appKey\n    const scopes: any[] = decoded.scope\n\n    /*\n     * This route reads the key back out of the token rather than holding the application, so it\n     * names the field. The signer takes `{ appKey }` for exactly this reason — see the note on\n     * `Application.sign`.\n     */\n    const newAccessToken: string = Application.generateAccessToken(domain, appUser, { appKey }, scopes)\n    const newRefreshToken: string = Application.generateRefreshToken(domain, appUser, { appKey }, scopes)\n\n    appUser.password = newRefreshToken\n    await getRepository(User).save(appUser)\n\n    setAccessTokenCookie(context, newAccessToken)\n\n    context.body = {\n      accessToken: newAccessToken,\n      refreshToken: newRefreshToken\n    }\n  } catch (e) {\n    context.status = 401\n    context.body = e.message\n  }\n})\n\noauth2Router.get('/profile', jwtAuthenticateMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const { name, description, email, userType: type, locale } = user\n  const { name: domainName, subdomain, brandName, brandImage, contentImage, timezone } = domain || {}\n\n  var application = {}\n  if (type == 'application') {\n    /* user entity에 reference 필드가 추가되기 전까지, appKey취득 방법임. */\n    application['appKey'] = email.substr(0, email.lastIndexOf('@'))\n  }\n\n  context.body = {\n    profile: {\n      name,\n      description,\n      email,\n      type /* (admin|user|application|appliance) */,\n      domain: {\n        name: domainName,\n        subdomain,\n        brandName,\n        brandImage,\n        contentImage,\n        timezone\n      },\n      application\n    }\n  }\n})\n\noauth2Router.post('/disconnect', jwtAuthenticateMiddleware, async (context, next) => {\n  try {\n    let { user } = context.state\n\n    if (typeof process.oauthDisconnect === 'function') {\n      await process.oauthDisconnect(user)\n    } else {\n      user.domains = []\n      user.roles = []\n      user.status = UserStatus.DELETED\n      await getRepository(User).save(user)\n    }\n    context.status = 200\n    context.body = 'ok'\n  } catch (e) {\n    throw e\n  }\n})\n"]}

package/dist-server/router/oauth2/oauth2-server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauth2-server.js","sourceRoot":"","sources":["../../../server/router/oauth2/oauth2-server.ts"],"names":[],"mappings":";;;;AAAA,8EAAyC;AACzC,qCAAmC;AAEnC,6CAA4C;AAC5C,iDAA6D;AAE7D,6EAAsE;AACtE,wDAAiD;AACjD,wDAA6D;AAE7D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEnB,QAAA,QAAQ,GAAG,UAAU,CAAA;AACrB,QAAA,SAAS,GAAG;IACvB,EAAE,EAAE,gBAAQ;CACb,CAAA;AAED,0BAA0B;AACb,QAAA,MAAM,GAAG,yBAAW,CAAC,YAAY,EAAE,CAAA;AAEhD,2DAA2D;AAC3D,EAAE;AACF,oEAAoE;AACpE,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,yBAAyB;AACzB,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,sCAAsC;AAEtC,cAAM,CAAC,eAAe,CAAC,KAAK,WAAW,MAAM;IAC3C,OAAO,MAAM,CAAC,EAAE,CAAA;AAClB,CAAC,CAAC,CAAA;AAEF,cAAM,CAAC,iBAAiB,CAAC,KAAK,WAAW,EAAE;IACzC,IAAI,EAAE,IAAI,gBAAQ,EAAE,CAAC;QACnB,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IACtE,OAAO,WAAW,CAAA;AACpB,CAAC,CAAC,CAAA;AAEF,kCAAkC;AAClC,EAAE;AACF,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,iCAAiC;AAEjC,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,2EAA2E;AAC3E,qDAAqD;AAErD,cAAM,CAAC,KAAK,CACV,yBAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IAExD,OAAO,4BAAW,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC,CAAC,CACH,CAAA;AAED,4EAA4E;AAC5E,sEAAsE;AACtE,8EAA8E;AAC9E,8EAA8E;AAC9E,QAAQ;AAER,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,wBAAwB;QACxB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAElD,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,sGAAsG;IACtG,kBAAkB;IAClB,wFAAwF;IACxF,mBAAmB;IACnB,8BAA8B;IAC9B,MAAM;IACN,oBAAoB;IACpB,yBAAyB;IACzB,uIAAuI;IACvI,MAAM;IACN,IAAI;IAEJ,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAElF,MAAM,YAAY,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,SAAS,EAAE,CAAA;IAE1D,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QAED,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;KAC7C,CAAC,CAAA;IAEF,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;QACvC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAClB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,WAAW,CAAC,IAAI;QACtB,QAAQ,EAAE,aAAa;QACvB,SAAS,EAAE,WAAW,CAAC,EAAE;QACzB,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,oBAAU,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO;QAChB,OAAO;KACR,CAAC,CAAA;IAEF,gDAAgD;IAChD,2CAA2C;IAC3C,2BAA2B;IAC3B,KAAK;IAEL,8CAA8C;IAC9C,0CAA0C;IAC1C,yEAAyE;IACzE,qEAAqE;IAErE,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IACvF,IAAI,YAAY,GAAG,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IAEzF,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;QAC7B,GAAI,OAAe;QACnB,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;YACpB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA;AAED,cAAM,CAAC,QAAQ,CACb,yBAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE;IACtE,IAAI,CAAC;QACH,mBAAmB;QACnB,IAAI,OAAO,GAAQ,4BAAW,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,YAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACf,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EACJ,EAAE,EACF,QAAQ,EACR,KAAK,EACL,WAAW,EAAE,EAAE,MAAM,EAAE,EACvB,MAAM,EAAE,EAAE,SAAS,EAAE,EACrB,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,UAAU,EAChB,GAAG,OAAO,CAAA;IAEX,MAAM,WAAW,GAAgB,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM;KACP,CAAC,CAAA;IAEF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,EAAE,CAAC;QACnC,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC;QAC3D,SAAS;KACV,CAAC,CAAA;IAEF,MAAM,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;QACxD,EAAE;QACF,QAAQ;KACT,CAAC,CAAA;IAEF,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,SAAS,EAAE,CAAA;IAE7C,IAAI,OAAO,GAAS,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE;YACL,KAAK,EAAE,YAAY;YACnB,SAAS,EAAE,WAAW,CAAC,EAAE;YACzB,QAAQ,EAAE,aAAa;SACxB;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,CAAC,CAAA;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,YAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACxC,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IAEH,KAAK,GAAG,KAAK,IAAI,aAAa,CAAA;IAE9B,MAAM,MAAM,GAAa,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACvD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClF,IAAI,eAAe,EAAE,CAAC;QACpB,YAAM,CAAC,KAAK,CAAC,oBAAoB,eAAe,YAAY,CAAC,CAAA;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,MAAM,CAAC;QAC7C,IAAI,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;QAChB,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;KAC1B,CAAC,CAAA;IAEF,IAAI,WAAW,GAAG,4BAAW,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IACtF,IAAI,YAAY,GAAQ,4BAAW,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;IAE7F,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;QAC7B,GAAI,OAAe;QACnB,KAAK;QACL,QAAQ,EAAE,YAAY;KACvB,CAAC,CAAA;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ;YACE,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,SAAS;YACvC,UAAU,EAAE,QAAQ;SACrB;KACF,CAAA;AACH,CAAC,CAAC,CACH,CAAA","sourcesContent":["import oauth2orize from 'oauth2orize-koa'\nimport { ILike, In } from 'typeorm'\n\nimport { logger } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { Application } from '../../service/application/application.js'\nimport { Role } from '../../service/role/role.js'\nimport { User, UserStatus } from '../../service/user/user.js'\n\nconst crypto = require('crypto')\n\nexport const NOTFOUND = 'NOTFOUND'\nexport const NonClient = {\n  id: NOTFOUND\n}\n\n// create OAuth 2.0 server\nexport const server = oauth2orize.createServer()\n\n// Register serialialization and deserialization functions.\n//\n// When a client redirects a user to user authorization endpoint, an\n// authorization transaction is initiated.  To complete the transaction, the\n// user must authenticate and approve the authorization request.  Because this\n// may involve multiple HTTP request/response exchanges, the transaction is\n// stored in the session.\n//\n// An application must supply serialization functions, which determine how the\n// client object is serialized into the session.  Typically this will be a\n// simple matter of serializing the client's ID, and deserializing by finding\n// the client by ID from the database.\n\nserver.serializeClient(async function (client) {\n  return client.id\n})\n\nserver.deserializeClient(async function (id) {\n  if (id == NOTFOUND) {\n    return {}\n  }\n\n  const application = await getRepository(Application).findOneBy({ id })\n  return application\n})\n\n// Register supported grant types.\n//\n// OAuth 2.0 specifies a framework that allows users to grant client\n// applications limited access to their protected resources.  It does this\n// through a process of the user granting access, and the client exchanging\n// the grant for an access token.\n\n// Grant authorization codes.  The callback takes the `client` requesting\n// authorization, the `redirectURI` (which is used as a verifier in the\n// subsequent exchange), the authenticated `user` granting access, and\n// their response, which contains approved scope, duration, etc. as parsed by\n// the application.  The application issues a code, which is bound to these\n// values, and will be exchanged for an access token.\n\nserver.grant(\n  oauth2orize.grant.code(async (client, redirectUrl, user, ares, areq) => {\n    const { email, appKey, subdomain, scopes, state } = ares\n\n    return Application.generateAuthCode(email, appKey, subdomain, scopes, state)\n  })\n)\n\n// Exchange authorization codes for access tokens.  The callback accepts the\n// `client`, which is exchanging `code` and any `redirectURI` from the\n// authorization request for verification.  If these values are validated, the\n// application issues an access token on behalf of the user who authorized the\n// code.\n\nserver.exchange(\n  oauth2orize.exchange.code(async (client, code, redirectUrl) => {\n    try {\n      /* authorization code */\n      var decoded: any = Application.verifyAuthCode(code)\n    } catch (e) {\n      return false\n    }\n    let { email, appKey, subdomain, scopes } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      return false\n    }\n\n    /* DONT-FORGET uncomment after test */\n    // if (redirectUrl !== application.redirectUrl && redirectUrl.indexOf(application.redirectUrl) != 0) {\n    //   logger.error(\n    //     'oauth2 exchange error - redirectUrl should begins with the application setting',\n    //     redirectUrl,\n    //     application.redirectUrl\n    //   )\n    //   // return false\n    //   throw new TypeError(\n    //     `oauth2 exchange error - redirectUrl should begins with the application setting : '${redirectUrl}':'${application.redirectUrl}'`\n    //   )\n    // }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({ email: ILike(email) })\n\n    const appuserEmail = `${crypto.randomUUID()}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n\n      relations: ['domains', 'creator', 'updater']\n    })\n\n    appuser = await getRepository(User).save({\n      ...(appuser || {}),\n      email: appuserEmail,\n      name: application.name,\n      userType: 'application',\n      reference: application.id,\n      domains: [domain],\n      roles: scopes,\n      status: UserStatus.ACTIVATED,\n      updater: creator,\n      creator\n    })\n\n    // appuser = await getRepository(User).findOne({\n    //   where: { email: ILike(appuserEmail) },\n    //   relations: ['domains']\n    // })\n\n    // appuser.domains = Promise.resolve([domain])\n    // await getRepository(User).save(appuser)\n    // Lazy relation 필드들(domain, domains)들에 대한 업데이트. 이상의 방법으로 업데이트 해야하는 것 같다.\n    // Lazy relation 업데이트 방법의 일관성이 부족하므로, Lazy relation 필드를 사용하지 않기를 권장함.\n\n    var accessToken = Application.generateAccessToken(domain, appuser, application, scopes)\n    var refreshToken = Application.generateRefreshToken(domain, appuser, application, scopes)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer',\n        centerId: subdomain\n      }\n    ]\n  })\n)\n\nserver.exchange(\n  oauth2orize.exchange.refreshToken(async (client, refreshToken, scope) => {\n    try {\n      /* refresh token */\n      var decoded: any = Application.verifyAuthCode(refreshToken)\n    } catch (e) {\n      logger.error(e)\n      return false\n    }\n    const {\n      id,\n      userType,\n      email,\n      application: { appKey },\n      domain: { subdomain },\n      scope: originalScope,\n      exp: expires_in\n    } = decoded\n\n    const application: Application = await getRepository(Application).findOneBy({\n      appKey\n    })\n\n    if (!application) {\n      logger.error('application is not exist')\n      return false\n    }\n\n    if (Date.now() > expires_in * 1000) {\n      logger.error('refresh token is expired')\n      return false\n    }\n\n    const domain: Domain = await getRepository(Domain).findOneBy({\n      subdomain\n    })\n\n    const creator: User = await getRepository(User).findOneBy({\n      id,\n      userType\n    })\n\n    const appuserEmail = `${appKey}@${subdomain}`\n\n    var appuser: User = await getRepository(User).findOne({\n      where: {\n        email: appuserEmail,\n        reference: application.id,\n        userType: 'application'\n      },\n      relations: ['domain', 'creator', 'updater']\n    })\n\n    if (!appuser) {\n      logger.error('application is not bound')\n      return false\n    }\n\n    /*\n     * `scope` is the scope of access requested by the client, which must not include any scope not originally granted.\n     */\n\n    scope = scope || originalScope\n\n    const scopes: string[] = scope.split(',')\n    const originalScopes = (originalScope || '').split(',')\n    const additionalScope = scopes.find(scope => originalScopes.indexOf(scope) === -1)\n    if (additionalScope) {\n      logger.error(`additional scope(${additionalScope}) required`)\n      return false\n    }\n\n    const roles = await getRepository(Role).findBy({\n      name: In(scopes),\n      domain: { id: domain.id }\n    })\n\n    var accessToken = Application.generateAccessToken(domain, appuser, application, scope)\n    var refreshToken: any = Application.generateRefreshToken(domain, appuser, application, scope)\n\n    await getRepository(User).save({\n      ...(appuser as any),\n      roles,\n      password: refreshToken\n    })\n\n    return [\n      accessToken,\n      refreshToken,\n      {\n        expires_in: 30 * 24 * 60 * 60 /* 30d */,\n        token_type: 'bearer'\n      }\n    ]\n  })\n)\n"]}

package/dist-server/router/oauth2/passport-oauth2-client-password.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passport-oauth2-client-password.js","sourceRoot":"","sources":["../../../server/router/oauth2/passport-oauth2-client-password.ts"],"names":[],"mappings":";;AASA,4BAWC;;AApBD,wEAAmC;AACnC,wDAAuB;AAEvB;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACtC,IAAI,OAAO,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,OAAO,CAAA;QAChB,OAAO,GAAG,EAAE,CAAA;IACd,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAE7F,sBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;IACrB,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAA;AACrD,CAAC;AAED;;GAEG;AACH,cAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAQ,CAAC,QAAQ,CAAC,CAAA;AAE1C,SAAS,oBAAoB,CAAC,aAAa,GAAG,EAAE;IAC9C,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAM;IACR,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,WAAW,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,SAAS,CAAC,YAAY,GAAG,UAAU,GAAG;IAC7C,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;QACpB,CAAC;QAED,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,IAAI,GAAG,IAAI,CAAA;IAEf,SAAS,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IAChD,CAAC;AACH,CAAC,CAAA","sourcesContent":["import passport from 'koa-passport'\nimport util from 'util'\n\n/**\n * `Oauth2ClientPasswordStrategy` constructor.\n *\n * @api protected\n * Basic Authorization Header와 Body 형식을 모두 지원한다.\n */\nexport function Strategy(options, verify) {\n  if (typeof options == 'function') {\n    verify = options\n    options = {}\n  }\n  if (!verify) throw new Error('OAuth 2.0 client password strategy requires a verify function')\n\n  passport.Strategy.call(this)\n  this.name = 'oauth2-client-password'\n  this._verify = verify\n  this._passReqToCallback = options.passReqToCallback\n}\n\n/**\n * Inherit from `passport.Strategy`.\n */\nutil.inherits(Strategy, passport.Strategy)\n\nfunction fetchBasicCredential(authorization = '') {\n  var parts = authorization.split(' ')\n  if (parts.length < 2) {\n    return\n  }\n\n  var scheme = parts[0]\n  var credentials = new Buffer(parts[1], 'base64').toString().split(':')\n\n  if (!/Basic/i.test(scheme)) {\n    return\n  }\n  if (credentials.length < 2) {\n    return\n  }\n\n  var clientId = credentials[0]\n  var clientSecret = credentials[1]\n  if (!clientId || !clientSecret) {\n    return\n  }\n\n  return [clientId, clientSecret]\n}\n\n/**\n * Authenticate request based on client credentials in the request body.\n *\n * @param {Object} req\n * @api protected\n */\nStrategy.prototype.authenticate = function (req) {\n  var [clientId, clientSecret] = fetchBasicCredential(req.headers['authorization']) || []\n  if (!clientId) {\n    if (!req.body || !req.body['client_id'] || !req.body['client_secret']) {\n      return this.fail()\n    }\n\n    clientId = req.body['client_id']\n    clientSecret = req.body['client_secret']\n  }\n\n  var self = this\n\n  function verified(err, client, info) {\n    if (err) {\n      return self.error(err)\n    }\n    if (!client) {\n      return self.fail()\n    }\n    self.success(client, info)\n  }\n\n  if (self._passReqToCallback) {\n    this._verify(req, clientId, clientSecret, verified)\n  } else {\n    this._verify(clientId, clientSecret, verified)\n  }\n}\n"]}

package/dist-server/router/oauth2/passport-refresh-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"passport-refresh-token.js","sourceRoot":"","sources":["../../../server/router/oauth2/passport-refresh-token.ts"],"names":[],"mappings":";;AASA,4BAWC;;AApBD,wEAAmC;AACnC,wDAAuB;AAEvB;;;;;GAKG;AACH,SAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM;IACtC,IAAI,OAAO,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,GAAG,OAAO,CAAA;QAChB,OAAO,GAAG,EAAE,CAAA;IACd,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAE3F,sBAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC3B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAA;IACrB,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAA;AACrD,CAAC;AAED;;GAEG;AACH,cAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAQ,CAAC,QAAQ,CAAC,CAAA;AAE1C,SAAS,oBAAoB,CAAC,aAAa,GAAG,EAAE;IAC9C,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAM;IACR,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,WAAW,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAM;IACR,CAAC;IAED,IAAI,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/B,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;AACjC,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,SAAS,CAAC,YAAY,GAAG,UAAU,GAAG;IAC7C,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAA;IACvF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;QACpB,CAAC;QAED,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAChC,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC1C,CAAC;IAED,IAAI,IAAI,GAAG,IAAI,CAAA;IAEf,SAAS,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;QACpB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC5B,CAAC;IAED,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IACrD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IAChD,CAAC;AACH,CAAC,CAAA","sourcesContent":["import passport from 'koa-passport'\nimport util from 'util'\n\n/**\n * `PassportRefreshTokenStrategy` constructor.\n *\n * @api protected\n * Basic Authorization Header와 Body 형식을 모두 지원한다.\n */\nexport function Strategy(options, verify) {\n  if (typeof options == 'function') {\n    verify = options\n    options = {}\n  }\n  if (!verify) throw new Error('OAuth 2.0 refresh-token strategy requires a verify function')\n\n  passport.Strategy.call(this)\n  this.name = 'refresh-token'\n  this._verify = verify\n  this._passReqToCallback = options.passReqToCallback\n}\n\n/**\n * Inherit from `passport.Strategy`.\n */\nutil.inherits(Strategy, passport.Strategy)\n\nfunction fetchBasicCredential(authorization = '') {\n  var parts = authorization.split(' ')\n  if (parts.length < 2) {\n    return\n  }\n\n  var scheme = parts[0]\n  var credentials = new Buffer(parts[1], 'base64').toString().split(':')\n\n  if (!/Basic/i.test(scheme)) {\n    return\n  }\n  if (credentials.length < 2) {\n    return\n  }\n\n  var clientId = credentials[0]\n  var clientSecret = credentials[1]\n  if (!clientId || !clientSecret) {\n    return\n  }\n\n  return [clientId, clientSecret]\n}\n\n/**\n * Authenticate request based on client credentials in the request body.\n *\n * @param {Object} req\n * @api protected\n */\nStrategy.prototype.authenticate = function (req) {\n  var [clientId, clientSecret] = fetchBasicCredential(req.headers['authorization']) || []\n  if (!clientId) {\n    if (!req.body || !req.body['client_id'] || !req.body['client_secret']) {\n      return this.fail()\n    }\n\n    clientId = req.body['client_id']\n    clientSecret = req.body['client_secret']\n  }\n\n  var self = this\n\n  function verified(err, client, info) {\n    if (err) {\n      return self.error(err)\n    }\n    if (!client) {\n      return self.fail()\n    }\n    self.success(client, info)\n  }\n\n  if (self._passReqToCallback) {\n    this._verify(req, clientId, clientSecret, verified)\n  } else {\n    this._verify(clientId, clientSecret, verified)\n  }\n}\n"]}

package/dist-server/router/path-base-domain-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-base-domain-router.js","sourceRoot":"","sources":["../../server/router/path-base-domain-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAElB,QAAA,oBAAoB,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEhD,wCAAwC;AACxC,4BAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACxD,MAAM,IAAI,EAAE,CAAA;AACd,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\n\nexport const pathBaseDomainRouter = new Router()\n\n/* browser history fallback 을 위한 라우터. */\npathBaseDomainRouter.get('/(.*)', async (context, next) => {\n  await next()\n})\n"]}

package/dist-server/router/site-root-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"site-root-router.js","sourceRoot":"","sources":["../../server/router/site-root-router.ts"],"names":[],"mappings":";;;AAcA,4BAWC;;AAzBD,oEAA+B;AAC/B,wEAAmC;AAEnC,iDAAgE;AAChE,6CAA4C;AAE5C,qDAA8C;AAC9C,sEAA6D;AAE7D,MAAM,iBAAiB,GAAG,YAAM,CAAC,GAAG,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAA;AAE1D,QAAA,cAAc,GAAG,IAAI,oBAAM,EAAE,CAAA;AAE1C,6FAA6F;AACtF,KAAK,UAAU,QAAQ,CAAC,OAAO,EAAE,IAAI;IAC1C,OAAO,MAAM,sBAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzF,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,cAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;gBAC1C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAA;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAA,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;AACnB,CAAC;AAED,sBAAc,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,wBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC1E,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEtC,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IAEnC,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,WAAW,GAAsB,MAAM,IAAA,oCAAc,EAAC,IAAI,CAAC,CAAA;QACjE,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,CAAC;YACtE,OAAO,MAAM,IAAI,EAAE,CAAA;QACrB,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACvD,CAAC;IAED,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;QAEjC,OAAM;IACR,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;AACrC,CAAC,CAAC,CAAA","sourcesContent":["import Router from 'koa-router'\nimport passport from 'koa-passport'\n\nimport { Domain, domainMiddleware } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { User } from '../service/user/user.js'\nimport { getUserDomains } from '../utils/get-user-domains.js'\n\nconst PUBLIC_HOME_ROUTE = config.get('publicHomeRoute', '/public/home')\n\nexport const siteRootRouter = new Router()\n\n/** Who the access token says this is, when it says anyone - the route goes on either way. */\nexport async function findAuth(context, next) {\n  return await passport.authenticate('jwt', { session: false }, async (err, decoded, info) => {\n    if (decoded) {\n      try {\n        const user = await User.checkAuth(decoded)\n        context.state.user = user\n      } catch (e) {}\n    }\n\n    await next()\n  })(context, next)\n}\n\nsiteRootRouter.get('/', findAuth, domainMiddleware, async (context, next) => {\n  const { user, domain } = context.state\n\n  const subdomain = domain?.subdomain\n\n  if (user && subdomain) {\n    const userDomains: Partial<Domain>[] = await getUserDomains(user)\n    if (userDomains.find(userDomain => userDomain.subdomain == subdomain)) {\n      return await next()\n    }\n\n    return context.redirect(`/auth/checkin/${subdomain}`)\n  }\n\n  if (user && !subdomain) {\n    context.redirect('/auth/checkin')\n\n    return\n  }\n\n  context.redirect(PUBLIC_HOME_ROUTE)\n})\n"]}

package/dist-server/router/webauthn-router.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"webauthn-router.js","sourceRoot":"","sources":["../../server/router/webauthn-router.ts"],"names":[],"mappings":";;;;AAAA,oEAA+B;AAC/B,6CAAwD;AAExD,0DAUkC;AAClC,4EAAoE;AACpE,2DAAmD;AACnD,wDAAyD;AACzD,wGAA8G;AAC9G,4EAAsE;AACtE,8EAAyE;AAE5D,QAAA,0BAA0B,GAAG,IAAI,oBAAM,EAAE,CAAA;AACzC,QAAA,2BAA2B,GAAG,IAAI,oBAAM,EAAE,CAAA;AAEvD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,gBAAiB,CAAA;AAE1C,MAAM,0BAA0B,GAAG,YAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAA;AACvF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAA;AAErD;;;GAGG;AAEH,6EAA6E;AAC7E,mCAA2B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACjF,MAAM,OAAO,GAAG,MAAM,IAAA,4BAAe,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,IAAA,mBAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IAE1E,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,GAAG,GAAG,CAAA;QACpB,OAAO,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAA;QAC7E,OAAM;IACR,CAAC;IAED,IAAA,8BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,2FAA2F;AAC3F,mCAA2B,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACxE,MAAM,SAAS,GAAG,IAAA,0BAAa,EAAC,OAAO,CAAC,CAAA;IACxC,MAAM,IAAA,qCAAe,EAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAA,gCAAmB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAA,mBAAM,EAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAE9H,OAAO,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAA;AACnF,CAAC,CAAC,CAAA;AAEF,gFAAgF;AAChF,mCAA2B,CAAC,IAAI,CAAC,wBAAwB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC/C,MAAM,IAAA,qCAAe,EAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAA,0BAAc,EAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;IAEzG,OAAO,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AACpC,CAAC,CAAC,CAAA;AAEF,mHAAmH;AACnH,mCAA2B,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACxE,OAAO,CAAC,IAAI,GAAG,EAAE,cAAc,EAAE,IAAA,yCAAc,EAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAA;AAC3G,CAAC,CAAC,CAAA;AAEF,2DAA2D;AAC3D,mCAA2B,CAAC,MAAM,CAAC,wBAAwB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IAC3E,IAAA,6CAAkB,EAAC,OAAO,CAAC,CAAA;IAC3B,OAAO,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACrC,CAAC,CAAC,CAAA;AAEF,4CAA4C;AAC5C,mCAA2B,CAAC,GAAG,CAAC,mCAAmC,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACnF,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAA,mBAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IAEtF,IAAA,8BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF,iGAAiG;AACjG,mCAA2B,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IAC5E,MAAM,SAAS,GAAG,IAAA,0BAAa,EAAC,OAAO,CAAC,CAAA;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAErD,MAAM,IAAA,4BAAe,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAA,mBAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IAErF,OAAO,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;AACnC,CAAC,CAAC,CAAA;AAEF;;;GAGG;AACH,mCAA2B,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACrE,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,oBAAoB;QACjC,aAAa,EAAE,wBAAwB;QACvC,IAAI,EAAE;YACJ,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ;YACrC,UAAU,EAAE,IAAA,gDAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC;YACtE,0BAA0B;YAC1B,SAAS;SACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,aAAa;AACb,kCAA0B,CAAC,GAAG,CAAC,iCAAiC,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IAChF,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAa,EAAC,IAAA,mBAAM,EAAC,OAAO,CAAC,CAAC,CAAA;IAEpD,IAAA,8BAAiB,EAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC7C,OAAO,CAAC,IAAI,GAAG,OAAO,CAAA;AACxB,CAAC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,kCAA0B,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;IACvE,MAAM,SAAS,GAAG,IAAA,0BAAa,EAAC,OAAO,CAAC,CAAA;IACxC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAA;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;IAEhC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAA,8BAAiB,EAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAA,mBAAM,EAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAA;IACzG,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAEpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,kBAAkB,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC,CAAA;AAC/H,CAAC,CAAC,CAAA;AAEF,yHAAyH;AACzH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,yBAAS,CAAC,EAAE,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,yBAAyB,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;IAC9H,CAAC;AACH,CAAC","sourcesContent":["import Router from 'koa-router'\nimport { appPackage, config } from '@things-factory/env'\n\nimport {\n  registerPasskey,\n  registrationOptions,\n  rememberChallenge,\n  reverifyOptions,\n  reverifyWithPasskey,\n  signinOptions,\n  signinWithPasskey,\n  siteOf,\n  takeChallenge\n} from '../controllers/passkey.js'\nimport { confirmIdentity } from '../controllers/confirm-identity.js'\nimport { AuthError } from '../errors/auth-error.js'\nimport { verifyPassword } from '../controllers/signin.js'\nimport { confirmedUntil, forgetConfirmation } from '../service/identity-confirmation/identity-confirmation.js'\nimport { setAccessTokenCookie } from '../utils/access-token-cookie.js'\nimport { sameOriginRedirectPath } from '../utils/same-origin-redirect.js'\n\nexport const webAuthnGlobalPublicRouter = new Router()\nexport const webAuthnGlobalPrivateRouter = new Router()\n\nconst { name: rpName } = appPackage as any\n\nconst disableUserFavoredLanguage = config.get('i18n/disableUserFavoredLanguage', false)\nconst languages = config.get('i18n/languages', false)\n\n/*\n * A refusal throws `AuthError`; `authenticate401Middleware` answers it with 401 and the refusal in\n * the request's language as the body. The screens read that body as the message.\n */\n\n// Confirming it is the signed-in person - only their own passkeys can answer\nwebAuthnGlobalPrivateRouter.get('/auth/verify-webauthn/challenge', async context => {\n  const options = await reverifyOptions(context.state.user, siteOf(context))\n\n  if (!options) {\n    context.status = 400\n    context.body = { error: 'No biometric credentials registered for this user' }\n    return\n  }\n\n  rememberChallenge(context, options.challenge)\n  context.body = options\n})\n\n/* A passkey that answers is also the recent confirmation a door may ask for (ADR-0168). */\nwebAuthnGlobalPrivateRouter.post('/auth/verify-webauthn', async context => {\n  const challenge = takeChallenge(context)\n  await confirmIdentity('passkey', context, user => reverifyWithPasskey(user, context.request.body, challenge, siteOf(context)))\n\n  context.body = { verified: true, message: 'Biometric authentication successful' }\n})\n\n/* The same confirmation by password - the body is `{ password }` (ADR-0168). */\nwebAuthnGlobalPrivateRouter.post('/auth/confirm-identity', async context => {\n  const { password } = context.request.body || {}\n  await confirmIdentity('password', context, user => verifyPassword(user, String(password ?? ''), context))\n\n  context.body = { confirmed: true }\n})\n\n/* Until when the confirmation holds - a screen puts away what it shows at that moment. Null when there is none. */\nwebAuthnGlobalPrivateRouter.get('/auth/confirm-identity', async context => {\n  context.body = { confirmedUntil: confirmedUntil(context, context.state.user?.id)?.toISOString() ?? null }\n})\n\n/* Letting the confirmation go before it ends by itself. */\nwebAuthnGlobalPrivateRouter.delete('/auth/confirm-identity', async context => {\n  forgetConfirmation(context)\n  context.body = { confirmed: false }\n})\n\n// Adding a passkey for the signed-in person\nwebAuthnGlobalPrivateRouter.get('/auth/register-webauthn/challenge', async context => {\n  const options = await registrationOptions(context.state.user, rpName, siteOf(context))\n\n  rememberChallenge(context, options.challenge)\n  context.body = options\n})\n\n/* The body is `{ response, name }` - the browser's answer, and the label the screen proposes. */\nwebAuthnGlobalPrivateRouter.post('/auth/verify-registration', async context => {\n  const challenge = takeChallenge(context)\n  const { response, name } = context.request.body || {}\n\n  await registerPasskey(context.state.user, response, name, challenge, siteOf(context))\n\n  context.body = { verified: true }\n})\n\n/*\n * After a password sign-in on the screen, before check-in: an offer to add a passkey on this device\n * (ADR-0156 decision 5). The page moves on by itself where it has nothing to offer.\n */\nwebAuthnGlobalPrivateRouter.get('/auth/passkey-offer', async context => {\n  await context.render('auth-page', {\n    pageElement: 'auth-passkey-offer',\n    elementScript: '/auth/passkey-offer.js',\n    data: {\n      username: context.state.user.username,\n      redirectTo: sameOriginRedirectPath(context.query.redirect_to, context),\n      disableUserFavoredLanguage,\n      languages\n    }\n  })\n})\n\n// Signing in\nwebAuthnGlobalPublicRouter.get('/auth/signin-webauthn/challenge', async context => {\n  const options = await signinOptions(siteOf(context))\n\n  rememberChallenge(context, options.challenge)\n  context.body = options\n})\n\n/*\n * The sign-in screen posts this as a form, the way it posts a password: `response` is the browser's\n * answer as JSON text, `redirectTo` where to go after. So a refusal takes the password's way too -\n * `authenticate401Middleware` answers the page with the one that follows from the code (a locked\n * account to the activate page, which sends the unlock mail again), never a page inside a fetch body.\n */\nwebAuthnGlobalPublicRouter.post('/auth/signin-webauthn', async context => {\n  const challenge = takeChallenge(context)\n  const { response, redirectTo } = context.request.body || {}\n  const { domain } = context.state\n\n  const { token } = await signinWithPasskey(passkeyAnswerOf(response), challenge, siteOf(context), context)\n  setAccessTokenCookie(context, token)\n\n  context.redirect(`/auth/checkin${domain ? '/' + domain.subdomain : ''}?redirect_to=${encodeURIComponent(redirectTo || '/')}`)\n})\n\n/* The browser's answer from the form field. Text that is not one is a failed verification, like any other bad answer. */\nfunction passkeyAnswerOf(field: unknown) {\n  try {\n    return JSON.parse(String(field))\n  } catch {\n    throw new AuthError({ errorCode: AuthError.ERROR_CODES.AUTHN_VERIFICATION_FAILED, detail: { reason: 'unreadable answer' } })\n  }\n}\n"]}

package/dist-server/routes.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../server/routes.ts"],"names":[],"mappings":";;AAAA,6CAA4C;AAC5C,iDAAmE;AAEnE,qDAAgG;AAChG,gDAY0B;AAE1B,2EAAqE;AAErE,MAAM,gBAAgB,GAAG,CAAC,YAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;AACjD,MAAM,uBAAuB,GAAG,YAAM,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAA;AAE5E,IAAI,uBAAuB,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,sCAA6C,EAAE,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE;QACpF,kBAAkB,CAAC,GAAG,CAAC,yBAAc,CAAC,MAAM,EAAE,EAAE,yBAAc,CAAC,cAAc,EAAE,CAAC,CAAA;QAChF,kBAAkB,CAAC,GAAG,CAAC,kCAAuB,CAAC,MAAM,EAAE,EAAE,kCAAuB,CAAC,cAAc,EAAE,CAAC,CAAA;IACpG,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,uCAA8C,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE;QACtF,8CAA8C;QAC9C,mBAAmB,CAAC,GAAG,CAAC,4BAAiB,CAAC,MAAM,EAAE,EAAE,4BAAiB,CAAC,cAAc,EAAE,CAAC,CAAA;QACvF,mBAAmB,CAAC,GAAG,CAAC,mCAAwB,CAAC,MAAM,EAAE,EAAE,mCAAwB,CAAC,cAAc,EAAE,CAAC,CAAA;IACvG,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,uCAA8C,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE;QACtF,0DAA0D;QAC1D,4EAA4E;QAC5E,gDAAgD;QAChD,iDAAiD;QACjD,sFAAsF;QACtF,qEAAqE;QACrE,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC1D,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,EAAE,CAAC,sCAA6C,EAAE,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE;QACpF,kBAAkB,CAAC,GAAG,CAAC,yBAAc,CAAC,MAAM,EAAE,EAAE,yBAAc,CAAC,cAAc,EAAE,CAAC,CAAA;QAChF,kBAAkB,CAAC,GAAG,CAAC,kCAAuB,CAAC,MAAM,EAAE,EAAE,kCAAuB,CAAC,cAAc,EAAE,CAAC,CAAA;QAElG,yDAAyD;QACzD,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,2BAAgB,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;gBAE9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;gBAC/B,IAAA,6CAAoB,EAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBAEpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,uCAA8C,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE;QACtF,mBAAmB,CAAC,GAAG,CAAC,oCAAyB,CAAC,CAAA;QAElD,mBAAmB,CAAC,GAAG,CAAC,4BAAiB,CAAC,MAAM,EAAE,EAAE,4BAAiB,CAAC,cAAc,EAAE,CAAC,CAAA;QACvF,8CAA8C;QAC9C,mBAAmB,CAAC,GAAG,CAAC,mCAAwB,CAAC,MAAM,EAAE,EAAE,mCAAwB,CAAC,cAAc,EAAE,CAAC,CAAA;QACrG,mBAAmB,CAAC,GAAG,CAAC,sCAA2B,CAAC,MAAM,EAAE,EAAE,sCAA2B,CAAC,cAAc,EAAE,CAAC,CAAA;IAC7G,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,sCAA6C,EAAE,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE;QACpF,6CAA6C;QAC7C,kBAAkB,CAAC,GAAG,CAAC,2BAAgB,CAAC,MAAM,EAAE,EAAE,2BAAgB,CAAC,cAAc,EAAE,CAAC,CAAA;QACpF,kBAAkB,CAAC,GAAG,CAAC,2BAAgB,CAAC,MAAM,EAAE,EAAE,2BAAgB,CAAC,cAAc,EAAE,CAAC,CAAA;QACpF,kBAAkB,CAAC,GAAG,CAAC,qCAA0B,CAAC,MAAM,EAAE,EAAE,qCAA0B,CAAC,cAAc,EAAE,CAAC,CAAA;QAExG,oGAAoG;QACpG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,uBAAY,CAAC,MAAM,EAAE,EAAE,uBAAY,CAAC,cAAc,EAAE,CAAC,CAAA,CAAC,mBAAmB;IAC5G,CAAC,CAAC,CAAA;IAEF,OAAO,CAAC,EAAE,CAAC,uCAA8C,EAAE,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE;QACtF,mBAAmB,CAAC,GAAG,CAAC,oCAAyB,CAAC,CAAA;QAClD,mBAAmB,CAAC,GAAG,CAAC,uCAA4B,CAAC,CAAA;QAErD,8CAA8C;QAC9C,IAAI,gBAAgB,EAAE,CAAC;YACrB,kEAAkE;YAClE,wDAAwD;YACxD,4EAA4E;YAC5E,mBAAmB,CAAC,GAAG,CACrB,IAAI,IAAA,mCAA2B,GAAE,gBAAgB,EACjD,gCAAqB,CAAC,MAAM,EAAE,EAC9B,gCAAqB,CAAC,cAAc,EAAE,CACvC,CAAA;YACD,mBAAmB,CAAC,GAAG,CACrB,IAAI,IAAA,mCAA2B,GAAE,EAAE,EACnC,+BAAoB,CAAC,MAAM,EAAE,EAC7B,+BAAoB,CAAC,cAAc,EAAE,CACtC,CAAA;QACH,CAAC;QAED,0DAA0D;QAC1D,4EAA4E;QAC5E,gDAAgD;QAChD,iDAAiD;QACjD,sFAAsF;QACtF,qEAAqE;QACrE,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;YAC1D,MAAM,IAAI,EAAE,CAAA;QACd,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { config } from '@things-factory/env'\nimport { getRoutePrefixForDomainType } from '@things-factory/shell'\n\nimport { domainAuthenticateMiddleware, jwtAuthenticateMiddleware } from './middlewares/index.js'\nimport {\n  authCheckinRouter,\n  authPrivateProcessRouter,\n  authPublicProcessRouter,\n  authSigninRouter,\n  authSignupRouter,\n  oauth2AuthorizeRouter,\n  oauth2Router,\n  pathBaseDomainRouter,\n  siteRootRouter,\n  webAuthnGlobalPublicRouter,\n  webAuthnGlobalPrivateRouter\n} from './router/index.js'\n\nimport { setAccessTokenCookie } from './utils/access-token-cookie.js'\n\nconst isPathBaseDomain = !config.get('subdomain')\nconst bypassUserSigninProcess = config.get('bypassUserSigninProcess', false)\n\nif (bypassUserSigninProcess) {\n  process.on('bootstrap-module-global-public-route' as any, (app, globalPublicRouter) => {\n    globalPublicRouter.use(siteRootRouter.routes(), siteRootRouter.allowedMethods())\n    globalPublicRouter.use(authPublicProcessRouter.routes(), authPublicProcessRouter.allowedMethods())\n  })\n\n  process.on('bootstrap-module-global-private-route' as any, (app, globalPrivateRouter) => {\n    /* globalPrivateRouter based nested-routers */\n    globalPrivateRouter.use(authCheckinRouter.routes(), authCheckinRouter.allowedMethods())\n    globalPrivateRouter.use(authPrivateProcessRouter.routes(), authPrivateProcessRouter.allowedMethods())\n  })\n\n  process.on('bootstrap-module-domain-private-route' as any, (app, domainPrivateRouter) => {\n    // Client Routing : path 확장자가 없는 경우는 대부분 client 라우팅에 해당한다.\n    // 즉, browser-history-fallback 으로 index.html을 send 하는 경우에, 사용자 로그인이 필요한 경우에,\n    // 화면깜박임없이 signin page로 redirect 하고자하는 목적의 설정이다.\n    // domain-private 라우트를 통과하고 싶지 않다면, regexp를 조정한다.\n    // '(.[^.]+)' 은 '', '/'는 제외하고, '/xxx', '/yyy/zzz' 등 모두를 포함하지만, path에 '.'가 있는 경우는 제외한다.\n    // (테스트는 여기서 : http://forbeslindesay.github.io/express-route-tester/)\n    domainPrivateRouter.get('(.[^.]+)', async (context, next) => {\n      await next()\n    })\n  })\n} else {\n  process.on('bootstrap-module-global-public-route' as any, (app, globalPublicRouter) => {\n    globalPublicRouter.use(siteRootRouter.routes(), siteRootRouter.allowedMethods())\n    globalPublicRouter.use(authPublicProcessRouter.routes(), authPublicProcessRouter.allowedMethods())\n\n    /* ssoMiddleware가 정의되어있다면, /auth/sso-signin 패스를 활성화한다. */\n    if (app.ssoMiddlewares.length > 0) {\n      authSigninRouter.get('/auth/sso-signin', app.ssoMiddlewares[0], async context => {\n        const { user } = context.state\n\n        const token = await user.sign()\n        setAccessTokenCookie(context, token)\n\n        context.redirect('/auth/checkin')\n      })\n    }\n  })\n\n  process.on('bootstrap-module-global-private-route' as any, (app, globalPrivateRouter) => {\n    globalPrivateRouter.use(jwtAuthenticateMiddleware)\n\n    globalPrivateRouter.use(authCheckinRouter.routes(), authCheckinRouter.allowedMethods())\n    /* globalPrivateRouter based nested-routers */\n    globalPrivateRouter.use(authPrivateProcessRouter.routes(), authPrivateProcessRouter.allowedMethods())\n    globalPrivateRouter.use(webAuthnGlobalPrivateRouter.routes(), webAuthnGlobalPrivateRouter.allowedMethods())\n  })\n\n  process.on('bootstrap-module-domain-public-route' as any, (app, domainPublicRouter) => {\n    /* domainPublicRouter based nested-routers */\n    domainPublicRouter.use(authSigninRouter.routes(), authSigninRouter.allowedMethods())\n    domainPublicRouter.use(authSignupRouter.routes(), authSignupRouter.allowedMethods())\n    domainPublicRouter.use(webAuthnGlobalPublicRouter.routes(), webAuthnGlobalPublicRouter.allowedMethods())\n\n    /* path '/admin/oauth/...' is deprecated. should use path '/oauth/...' for oauth2 related routing */\n    domainPublicRouter.use('/oauth', oauth2Router.routes(), oauth2Router.allowedMethods()) // if i use context\n  })\n\n  process.on('bootstrap-module-domain-private-route' as any, (app, domainPrivateRouter) => {\n    domainPrivateRouter.use(jwtAuthenticateMiddleware)\n    domainPrivateRouter.use(domainAuthenticateMiddleware)\n\n    /* domainPrivateRouter based nested-routers */\n    if (isPathBaseDomain) {\n      // pathBaseDomainRouter는 history-fallback의 경우에 인증 처리를 하기 위한 라우터이다.\n      // (보통, URL 링크등을 통해서 domain path URL로 바로 요청하는 경우에 해당한다.)\n      // pathBaseDomainRouter는 domain path를 domain-private-router를 사용하는 것을 전제로 한다.\n      domainPrivateRouter.use(\n        `/${getRoutePrefixForDomainType()}/:domain/oauth`,\n        oauth2AuthorizeRouter.routes(),\n        oauth2AuthorizeRouter.allowedMethods()\n      )\n      domainPrivateRouter.use(\n        `/${getRoutePrefixForDomainType()}`,\n        pathBaseDomainRouter.routes(),\n        pathBaseDomainRouter.allowedMethods()\n      )\n    }\n\n    // Client Routing : path 확장자가 없는 경우는 대부분 client 라우팅에 해당한다.\n    // 즉, browser-history-fallback 으로 index.html을 send 하는 경우에, 사용자 로그인이 필요한 경우에,\n    // 화면깜박임없이 signin page로 redirect 하고자하는 목적의 설정이다.\n    // domain-private 라우트를 통과하고 싶지 않다면, regexp를 조정한다.\n    // '(.[^.]+)' 은 '', '/'는 제외하고, '/xxx', '/yyy/zzz' 등 모두를 포함하지만, path에 '.'가 있는 경우는 제외한다.\n    // (테스트는 여기서 : http://forbeslindesay.github.io/express-route-tester/)\n    domainPrivateRouter.get('(.[^.]+)', async (context, next) => {\n      await next()\n    })\n  })\n}\n"]}

package/dist-server/service/access-request/access-request-mutation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-request-mutation.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AAErF,iDAAqD;AAErD,2EAA+G;AAC/G,2DAAmD;AACnD,uEAAiF;AAEjF,0IAA0I;AAC7H,QAAA,MAAM,GAAG,+EAA+E,CAAA;AAI9F,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC;;;OAGG;IAGG,AAAN,KAAK,CAAC,aAAa,CAA2C,OAAyB,EAAS,OAAwB;QACtH,OAAO,MAAM,IAAA,iCAAa,EAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAED,8EAA8E;IAGxE,AAAN,KAAK,CAAC,qBAAqB,CAAY,EAAU,EAAS,OAAwB;QAChF,OAAO,MAAM,IAAA,yCAAqB,EAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC;IAED;;;OAGG;IAIG,AAAN,KAAK,CAAC,mBAAmB,CAA+C,QAA6B,EAAS,OAAwB;QACpI,OAAO,MAAM,IAAA,uCAAmB,EAAC,QAAe,EAAE,OAAO,CAAC,CAAA;IAC5D,CAAC;CACF,CAAA;AA5BY,sDAAqB;AAO1B;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,iCAAa,EAAE,EAAE,WAAW,EAAE,iHAAiH,EAAE,CAAC;IAClJ,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,0CAAgB,CAAC,CAAA;IAA6B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAxB,0CAAgB;;0DAEtF;AAKK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,iCAAa,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAC/E,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kEAExD;AASK;IAHL,IAAA,wBAAS,EAAC,cAAM,CAAC;IACjB,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,iCAAa,EAAE,EAAE,WAAW,EAAE,+FAA+F,EAAE,CAAC;IAC1H,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,6CAAmB,CAAC,CAAA;IAAiC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAA3B,6CAAmB;;gEAEpG;gCA3BU,qBAAqB;IAFjC,IAAA,uBAAQ,EAAC,iCAAa,CAAC;IACvB,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,qBAAqB,CA4BjC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\n\nimport { SpeakRefusals } from '@things-factory/shell'\n\nimport { decideAccessRequest, requestAccess, withdrawAccessRequest } from '../../controllers/access-request.js'\nimport { AccessRequest } from './access-request.js'\nimport { AccessDecisionInput, NewAccessRequest } from './access-request-types.js'\n\n/* Deciding is putting somebody into a role - the same declaration as `updateUserRoles`, so who is told and who may decide are one set. */\nexport const DECIDE = '@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)'\n\n@Resolver(AccessRequest)\n@UseMiddleware(SpeakRefusals)\nexport class AccessRequestMutation {\n  /**\n   * Open by design (open-fields.ts): anyone in the domain who was refused for want of a role asks here. The\n   * door holds the rest - the caller asks only for themselves, the server judges again that a role would open it.\n   */\n  @Directive('@transaction')\n  @Mutation(returns => AccessRequest, { description: 'To ask for a privilege the caller was refused for want of a role. Asking again while one is pending adds to it.' })\n  async requestAccess(@Arg('request', type => NewAccessRequest) request: NewAccessRequest, @Ctx() context: ResolverContext): Promise<AccessRequest> {\n    return await requestAccess(request, context)\n  }\n\n  /** Open by design: only the caller's own pending request can be withdrawn. */\n  @Directive('@transaction')\n  @Mutation(returns => AccessRequest, { description: \"To withdraw the caller's own pending access request.\" })\n  async withdrawAccessRequest(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<AccessRequest> {\n    return await withdrawAccessRequest(id, context)\n  }\n\n  /**\n   * A person presses grant or deny - on the list screen, or on the AI 입력 draft card. The model never calls this\n   * (ADR-0103 decision 4); the review runs again inside.\n   */\n  @Directive(DECIDE)\n  @Directive('@transaction')\n  @Mutation(returns => AccessRequest, { description: 'To grant an access request by putting the requester into a role, or to deny it with a reason.' })\n  async decideAccessRequest(@Arg('decision', type => AccessDecisionInput) decision: AccessDecisionInput, @Ctx() context: ResolverContext): Promise<AccessRequest> {\n    return await decideAccessRequest(decision as any, context)\n  }\n}\n"]}

package/dist-server/service/access-request/access-request-query.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-request-query.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8E;AAE9E,iDAAmH;AAEnH,2EAAmG;AACnG,yEAA0E;AAC1E,2DAAmD;AACnD,gEAA4D;AAC5D,uEAA8I;AAE9I,gFAAgF;AAChF,MAAM,MAAM,GAAG,+EAA+E,CAAA;AAGvF,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B;;;OAGG;IAGG,AAAN,KAAK,CAAC,cAAc,CAA0B,MAAiB,EAAS,OAAwB;QAC9F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,iCAAa,CAAC;YACxC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;SACjD,CAAC,CAAA;QACF,YAAY,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAA;QAC9L,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,sFAAsF;IAEhF,AAAN,KAAK,CAAC,gBAAgB,CAAQ,OAAwB;QACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,MAAM,IAAA,qBAAa,EAAC,iCAAa,CAAC,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YAChE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC;YACjD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,yBAAyB,CAAQ,OAAwB;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACvD,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CACA,QAAgB,EACf,SAAiB,EAC5B,OAAwB,EAC6E,MAAe;QAE3H,OAAO,CAAC,MAAM,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAA;IACxL,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,aAAa,CAAkB,QAAgB,EAAoB,SAAiB;QACxF,OAAO,IAAA,2BAAY,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;SACnF,CAAC,CAAC,CAAA;IACL,CAAC;IAED,4HAA4H;IAGtH,AAAN,KAAK,CAAC,oBAAoB,CAAc,IAAY,EAAS,OAAwB;QACnF,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;IAC9H,CAAC;IAED,iHAAiH;IAG3G,AAAN,KAAK,CAAC,oBAAoB,CAA+C,QAA6B,EAAS,OAAwB;QACrI,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,QAAe,EAAE,OAAO,CAAC,CAA0B,CAAA;IAClF,CAAC;CACF,CAAA;AAjFY,gDAAkB;AAOvB;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,2CAAiB,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;IAC1E,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;wDAY9D;AAIK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACtG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAQ5B;AAOK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4FAA4F,EAAE,CAAC;IACpG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mEAGrC;AAIK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,2FAA2F,EAAE,CAAC;IAEnJ,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IACf,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAChB,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAA;;;;uDAG5G;AAOK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,0CAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,uGAAuG,EAAE,CAAC;IAC1I,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IAAoB,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;;;;uDAMvE;AAKK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IAC1F,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8DAG3D;AAKK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,kGAAkG,EAAE,CAAC;IACjI,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,6CAAmB,CAAC,CAAA;IAAiC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAA3B,6CAAmB;;8DAErG;6BAhFU,kBAAkB;IAD9B,IAAA,uBAAQ,EAAC,iCAAa,CAAC;GACX,kBAAkB,CAiF9B","sourcesContent":["import { Arg, Args, Ctx, Directive, Int, Query, Resolver } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, getRepository, InheritedValueType, ListParam } from '@things-factory/shell'\n\nimport { findDeciderIds, reviewDecision, rolesGranting } from '../../controllers/access-request.js'\nimport { findAssignableRolesNamed } from '../../utils/assignable-roles.js'\nimport { AccessRequest } from './access-request.js'\nimport { tasksHolding } from '../role-template/role-task.js'\nimport { AccessDecisionInput, AccessDecisionIssue, AccessRequestList, AccessRoleCandidate, AccessTaskChoice } from './access-request-types.js'\n\n/* The review and the candidates serve a decision - the deciding declaration. */\nconst DECIDE = '@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)'\n\n@Resolver(AccessRequest)\nexport class AccessRequestQuery {\n  /*\n   * A decider's list - the same declaration as the decision, so the people told of a request can open it (ADR-0103).\n   * This domain's rows only: `inherited` is pinned, a parent domain's requests are not this domain's to read.\n   */\n  @Directive(DECIDE)\n  @Query(returns => AccessRequestList, { description: \"To fetch this domain's access requests.\" })\n  async accessRequests(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<AccessRequestList> {\n    const { domain } = context.state\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain,\n      params: { ...params, inherited: InheritedValueType.None },\n      repository: getRepository(AccessRequest),\n      alias: 'accessRequest',\n      searchables: ['category', 'privilege', 'reason']\n    })\n    queryBuilder.leftJoinAndSelect('accessRequest.requester', 'requester').leftJoinAndSelect('accessRequest.decidedBy', 'decidedBy').leftJoinAndSelect('accessRequest.grantedRole', 'grantedRole')\n    const [items, total] = await queryBuilder.getManyAndCount()\n    return { items, total }\n  }\n\n  /** Open by design: the caller's own requests - where they see what became of them. */\n  @Query(returns => [AccessRequest], { description: \"To fetch the caller's own access requests in this domain, newest first.\" })\n  async myAccessRequests(@Ctx() context: ResolverContext): Promise<AccessRequest[]> {\n    const { domain, user } = context.state\n    return await getRepository(AccessRequest).find({\n      where: { domain: { id: domain.id }, requester: { id: user.id } },\n      relations: ['domain', 'requester', 'grantedRole'],\n      order: { createdAt: 'DESC' },\n      take: 100\n    })\n  }\n\n  /**\n   * Open by design: how many people a request would reach - the popup says it before the person sends, so asking reads\n   * as what it is. A number, never who.\n   */\n  @Query(returns => Int, { description: 'To count the people who would be told of an access request from the caller in this domain.' })\n  async accessRequestDeciderCount(@Ctx() context: ResolverContext): Promise<number> {\n    const { domain, user } = context.state\n    return (await findDeciderIds(domain, user.id)).length\n  }\n\n  @Directive(DECIDE)\n  @Query(returns => [AccessRoleCandidate], { description: 'To list the roles this domain can assign that grant a privilege, fewest privileges first.' })\n  async rolesGranting(\n    @Arg('category') category: string,\n    @Arg('privilege') privilege: string,\n    @Ctx() context: ResolverContext,\n    @Arg('taskId', { nullable: true, description: 'The task asked for - roles holding all of it come first.' }) taskId?: string\n  ): Promise<AccessRoleCandidate[]> {\n    return (await rolesGranting(category, privilege, context.state.domain, undefined, taskId)).map(({ id, name, privilegeCount, holdsTask }) => ({ id, name, privilegeCount, holdsTask }))\n  }\n\n  /**\n   * Open by design: the tasks a person refused may ask for - the code catalog of work, nothing of this domain's data.\n   * The person asking is refused by definition, so no privilege can close it (ADR-0103 decision 9).\n   */\n  @Query(returns => [AccessTaskChoice], { description: 'To list the tasks that hold a privilege, fewest privileges first - what a person refused may ask for.' })\n  async tasksGranting(@Arg('category') category: string, @Arg('privilege') privilege: string): Promise<AccessTaskChoice[]> {\n    return tasksHolding(category, privilege).map(task => ({\n      taskId: task.id,\n      module: task.id.split('.')[0],\n      privilegeCount: task.grants.reduce((count, grant) => count + grant.axes.length, 0)\n    }))\n  }\n\n  /** The roles of this domain's assignable scope (own, parent, granted) with exactly this name - what a decision may name. */\n  @Directive(DECIDE)\n  @Query(returns => [AccessRoleCandidate], { description: 'To find, by exact name, the roles this domain can assign.' })\n  async assignableRolesNamed(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<AccessRoleCandidate[]> {\n    const roles = await findAssignableRolesNamed(name, context.state.domain)\n    return roles.map(role => ({ id: role.id, name: role.name, privilegeCount: role.privileges?.length ?? 0, holdsTask: false }))\n  }\n\n  /** The same review the decision runs - the list screen and the AI draft card show this (ADR-0103 decision 4). */\n  @Directive(DECIDE)\n  @Query(returns => [AccessDecisionIssue], { description: 'To review a decision before it is made: what blocks it and what the person deciding should know.' })\n  async reviewAccessDecision(@Arg('decision', type => AccessDecisionInput) decision: AccessDecisionInput, @Ctx() context: ResolverContext): Promise<AccessDecisionIssue[]> {\n    return (await reviewDecision(decision as any, context)) as AccessDecisionIssue[]\n  }\n}\n"]}

package/dist-server/service/access-request/access-request-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-request-types.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAkF;AAClF,iDAAoD;AAEpD,2DAAmD;AAEnD,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,+BAAa,CAAA;AACf,CAAC,EAHW,cAAc,8BAAd,cAAc,QAGzB;AAED,IAAA,+BAAgB,EAAC,cAAc,EAAE;IAC/B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,wGAAwG;CACtH,CAAC,CAAA;AAGK,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAe5B,CAAA;AAfY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;;kDACzF;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;mDACxE;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;uDAClF;AAGtB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wFAAwF,EAAE,CAAC;;gDAClH;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;gDACnD;2BAdJ,gBAAgB;IAD5B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,oGAAoG,EAAE,CAAC;GACpH,gBAAgB,CAe5B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;sDACrC;AAGjB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;qDACzC;AAGxB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8GAA8G,EAAE,CAAC;;mDACxI;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;mDACnD;8BAXJ,mBAAmB;IAD/B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;GACnD,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;iDAC1D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;qDACxD;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;;kDACrG;AAGd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;;mDACvE;8BAXrB,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;GAC/G,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;;+CAC7B;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;iDAC7B;AAGZ;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;2DAC3F;AAGtB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6FAA6F,EAAE,CAAC;;sDACpG;8BAXP,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;GACjF,mBAAmB,CAY/B;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAS5B,CAAA;AATY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;gDAC5C;AAGd;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;gDAC9D;AAGd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;wDAC3F;2BARX,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,uHAAuH,EAAE,CAAC;GACxI,gBAAgB,CAS5B;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AANY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;;gDAClE;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;gDAC/E;4BALF,iBAAiB;IAD7B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;GACvD,iBAAiB,CAM7B","sourcesContent":["import { Field, InputType, Int, ObjectType, registerEnumType } from 'type-graphql'\nimport { ScalarObject } from '@things-factory/shell'\n\nimport { AccessRequest } from './access-request.js'\n\nexport enum AccessDecision {\n  GRANT = 'GRANT',\n  DENY = 'DENY'\n}\n\nregisterEnumType(AccessDecision, {\n  name: 'AccessDecision',\n  description: 'What the person deciding an access request does: put the requester into a role, or deny with a reason.'\n})\n\n@InputType({ description: 'An access request for one privilege in this domain - what a refusal carried, and why it is needed.' })\nexport class NewAccessRequest {\n  @Field({ description: \"The category of the refused privilege, from the refusal's extensions.requires.\" })\n  category: string\n\n  @Field({ description: \"The refused privilege, from the refusal's extensions.requires.\" })\n  privilege: string\n\n  @Field({ nullable: true, description: 'The operation that was refused, shown to the person deciding.' })\n  operationName?: string\n\n  @Field({ nullable: true, description: 'The task asked for - one of the tasks that hold the refused privilege (tasksGranting).' })\n  taskId?: string\n\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n}\n\n@InputType({ description: 'A decision on one access request.' })\nexport class AccessDecisionInput {\n  @Field({ description: 'The access request decided.' })\n  requestId: string\n\n  @Field(type => AccessDecision, { description: 'Grant or deny.' })\n  decision: AccessDecision\n\n  @Field({ nullable: true, description: 'The role to put the requester into - required to grant, one this domain can assign that holds the privilege.' })\n  roleId?: string\n\n  @Field({ nullable: true, description: 'Why - required to deny.' })\n  reason?: string\n}\n\n@ObjectType({ description: 'One finding of the access decision review - blocking ones keep the decision from being made.' })\nexport class AccessDecisionIssue {\n  @Field({ description: 'What was found, as a code the screen words.' })\n  code: string\n\n  @Field({ description: 'Whether it keeps the decision from being made.' })\n  blocking: boolean\n\n  @Field({ nullable: true, description: 'The part of the decision it is about: request, decision, role or reason.' })\n  field?: string\n\n  @Field(type => ScalarObject, { nullable: true, description: 'The values the sentence is built from.' })\n  params?: Record<string, unknown>\n}\n\n@ObjectType({ description: 'A role this domain can assign that grants the asked privilege.' })\nexport class AccessRoleCandidate {\n  @Field({ description: 'The role id.' })\n  id: string\n\n  @Field({ description: 'The role name.' })\n  name: string\n\n  @Field(type => Int, { description: 'How many privileges the role carries - fewer is closer to what was asked.' })\n  privilegeCount: number\n\n  @Field({ description: 'Whether the role holds every privilege of the task asked for. False when no task was asked.' })\n  holdsTask: boolean\n}\n\n@ObjectType({ description: 'A task that holds a refused privilege - what a person refused may ask for. Words are task.<id>.name and .description.' })\nexport class AccessTaskChoice {\n  @Field({ description: 'The task id, `<module>.<work>`.' })\n  taskId: string\n\n  @Field({ description: 'The module or application that declares the task.' })\n  module: string\n\n  @Field(type => Int, { description: 'How many privileges the task holds - fewer is closer to what was refused.' })\n  privilegeCount: number\n}\n\n@ObjectType({ description: 'A paginated list of access requests.' })\nexport class AccessRequestList {\n  @Field(type => [AccessRequest], { nullable: true, description: 'The access requests.' })\n  items: AccessRequest[]\n\n  @Field(type => Int, { nullable: true, description: 'The total number of access requests.' })\n  total: number\n}\n"]}

package/dist-server/service/access-request/access-request.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request.ts"],"names":[],"mappings":";;;;AAAA,qCASgB;AAChB,+CAA2E;AAE3E,6CAA4C;AAC5C,iDAA8C;AAE9C,6CAAsC;AACtC,6CAAsC;AAEtC,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wCAAiB,CAAA;IACjB,8CAAuB,CAAA;IACvB,0CAAmB,CAAA;AACrB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAED,IAAA,+BAAgB,EAAC,mBAAmB,EAAE;IACpC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,8GAA8G;CAC5H,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AAKI,IAAM,aAAa,GAAnB,MAAM,aAAa;CAuGzB,CAAA;AAvGY,sCAAa;AAGf;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;yCAC7D;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;sCACxE,cAAM;6CAAA;AAGd;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;;+CACvC;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACvB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACnD,cAAI;gDAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACvC;AAInB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;+CAC9E;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;gDAC7D;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;oDACnF;AAStB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;;6CACxH;AAIf;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;6CACnD;AAIf;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;4CACrE;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;sCAChD,IAAI;IAEtB,6DAA6D;;sDAFvC;AAkBtB;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACzH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,mBAAmB,CAAC,OAAO;KACrC,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;;4CACvD;AAI1B;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;sCACzE,IAAI;gDAAA;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;sCAC5D,cAAI;gDAAA;AAGhB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACtC;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;sCACnD,IAAI;gDAAA;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;qDAC5D;AAIvB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;sCAC/E,cAAI;kDAAA;AAGlB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;;oDACtC;AAItB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;sCACxC,IAAI;gDAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACrC,IAAI;gDAAA;wBAtGJ,aAAa;IAJzB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAClI,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,qFAAqF,EAAE,CAAC;GACtG,aAAa,CAuGzB","sourcesContent":["import {\n  Column,\n  CreateDateColumn,\n  Entity,\n  Index,\n  ManyToOne,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\nimport { Field, ID, Int, ObjectType, registerEnumType } from 'type-graphql'\n\nimport { config } from '@things-factory/env'\nimport { Domain } from '@things-factory/shell'\n\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nexport enum AccessRequestStatus {\n  PENDING = 'PENDING',\n  GRANTED = 'GRANTED',\n  DENIED = 'DENIED',\n  WITHDRAWN = 'WITHDRAWN',\n  EXPIRED = 'EXPIRED'\n}\n\nregisterEnumType(AccessRequestStatus, {\n  name: 'AccessRequestStatus',\n  description: 'Where an access request stands: waiting, granted, denied, withdrawn by the requester, or expired unanswered.'\n})\n\n/*\n * A person refused for want of a role asks for the privilege (ADR-0103, docs/design/access-request.md).\n *\n * ── The row is the record ────────────────────────────────────────────────\n * Who asked, for what, why, who decided, which role, why not - all here, and never deleted. A notification\n * is a courtesy on top: it is not stored per person and does nothing where FCM is not set up.\n *\n * ── At most one pending per person and privilege ─────────────────────────\n * Asking again bumps `count` and `lastRequestedAt` instead of adding a row. A partial unique index would say\n * it and is not portable across the databases this framework supports, so it is held where the request is\n * made. The index below is for reading.\n */\n@Entity()\n@Index('ix_access_request_0', (request: AccessRequest) => [request.domain, request.state])\n@Index('ix_access_request_1', (request: AccessRequest) => [request.domain, request.requester, request.category, request.privilege])\n@ObjectType({ description: 'A request by a person refused for want of a role, for one privilege in this domain.' })\nexport class AccessRequest {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the access request.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The domain the privilege is asked in.' })\n  domain: Domain\n\n  @RelationId((request: AccessRequest) => request.domain)\n  domainId: string\n\n  @ManyToOne(type => User)\n  @Field(type => User, { description: 'The person who asked.' })\n  requester: User\n\n  @RelationId((request: AccessRequest) => request.requester)\n  requesterId: string\n\n  @Column()\n  @Field({ description: 'The category of the privilege asked for, as the refusal carried it.' })\n  category: string\n\n  @Column()\n  @Field({ description: 'The privilege asked for, as the refusal carried it.' })\n  privilege: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'The operation that was refused - shown to the person deciding.' })\n  operationName?: string\n\n  /*\n   * The work the person asked for, by task id (ADR-0103 decision 9) - their own words for the refused privilege,\n   * picked from the tasks that hold it. The request is still keyed by the refused privilege; this explains it. A task is\n   * a code catalog and may be gone later: the screen then draws the id, and the review says nothing of it.\n   */\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'The task the requester asked for - one that holds the refused privilege (`<module>.<work>`).' })\n  taskId?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n\n  @Column({ type: 'int', default: 1 })\n  @Field(type => Int, { description: 'How many times it was asked while pending.' })\n  count: number\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was last asked.' })\n  lastRequestedAt?: Date\n\n  /* An enum where the database has one, a string elsewhere. */\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? AccessRequestStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: AccessRequestStatus.PENDING\n  })\n  @Field(type => AccessRequestStatus, { description: 'Where the request stands.' })\n  state: AccessRequestStatus\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When a pending request expires unanswered.' })\n  expiresAt?: Date\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true, description: 'Who decided it.' })\n  decidedBy?: User\n\n  @RelationId((request: AccessRequest) => request.decidedBy)\n  decidedById?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was decided.' })\n  decidedAt?: Date\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The decider's reason - required to deny.\" })\n  decisionReason?: string\n\n  @ManyToOne(type => Role, { nullable: true })\n  @Field(type => Role, { nullable: true, description: 'The role the requester was put into.' })\n  grantedRole?: Role\n\n  @RelationId((request: AccessRequest) => request.grantedRole)\n  grantedRoleId?: string\n\n  @CreateDateColumn()\n  @Field({ description: 'When it was first asked.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ description: 'When it last changed.' })\n  updatedAt: Date\n}\n"]}

package/dist-server/service/access-request/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/access-request/index.ts"],"names":[],"mappings":";;;AAAA,2DAAmD;AACnD,6EAAoE;AACpE,uEAA8D;AAEjD,QAAA,QAAQ,GAAG,CAAC,iCAAa,CAAC,CAAA;AAC1B,QAAA,SAAS,GAAG,CAAC,4CAAkB,EAAE,kDAAqB,CAAC,CAAA","sourcesContent":["import { AccessRequest } from './access-request.js'\nimport { AccessRequestMutation } from './access-request-mutation.js'\nimport { AccessRequestQuery } from './access-request-query.js'\n\nexport const entities = [AccessRequest]\nexport const resolvers = [AccessRequestQuery, AccessRequestMutation]\n"]}

package/dist-server/service/app-binding/app-binding-mutation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-binding-mutation.js","sourceRoot":"","sources":["../../../server/service/app-binding/app-binding-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AAEtE,iDAAqD;AAErD,yEAA8E;AAC9E,6CAAsC;AACtC,qDAAoE;AAG7D,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IAGG,AAAN,KAAK,CAAC,gBAAgB,CAAY,EAAU,EAAS,OAAwB;QAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,OAAO,GAAG,MAAM,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC;aAClE,QAAQ,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC;aACjC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,sCAAqB,EAAE,CAAC;aAC1E,MAAM,EAAE,CAAA;QAEX,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAA;QACb,CAAC;QAED,iEAAiE;QACjE,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,sCAAqB,EAAE,CAAC,CAAA;QAErF,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAA;AA/CY,gDAAkB;AA8BvB;IAFL,IAAA,wBAAS,EAAC,mFAAmF,CAAC;IAC9F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IACnF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAgBnD;6BA9CU,kBAAkB;IAD9B,IAAA,uBAAQ,EAAC,2BAAU,CAAC;GACR,kBAAkB,CA+C9B","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { User } from '../user/user.js'\nimport { APP_BINDING_USER_TYPE, AppBinding } from './app-binding.js'\n\n@Resolver(AppBinding)\nexport class AppBindingMutation {\n  /**\n   * Cut one client off, without touching the application it was granted access to.\n   *\n   * ── This is the revocation ──────────────────────────────────────────────\n   * An appliance keeps its identity when its credential is taken away: past rows point at it as\n   * creator and updater, and a new secret should land on the same subject. A binding is not\n   * like that. The OAuth2 exchange makes one whenever a client is granted access, and the grant\n   * is the only thing it records — so deleting it is what revoking means here, and there is no\n   * second state for it to sit in (ADR-0055).\n   *\n   * ── What the criteria has to name ───────────────────────────────────────\n   * A binding is not a table of its own. It is a `User` row wearing a `userType`, which makes\n   * every account in the installation the same kind of row as this one. This ran\n   * `delete({ id })` — no type, no tenant — so any id at all deleted that row and answered\n   * true: a person's account, a domain owner, an appliance's shadow user, another tenant's\n   * binding. The domain was read out of the context and then not used.\n   *\n   * So the row is found first, the way `appBinding` finds one — this tenant, this type — and\n   * only then deleted. An id that is not one of ours answers exactly what a nonexistent id\n   * answers, for the same reason the read does: telling them apart would confirm that some id\n   * is real somewhere else.\n   *\n   * ── And it carried no privilege ─────────────────────────────────────────\n   * The schema recorded it as open, so anyone holding a valid token could reach it. It now asks\n   * for what `revokeApplianceCredential` asks for, which is the same act on the other kind of\n   * machine credential.\n   */\n  @Directive('@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, { description: \"To revoke an application's access by deleting its binding\" })\n  async deleteAppBinding(@Arg('id') id: string, @Ctx() context: ResolverContext) {\n    const { domain } = context.state\n\n    const binding = await buildDomainUsersQueryBuilder(domain.id, 'USER')\n      .andWhere('USER.id = :id', { id })\n      .andWhere('USER.userType = :userType', { userType: APP_BINDING_USER_TYPE })\n      .getOne()\n\n    if (!binding) {\n      return true\n    }\n\n    // TODO 다른 도메인에도 포함되어있다면, domains-users 관계와 해당 도메인 관련 정보만 삭제해야 함.\n    await getRepository(User).delete({ id: binding.id, userType: APP_BINDING_USER_TYPE })\n\n    return true\n  }\n}\n"]}

package/dist-server/service/app-binding/app-binding-query.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-binding-query.js","sourceRoot":"","sources":["../../../server/service/app-binding/app-binding-query.ts"],"names":[],"mappings":";;;AAwCA,wCAcC;;AAtDD,+CAA8F;AAG9F,iDAA4E;AAE5E,yEAA8E;AAC9E,kEAA2D;AAC3D,6CAAsC;AAEtC,qDAAoE;AACpE,iEAAuD;AAEvD;;;;;;;;;;GAUG;AACH;;;GAGG;AACU,QAAA,uBAAuB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;AAEvE;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,MAAiB;IAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IAEnC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAA;IACf,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE;YACP,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACzB,GAAG,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;SAC3F;KACF,CAAA;AACH,CAAC;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B;;;;;;;;;;;;;OAaG;IAGG,AAAN,KAAK,CAAC,UAAU,CAAY,EAAU,EAAS,OAAwB;QACrE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAO,MAAM,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC;aACzD,QAAQ,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,CAAC;aACjC,QAAQ,CAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,sCAAqB,EAAE,CAAC;aAC1E,MAAM,EAAE,CAAA;IACb,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IAGG,AAAN,KAAK,CAAC,WAAW,CAA0B,MAAiB,EAAS,OAAwB;QAC3F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,KAAK,GAAW,MAAM,CAAA;QAC5B,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAEnF,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,uBAAuB,EAAE,EAAE,QAAQ,EAAE,sCAAqB,EAAE,CAAC,CAAA;QAEjF,IAAA,kBAAU,EAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,+BAAuB,EAAE,CAAC,CAAA;QAExG,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;QAEjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAS,UAAsB;QAC9C,OAAO,MAAM,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;IACjF,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,UAAsB;QACxC,MAAM,CAAC,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACjH,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAS,UAAsB;QAC/C,OAAO,UAAU,CAAC,QAAQ,CAAA;IAC5B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,UAAsB;QAC1C,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,UAAsB;QAC1C,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1E,CAAC;CACF,CAAA;AAxFY,0CAAe;AAiBpB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,2BAAU,CAAC;IACX,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAO7C;AAwBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,qCAAc,CAAC;IACd,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;kDAa3D;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,4BAAW,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,2BAAU;;kDAE/C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,2BAAU;;4CAGzC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACV,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,2BAAU;;mDAEhD;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,2BAAU;;8CAE3C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,2BAAU;;8CAE3C;0BAvFU,eAAe;IAD3B,IAAA,uBAAQ,EAAC,2BAAU,CAAC;GACR,eAAe,CAwF3B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { buildQuery, getRepository, ListParam } from '@things-factory/shell'\n\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { Application } from '../application/application.js'\nimport { User } from '../user/user.js'\nimport { UserList } from '../user/user-types.js'\nimport { APP_BINDING_USER_TYPE, AppBinding } from './app-binding.js'\nimport { AppBindingList } from './app-binding-types.js'\n\n/*\n * ── Why these two now carry a gate ──────────────────────────────────────────\n * They carried none, so the schema recorded them as open and any valid token could list this\n * tenant's bindings. The rows are tenant-scoped, and `AppBinding.refreshToken` has a gate of\n * its own, so what was reachable was the rest of the row — the name, the email, and which\n * application each client is bound to.\n *\n * The pair is the one the appliance and application lists ask for. Those three screens sit\n * together and are the same kind of thing, and leaving one of them open reads as a decision\n * that nobody made.\n */\n/**\n * The fields a free-text search looks in: the binding's name, its generated email, and the\n * description someone wrote for it.\n */\nexport const APP_BINDING_SEARCHABLES = ['name', 'email', 'description']\n\n/**\n * Turns the list's free-text term into one search filter per searchable field.\n *\n * The screen now sends the term itself (`ListParam.search`) and leaves it to the server to say\n * where it looks. This door builds its query with the older `buildQuery`, which only knows search\n * *filters* - so the term is spelled out here, at the caller, rather than by changing the shared\n * helper for one door. Without this the term reaches the door and is dropped, and the list comes\n * back whole with nothing to say so.\n *\n * `buildQuery` applies a search filter as `LIKE :value`, so the value carries its own wildcards.\n */\nexport function withSearchTerm(params: ListParam): ListParam {\n  const term = params?.search?.trim()\n\n  if (!term) {\n    return params\n  }\n\n  return {\n    ...params,\n    filters: [\n      ...(params.filters ?? []),\n      ...APP_BINDING_SEARCHABLES.map(name => ({ name, operator: 'search', value: `%${term}%` }))\n    ]\n  }\n}\n\n@Resolver(AppBinding)\nexport class AppBindingQuery {\n  /**\n   * One binding.\n   *\n   * The domain was read out of the context and then not used — `findOneBy({ id, userType })`\n   * searched every tenant, and a comment said so: \"TODO should check domain is available\".\n   * An id from anywhere returned that application user's name, email and reference. The\n   * refresh token was never part of it, since `AppBinding.refreshToken` carries its own\n   * `@privilege(category: \"security\", …)`, but the rest of the row is still another tenant's.\n   *\n   * A binding belongs to the domain that made it, so the lookup asks for both. An id from\n   * another domain now answers nothing, which is the same thing it answers for an id that\n   * does not exist — deliberately: telling the two apart would confirm that some id is real\n   * somewhere else.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => AppBinding)\n  async appBinding(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<User> {\n    const { domain } = context.state\n\n    return await buildDomainUsersQueryBuilder(domain.id, 'USER')\n      .andWhere('USER.id = :id', { id })\n      .andWhere('USER.userType = :userType', { userType: APP_BINDING_USER_TYPE })\n      .getOne()\n  }\n\n  /**\n   * The bindings of this domain.\n   *\n   * ── Paging used to happen before the filtering ───────────────────────────────\n   * `buildQuery` applied the caller's pagination to the query, and the \"is this an\n   * application user\" test ran in JavaScript on whatever came back:\n   *\n   *     buildQuery(qb, params, …)                              take 20 users of any type\n   *     items = items.filter(user => user.userType == …)       keep the ones that qualify\n   *     return { items, total: items.length }                  report that many in total\n   *\n   * A page of twenty therefore arrived with however many of those twenty happened to be\n   * applications — three, or none — and the total reported the survivors of that one page.\n   * The grid's pager believed it, so with more bindings than fit in a page the later ones\n   * were unreachable: the pager never offered a page two that the total said did not exist.\n   *\n   * The condition belongs in the query, where the database can page what is already\n   * filtered, and `getManyAndCount` then counts every matching row rather than the visible\n   * ones.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => AppBindingList)\n  async appBindings(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<UserList> {\n    const { domain } = context.state\n\n    const alias: string = 'USER'\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, alias)\n\n    qb.andWhere(`${alias}.userType = :userType`, { userType: APP_BINDING_USER_TYPE })\n\n    buildQuery(qb, withSearchTerm(params), null, { domainRef: false, searchables: APP_BINDING_SEARCHABLES })\n\n    const [items, total] = await qb.getManyAndCount()\n\n    return { items, total }\n  }\n\n  @FieldResolver(type => Application)\n  async application(@Root() appBinding: AppBinding): Promise<Application> {\n    return await getRepository(Application).findOneBy({ id: appBinding.reference })\n  }\n\n  @FieldResolver(type => String)\n  async scope(@Root() appBinding: AppBinding): Promise<string> {\n    const u = await getRepository(User).findOne({ where: { reference: appBinding.reference }, relations: ['roles'] })\n    return u.roles.map(role => role.name).join(',')\n  }\n\n  @FieldResolver(type => String)\n  async refreshToken(@Root() appBinding: AppBinding): Promise<string> {\n    return appBinding.password\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() appBinding: AppBinding): Promise<User> {\n    return await getRepository(User).findOneBy({ id: appBinding.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() appBinding: AppBinding): Promise<User> {\n    return await getRepository(User).findOneBy({ id: appBinding.creatorId })\n  }\n}\n"]}

package/dist-server/service/app-binding/app-binding-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-binding-types.js","sourceRoot":"","sources":["../../../server/service/app-binding/app-binding-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAqD;AACrD,qDAA6C;AAGtC,IAAM,cAAc,GAApB,MAAM,cAAc;CAM1B,CAAA;AANY,wCAAc;AAEzB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,2BAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;;6CACnF;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;6CACnF;yBALH,cAAc;IAD1B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;GAC5D,cAAc,CAM1B","sourcesContent":["import { Field, Int, ObjectType } from 'type-graphql'\nimport { AppBinding } from './app-binding.js'\n\n@ObjectType({ description: 'A paginated list of application bindings.' })\nexport class AppBindingList {\n  @Field(type => [AppBinding], { nullable: true, description: 'The list of application binding items.' })\n  items?: [AppBinding]\n\n  @Field(type => Int, { nullable: true, description: 'The total number of application bindings.' })\n  total?: number\n}\n"]}

package/dist-server/service/app-binding/app-binding.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-binding.js","sourceRoot":"","sources":["../../../server/service/app-binding/app-binding.ts"],"names":[],"mappings":";;;;AAAA,+CAA2D;AAC3D,kEAA2D;AAC3D,6CAAsC;AAEtC;;;;;;;GAOG;AACU,QAAA,qBAAqB,GAAG,aAAa,CAAA;AAK3C,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,cAAI;CAUnC,CAAA;AAVY,gCAAU;AAErB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;sCACzE,4BAAW;+CAAA;AAGxB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;;yCAC7E;AAIb;IAFC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IAChF,IAAA,wBAAS,EAAC,gFAAgF,CAAC;;gDACxE;qBATT,UAAU;IAHtB,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,wGAAwG;KACtH,CAAC;GACW,UAAU,CAUtB","sourcesContent":["import { ObjectType, Field, Directive } from 'type-graphql'\nimport { Application } from '../application/application.js'\nimport { User } from '../user/user.js'\n\n/**\n * What a binding is, as a row: a `User` with this `userType`.\n *\n * It is spelled here rather than in one of the resolvers because three places have to agree on\n * it — the list, the single lookup, and the delete. The delete is the one that matters: a\n * binding is not a distinct table, so a criteria that leaves this out names every account in\n * the installation just as well.\n */\nexport const APP_BINDING_USER_TYPE = 'application'\n\n@ObjectType({\n  description: 'Represents a user that is bound to a specific application, with an associated scope and refresh token.'\n})\nexport class AppBinding extends User {\n  @Field({ nullable: true, description: 'The application to which the user is bound.' })\n  application: Application\n\n  @Field({ nullable: true, description: 'The scope of access granted to the application.' })\n  scope: string\n\n  @Field({ nullable: true, description: 'The refresh token for the application.' })\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  refreshToken: string\n}\n"]}

package/dist-server/service/app-binding/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/app-binding/index.ts"],"names":[],"mappings":";;;AAAA,iEAAwD;AACxD,uEAA8D;AAEjD,QAAA,SAAS,GAAG,CAAC,sCAAe,EAAE,4CAAkB,CAAC,CAAA","sourcesContent":["import { AppBindingQuery } from './app-binding-query.js'\nimport { AppBindingMutation } from './app-binding-mutation.js'\n\nexport const resolvers = [AppBindingQuery, AppBindingMutation]\n"]}

package/dist-server/service/appliance/appliance-mutation.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appliance-mutation.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AAEtE,iDAAqD;AAErD,6CAAkD;AAClD,+EAA+E;AAC/E,iDAA0C;AAC1C,6DAAmE;AAEnE,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;AAGzB,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAItB,AAAN,KAAK,CAAC,eAAe,CACD,SAAuB,EAClC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,YAAY,GAAG,MAAM,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;YACb,GAAG,SAAS;SACb,CAAC,CAAA;QAEF,MAAM,wBAAS,CAAC,mBAAmB,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAE3D,OAAO,YAAY,CAAA;IACrB,CAAC;IAKK,AAAN,KAAK,CAAC,eAAe,CAAY,EAAU,EAAS,OAAwB;QAC1E,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC;;;;;;;;;WASG;QACH,MAAM,SAAS,GAAG,MAAM,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAEjG,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,IAAI,CAAA;QACb,CAAC;QAED,iEAAiE;QACjE,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;YACnC,SAAS,EAAE,EAAE;YACb,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAA;QAEF,MAAM,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAE5E,OAAO,IAAI,CAAA;IACb,CAAC;IAKK,AAAN,KAAK,CAAC,uBAAuB,CAAY,EAAU,EAAS,OAAwB;QAClF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,SAAS,GAAc,MAAM,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAC5G,MAAM,OAAO,GAAG,MAAM,wBAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAExE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,0CAA0C,CAAC,CAAA;QAChE,CAAC;QAED;;;;WAIG;QACH,OAAO,CAAC,gBAAgB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAC9D,OAAO,CAAC,QAAQ,GAAG,wBAAS,CAAC,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QAE5E;;;WAGG;QACH,OAAO,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAErC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEvC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YAC7C,GAAG,SAAS;YACZ,WAAW,EAAE,OAAO,CAAC,QAAQ;YAC7B,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IAIG,AAAN,KAAK,CAAC,yBAAyB,CAAY,EAAU,EAAS,OAAwB;QACpF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C;;;WAGG;QACH,IAAI,CAAC,IAAA,mDAA0B,GAAE,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAA;QACjF,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAExF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAA;QAC3C,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QAEjG,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBACjC,GAAG,OAAO;gBACV;;;;mBAIG;gBACH,gBAAgB,EAAE,CAAC,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC;gBACrD,MAAM,EAAE,oBAAU,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,MAAM,mBAAmB,CAAC,IAAI,CAAC;YACpC,GAAG,SAAS;YACZ,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAKK,AAAN,KAAK,CAAC,eAAe,CACR,EAAU,EACP,KAAqB,EAC5B,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,wBAAS,EAAE,EAAE,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QACjG,MAAM,OAAO,GAAG,MAAM,wBAAS,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;QAExE,MAAM,cAAc,CAAC,IAAI,CAAC;YACxB,GAAG,OAAO;YACV,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI;SAC/B,CAAC,CAAA;QAEF,OAAO,MAAM,mBAAmB,CAAC,IAAI,CAAC;YACpC,GAAG,SAAS;YACZ,GAAG,KAAK;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;CACF,CAAA;AAxMY,8CAAiB;AAItB;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAExE,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAChB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CADuB,iCAAY;;wDAe1C;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IAC9C,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wDA4BlD;AAKK;IAHL,IAAA,wBAAS,EAAC,mFAAmF,CAAC;IAC9F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,CAAC;IACA,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gEA+B1D;AA0CK;IAHL,IAAA,wBAAS,EAAC,mFAAmF,CAAC;IAC9F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAC7D,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kEAwC5D;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,CAAC;IAE5B,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IACT,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IACZ,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADe,mCAAc;;wDAqBpC;4BAvMU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,wBAAS,CAAC;GACP,iBAAiB,CAwM7B","sourcesContent":["import { Directive, Arg, Ctx, Mutation, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { User, UserStatus } from '../user/user.js'\nimport { offersCredentialRevocation } from '../../utils/credential-features.js'\nimport { Appliance } from './appliance.js'\nimport { AppliancePatch, NewAppliance } from './appliance-types.js'\n\nconst crypto = require('crypto')\n\n@Resolver(Appliance)\nexport class ApplianceMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Appliance, { description: 'To create new appliance' })\n  async createAppliance(\n    @Arg('appliance') appliance: NewAppliance,\n    @Ctx() context: ResolverContext\n  ): Promise<Appliance> {\n    const { domain, user, tx } = context.state\n\n    const newAppliance = await getRepository(Appliance, tx).save({\n      domain: domain,\n      creator: user,\n      updater: user,\n      ...appliance\n    })\n\n    await Appliance.ensureApplianceUser(newAppliance, user, tx)\n\n    return newAppliance\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: 'To delete appliance' })\n  async deleteAppliance(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Boolean> {\n    const { domain, tx } = context.state\n\n    /*\n     * The appliance is read before anything is deleted.\n     *\n     * The shadow user is found by `reference`, which carries no tenant of its own, and only the\n     * appliance row is scoped by domain. Deleting the user first meant an id belonging to\n     * somebody else took their device's identity away and then failed to delete their appliance:\n     * the row stayed on their screen looking registered while the device stopped at its next\n     * request, because `checkAuth` looks the subject up by the id in the token and there was no\n     * longer a subject. The mutation answered true either way, so nothing said it had happened.\n     */\n    const appliance = await getRepository(Appliance, tx).findOneBy({ domain: { id: domain.id }, id })\n\n    if (!appliance) {\n      return true\n    }\n\n    // TODO 다른 도메인에도 포함되어있다면, domains-users 관게와 해당 도메인 관련 정보만 삭제해야 함.\n    await getRepository(User, tx).delete({\n      reference: id,\n      userType: 'appliance'\n    })\n\n    await getRepository(Appliance, tx).delete({ domain: { id: domain.id }, id })\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Appliance)\n  async generateApplianceSecret(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Appliance> {\n    const { domain, user, tx } = context.state\n\n    const appliance: Appliance = await getRepository(Appliance, tx).findOneBy({ domain: { id: domain.id }, id })\n    const appuser = await Appliance.ensureApplianceUser(appliance, user, tx)\n\n    if (!appuser.domains.find(d => d.id === domain.id)) {\n      context.throw(401, 'appliance is not allowed for this domain')\n    }\n\n    /*\n     * The serial moves before the token is signed, so the new token carries the new number and\n     * every earlier one stops matching (ADR-0085 decision 3). An appliance that has never been\n     * through this path starts at 1.\n     */\n    appuser.credentialSerial = (appuser.credentialSerial ?? 0) + 1\n    appuser.password = Appliance.generateAccessToken(domain, appuser, appliance)\n\n    /*\n     * Back to ACTIVATED. A revoked appliance is INACTIVE, and `checkAuth` refuses that whatever\n     * the token says — so without this line a freshly issued secret would be dead on arrival.\n     */\n    appuser.status = UserStatus.ACTIVATED\n\n    await getRepository(User).save(appuser)\n\n    return await getRepository(Appliance, tx).save({\n      ...appliance,\n      accessToken: appuser.password,\n      updater: user\n    })\n  }\n\n  /*\n   * Take an appliance's credential away without taking the appliance with it.\n   *\n   * ── Emptying the field is not revocation ────────────────────────────────\n   * The access token is a **signed JWT**, not a secret we compare against. Clearing\n   * `Appliance.accessToken` only drops our copy — the token already on the device keeps\n   * verifying against SECRET until its own `exp`, which is a year out.\n   *\n   * What stops it is `User.checkAuth`. It runs on every request once the signature verifies,\n   * looks the subject up by the id baked into the token, and refuses an INACTIVE one. So the\n   * shadow user's status is the switch, and every outstanding token is refused from the next\n   * request onward.\n   *\n   * ── Why INACTIVE and not LOCKED ─────────────────────────────────────────\n   * LOCKED is the failed-sign-in lockout, and `checkAuth` lets it through once\n   * `isAccountLocked` says the lock has aged out. A revocation that expires by itself would\n   * hand a lost device its access back. INACTIVE is refused unconditionally.\n   *\n   * BANNED would read well here and does not work: it is in `UserStatus` but `checkAuth`'s\n   * switch has no case for it, so a banned subject authenticates.\n   *\n   * Clearing `password` and `accessToken` is tidiness rather than a control: the JWT verifies\n   * on its signature and never against those columns. ⚠ So a hazard remains — set the status\n   * back to ACTIVATED without issuing a new secret and the old token authenticates again.\n   * Closing that needs the token to be refusable on its own (a jti denylist), which this is\n   * not.\n   *\n   * ── Why the shadow user survives ────────────────────────────────────────\n   * `deleteAppliance` deletes it, and that is right when the appliance goes too. Here the\n   * appliance stays, so the identity has to stay with it — it is what past rows point at as\n   * creator and updater, and re-issuing later keeps the same id rather than orphaning them.\n   *\n   * ── What this is for ────────────────────────────────────────────────────\n   * A device that is lost, decommissioned or suspect. Before this the only ways to stop one\n   * were to delete the row, which takes the history with it, or to issue a new secret, which\n   * leaves a working credential in the database and on the screen. Neither is revocation.\n   */\n  @Directive('@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Appliance, { description: \"To revoke an appliance's access credential\" })\n  async revokeApplianceCredential(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Appliance> {\n    const { domain, user, tx } = context.state\n\n    /*\n     * The door only exists where the installation asked for it (ADR-0085 decision 2). Refusing\n     * here rather than hiding the mutation keeps one answer for a caller that reaches it anyway.\n     */\n    if (!offersCredentialRevocation()) {\n      context.throw(404, 'credential revocation is not enabled on this installation')\n    }\n\n    const applianceRepository = getRepository(Appliance, tx)\n    const appliance = await applianceRepository.findOneBy({ domain: { id: domain.id }, id })\n\n    if (!appliance) {\n      context.throw(404, 'appliance not found')\n    }\n\n    const appuser = await getRepository(User, tx).findOneBy({ reference: id, userType: 'appliance' })\n\n    if (appuser) {\n      await getRepository(User, tx).save({\n        ...appuser,\n        /*\n         * The serial moves without a token being signed, so nothing matches it any more — not\n         * the token on the device, and not one issued before this appliance ever had a serial.\n         * The status alone could be undone by setting it back; this cannot.\n         */\n        credentialSerial: (appuser.credentialSerial ?? 0) + 1,\n        status: UserStatus.INACTIVE,\n        password: null,\n        updater: user\n      })\n    }\n\n    return await applianceRepository.save({\n      ...appliance,\n      accessToken: null,\n      updater: user\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Appliance)\n  async updateAppliance(\n    @Arg('id') id: string,\n    @Arg('patch') patch: AppliancePatch,\n    @Ctx() context: ResolverContext\n  ): Promise<Appliance> {\n    const { domain, user, tx } = context.state\n\n    const applianceRepository = getRepository(Appliance, tx)\n    const userRepository = getRepository(User, tx)\n\n    const appliance = await applianceRepository.findOne({ where: { domain: { id: domain.id }, id } })\n    const appuser = await Appliance.ensureApplianceUser(appliance, user, tx)\n\n    await userRepository.save({\n      ...appuser,\n      name: patch?.name || user.name\n    })\n\n    return await applianceRepository.save({\n      ...appliance,\n      ...patch,\n      updater: user\n    })\n  }\n}\n"]}

package/dist-server/service/appliance/appliance-query.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appliance-query.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA2H;AAE3H,+EAA+E;AAC/E,4DAAqD;AACrD,6CAAkD;AAClD,6DAAoD;AAG7C,IAAM,cAAc,GAApB,MAAM,cAAc;IAGnB,AAAN,KAAK,CAAC,SAAS,CAAY,EAAU,EAAS,OAAwB;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACpF,CAAC;IAIK,AAAN,KAAK,CAAC,UAAU,CACW,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,wBAAS,CAAC;YACpC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,wBAAS,CAAC;YACpC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,4BAA4B;QAChC,OAAO,IAAA,mDAA0B,GAAE,CAAA;IACrC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAS,SAAoB,EAAS,OAAwB;QAC7E,OAAO,SAAS,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED;;;;;;;;OAQG;IAEG,AAAN,KAAK,CAAC,iBAAiB,CAAS,SAAoB;QAClD,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QAEvG,OAAO,OAAO,EAAE,MAAM,KAAK,oBAAU,CAAC,QAAQ,CAAA;IAChD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAwB;QAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,SAAoB;QACxC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,SAAoB;QACxC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,CAAC;CACF,CAAA;AA3GY,wCAAc;AAGnB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACnD,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAG5C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kCAAa,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IAE7E,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;gDAiB3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kCAAa,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnE,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;2CAerD;AAqBK;IAFL,IAAA,wBAAS,EAAC,mFAAmF,CAAC;IAC9F,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;;;;kEAG9G;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACX,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAwB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,wBAAS;;iDAE7C;AAYK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACN,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;uDAInD;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;4CAElB;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;6CAEzC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;6CAEzC;yBA1GU,cAAc;IAD1B,IAAA,uBAAQ,EAAC,wBAAS,CAAC;GACP,cAAc,CA2G1B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, InheritedValueType, Domain, getRepository, ListParam } from '@things-factory/shell'\n\nimport { offersCredentialRevocation } from '../../utils/credential-features.js'\nimport { Appliance } from '../appliance/appliance.js'\nimport { User, UserStatus } from '../user/user.js'\nimport { ApplianceList } from './appliance-types.js'\n\n@Resolver(Appliance)\nexport class ApplianceQuery {\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => Appliance, { description: ' To fetch appliance' })\n  async appliance(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Appliance> {\n    const { domain } = context.state\n    return await getRepository(Appliance).findOneBy({ domain: { id: domain.id }, id })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => ApplianceList, { description: 'To fetch multiple appliance' })\n  async appliances(\n    @Args(type => ListParam) params: ListParam,\n    @Ctx() context: ResolverContext\n  ): Promise<ApplianceList> {\n    const { domain } = context.state\n\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain,\n      // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n      params: { ...params, inherited: InheritedValueType.None },\n      repository: getRepository(Appliance),\n      alias: 'appliance',\n      searchables: ['name', 'description']\n    })\n\n    const [items, total] = await queryBuilder.getManyAndCount()\n\n    return { items, total }\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => ApplianceList, { description: 'To fetch multiple appliance' })\n  async edges(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<ApplianceList> {\n    const { domain } = context.state\n\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain,\n      // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n      params: { ...params, inherited: InheritedValueType.None },\n      repository: getRepository(Appliance),\n      alias: 'appliance',\n      searchables: ['name', 'description']\n    })\n\n    const [items, total] = await queryBuilder.getManyAndCount()\n\n    return { items, total }\n  }\n\n  /*\n   * Does revoking an appliance credential work here? (ADR-0085 decision 1.)\n   *\n   * ── Why the screen has to ask ───────────────────────────────────────────\n   * Revocation is behind `credential/revocable`, and an installation that never configured it\n   * has no such door — `revokeApplianceCredential` answers 404. The screen cannot read the\n   * config, so without this it would either hide a feature the installation paid for or show a\n   * button that always refuses. The second is the worse one: it reads as a broken product\n   * rather than as something nobody turned on.\n   *\n   * ── Why it carries the mutation's own gate ──────────────────────────────\n   * The same `category` / `privilege` pair as `revokeApplianceCredential`, so what comes back is\n   * not \"the installation has this\" but **\"pressing it would work for you\"**. Those differ for a\n   * reader who may list appliances and may not act on their credentials, and a button should\n   * follow the second. A refusal here reaches the client as an error, which it reads the same\n   * way as false.\n   */\n  @Directive('@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Query(returns => Boolean, { description: 'Whether this installation offers appliance credential revocation' })\n  async applianceCredentialRevocable(): Promise<boolean> {\n    return offersCredentialRevocation()\n  }\n\n  @FieldResolver(type => String)\n  async accessToken(@Root() appliance: Appliance, @Ctx() context: ResolverContext) {\n    return appliance.accessToken\n  }\n\n  /*\n   * Revocation is recorded on the shadow user, so the answer is not on the row that was asked\n   * for. INACTIVE means revoked and nothing else does: `ensureApplianceUser` creates the user\n   * ACTIVATED, `generateApplianceSecret` puts it back to ACTIVATED, and `revokeApplianceCredential`\n   * is the one place that sets INACTIVE.\n   *\n   * An appliance with no shadow user at all is not revoked — it is one nothing was ever issued\n   * for, which is the state a freshly registered appliance is in.\n   */\n  @FieldResolver(type => Boolean)\n  async credentialRevoked(@Root() appliance: Appliance): Promise<boolean> {\n    const appuser = await getRepository(User).findOneBy({ reference: appliance.id, userType: 'appliance' })\n\n    return appuser?.status === UserStatus.INACTIVE\n  }\n\n  @FieldResolver(type => Domain)\n  async domain(@Ctx() context: ResolverContext) {\n    return context.state.domain\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() appliance: Appliance): Promise<User> {\n    return await getRepository(User).findOneBy({ id: appliance.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() appliance: Appliance): Promise<User> {\n    return await getRepository(User).findOneBy({ id: appliance.creatorId })\n  }\n}\n"]}

package/dist-server/service/appliance/appliance-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appliance-types.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAoE;AACpE,iDAA0C;AAGnC,IAAM,aAAa,GAAnB,MAAM,aAAa;CAMzB,CAAA;AANY,sCAAa;AAExB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;;4CACzE;AAGnB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;4CACzE;wBALH,aAAa;IADzB,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;GAClD,aAAa,CAMzB;AAGM,IAAM,cAAc,GAApB,MAAM,cAAc;CAqB1B,CAAA;AArBY,wCAAc;AAEzB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;;0CAC7F;AAGX;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;gDAClE;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;4CAC7D;AAGb;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;6CAC7D;AAGd;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;;6CAC7D;AAGd;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;;mDAC7D;AAGpB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;+CAClE;yBApBL,cAAc;IAD1B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;GACtE,cAAc,CAqB1B;AAGM,IAAM,YAAY,GAAlB,MAAM,YAAY;CAkBxB,CAAA;AAlBY,oCAAY;AAEvB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;8CAClD;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;;0CAC7C;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;2CAC7C;AAGb;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;2CAC7C;AAGb;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;iDAC3D;AAGpB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;6CAClE;uBAjBL,YAAY;IADxB,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;GACrD,YAAY,CAkBxB","sourcesContent":["import { ObjectType, InputType, Field, ID, Int } from 'type-graphql'\nimport { Appliance } from './appliance.js'\n\n@ObjectType({ description: 'A paginated list of appliances.' })\nexport class ApplianceList {\n  @Field(type => [Appliance], { nullable: true, description: 'The list of appliance items.' })\n  items?: Appliance[]\n\n  @Field(type => Int, { nullable: true, description: 'The total number of appliances.' })\n  total?: number\n}\n\n@InputType({ description: 'Input for updating (patching) an existing appliance.' })\nexport class AppliancePatch {\n  @Field(type => ID, { nullable: true, description: 'The unique identifier of the appliance to update.' })\n  id?: string\n\n  @Field({ nullable: true, description: 'The new serial number for the appliance.' })\n  serialNo?: string\n\n  @Field({ nullable: true, description: 'The new name for the appliance.' })\n  name?: string\n\n  @Field({ nullable: true, description: 'The new brand for the appliance.' })\n  brand?: string\n\n  @Field({ nullable: true, description: 'The new model for the appliance.' })\n  model?: string\n\n  @Field({ nullable: true, description: 'The new description for the appliance.' })\n  description?: string\n\n  @Field({ nullable: true, description: 'The new network mask for the appliance.' })\n  netmask?: string\n}\n\n@InputType({ description: 'Input for creating a new appliance.' })\nexport class NewAppliance {\n  @Field({ description: 'The serial number of the new appliance.' })\n  serialNo: string\n\n  @Field({ description: 'The name of the new appliance.' })\n  name: string\n\n  @Field({ description: 'The brand of the new appliance.' })\n  brand: string\n\n  @Field({ description: 'The model of the new appliance.' })\n  model: string\n\n  @Field({ nullable: true, description: 'A description for the new appliance.' })\n  description?: string\n\n  @Field({ nullable: true, description: 'The network mask for the new appliance.' })\n  netmask?: string\n}\n"]}

package/dist-server/service/appliance/appliance.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"appliance.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance.ts"],"names":[],"mappings":";;;;AAAA,qCAUgB;AAChB,+CAA+D;AAC/D,iDAA6D;AAC7D,6CAA4C;AAE5C,6EAA+E;AAE/E,6CAAkD;AAClD,6DAAkD;AAClD,wEAA8B;AAE9B,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAO7B,IAAM,SAAS,GAAf,MAAM,SAAS;IAkGpB;;;;;;;;;OASG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS;QACrD,IAAI,UAAU,GAAQ;YACpB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE;gBACT,EAAE,EAAE,SAAS,CAAC,EAAE;aACjB;YACD,MAAM,EAAE,oBAAU,CAAC,SAAS;YAC5B,MAAM,EAAE;gBACN,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B;SACF,CAAA;QAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1E,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAA;QACvC,CAAC;QAED,OAAO,sBAAG,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAM,EAAE;YAClC,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,OAAO;SACR,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS;QAChD,uDAAuD;QACvD,IAAI,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAA;QACzD,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IACtE,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,SAAoB,EAAE,IAAU,EAAE,EAAiB;QAClF,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;QAChC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,OAAO,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE;gBACL,SAAS,EAAE,EAAE;gBACb,QAAQ,EAAE,WAAW;aACtB;YACD,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,GAAG,SAAS,CAAC,EAAE,IAAI,MAAM,EAAE,SAAS,IAAI,CAAA;YAE9E,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;gBAClC,QAAQ;gBACR,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,QAAQ,EAAE,WAAW;gBACrB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,oBAAU,CAAC,SAAS;gBAC5B,OAAO,EAAE,CAAC,MAAM,CAAC;gBACjB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;aAClC,CAAC,CAAA;YAEF,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE;oBACL,EAAE,EAAE,OAAO,CAAC,EAAE;iBACf;gBACD,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7B,0DAA0D;YAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,SAAS,CAAC,EAAE,IAAI,MAAM,EAAE,SAAS,IAAI,CAAA;YAE1E,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;gBAClC,GAAG,OAAO;gBACV,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ;gBACtC,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YAEF,OAAO,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE;oBACL,EAAE,EAAE,OAAO,CAAC,EAAE;iBACf;gBACD,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;CACF,CAAA;AA/LY,8BAAS;AAGX;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;qCACxD;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;sCAC5E,cAAM;yCAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;;2CACvC;AAMhB;IAJC,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;2CAC9D;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;;uCACzC;AAIZ;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;wCACzE;AAIb;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;wCACzD;AAMb;IAJC,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;;0CAC9D;AAMf;IAJC,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;8CACvD;AAiBnB;IAfC,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACpD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACpD,WAAW,EAAE,mDAA2B;KACzC,CAAC;IACD,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAC7E,IAAA,wBAAS,EAAC,gFAAgF,CAAC;;8CACzE;AAiBnB;IAJC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE;QACtB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uDAAuD;KACrE,CAAC;;oDACyB;AAI3B;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACrE,cAAI;0CAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;;4CACvC;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;sCAC1E,cAAI;0CAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,SAAoB,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;;4CACvC;AAIjB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;sCAC7E,IAAI;4CAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oDAAoD,EAAE,CAAC;sCAClF,IAAI;IAEf;;;;;;;;;OASG;;4CAXY;oBAhGJ,SAAS;IALrB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,gBAAgB,EAAE,CAAC,SAAoB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI;KACb,CAAC;IACD,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;GAChG,SAAS,CA+LrB","sourcesContent":["import {\n  Column,\n  CreateDateColumn,\n  Entity,\n  EntityManager,\n  Index,\n  ManyToOne,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\nimport { Directive, Field, ID, ObjectType } from 'type-graphql'\nimport { Domain, getRepository } from '@things-factory/shell'\nimport { config } from '@things-factory/env'\n\nimport { credentialAtRestTransformer } from '../../utils/credential-at-rest.js'\n\nimport { User, UserStatus } from '../user/user.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport jwt from 'jsonwebtoken'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\n@Entity()\n@Index('ix_appliance_0', (appliance: Appliance) => [appliance.domain, appliance.name], {\n  unique: true\n})\n@ObjectType({ description: 'Represents a physical or virtual appliance that can be managed by the system.' })\nexport class Appliance {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the appliance.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The domain to which the appliance belongs.' })\n  domain?: Domain\n\n  @RelationId((appliance: Appliance) => appliance.domain)\n  domainId: string\n\n  @Column({\n    nullable: true\n  })\n  @Field({ nullable: true, description: 'The serial number of the appliance.' })\n  serialNo: string\n\n  @Column()\n  @Field({ description: 'The name of the appliance.' })\n  name: string\n\n  @Column()\n  @Field({ nullable: true, description: 'The brand or manufacturer of the appliance.' })\n  brand: string\n\n  @Column()\n  @Field({ nullable: true, description: 'The model of the appliance.' })\n  model: string\n\n  @Column({\n    nullable: true\n  })\n  @Field({ nullable: true, description: 'The network mask of the appliance.' })\n  netmask: string\n\n  @Column({\n    nullable: true\n  })\n  @Field({ nullable: true, description: 'A description of the appliance.' })\n  description: string\n\n  @Column({\n    nullable: true,\n    type:\n      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'longtext'\n        : DATABASE_TYPE == 'oracle'\n          ? 'clob'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined,\n    transformer: credentialAtRestTransformer\n  })\n  @Field({ nullable: true, description: 'The access token for the appliance.' })\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  accessToken: string\n\n  /*\n   * Has this appliance's credential been taken away? Not a column.\n   *\n   * Revocation lives in the shadow user's status, not here — `revokeApplianceCredential` clears\n   * `accessToken` as tidiness and sets that user INACTIVE, which is what actually stops the\n   * token. So an empty `accessToken` says two different things: never issued, or revoked. A\n   * screen that cannot tell them apart shows the same blank box for a new appliance and for a\n   * lost one.\n   *\n   * Resolved in `ApplianceQuery`, so it costs a lookup and only in the queries that ask for it.\n   */\n  @Field(type => Boolean, {\n    nullable: true,\n    description: \"Whether this appliance's credential has been revoked.\"\n  })\n  credentialRevoked?: boolean\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'The user who created the appliance.' })\n  creator: User\n\n  @RelationId((appliance: Appliance) => appliance.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'The user who last updated the appliance.' })\n  updater: User\n\n  @RelationId((appliance: Appliance) => appliance.updater)\n  updaterId: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'The timestamp when the appliance was created.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true, description: 'The timestamp when the appliance was last updated.' })\n  updatedAt: Date\n\n  /*\n   * `cs` is the credential serial (ADR-0085 decision 3) — which generation of this appliance's\n   * credential the token belongs to. It is absent for a subject that has never been through the\n   * new path, and `checkAuth` lets an absent one by, which is what keeps the tokens already in\n   * the field working.\n   *\n   * It also makes each issue distinct. The rest of this payload is the same every time and\n   * `iat` counts whole seconds, so two signings inside one second used to produce the identical\n   * string — revoking and immediately re-issuing handed back the credential just revoked.\n   */\n  static sign(subject, expiresIn, domain, user, appliance) {\n    var credential: any = {\n      id: user.id,\n      userType: 'appliance',\n      appliance: {\n        id: appliance.id\n      },\n      status: UserStatus.ACTIVATED,\n      domain: {\n        subdomain: domain.subdomain\n      }\n    }\n\n    if (user.credentialSerial !== null && user.credentialSerial !== undefined) {\n      credential.cs = user.credentialSerial\n    }\n\n    return jwt.sign(credential, SECRET, {\n      expiresIn,\n      issuer: 'hatiolab.com',\n      subject\n    })\n  }\n\n  static generateAccessToken(domain, user, appliance) {\n    /* how to set expiresIn https://github.com/vercel/ms */\n    let expiresIn = config.get('applianceJwtExpiresIn', '1y')\n    return this.sign('access-token', expiresIn, domain, user, appliance)\n  }\n\n  static async ensureApplianceUser(appliance: Appliance, user: User, tx: EntityManager) {\n    const { id, domain } = appliance\n    const userRepository = getRepository(User, tx)\n\n    let appuser: User = await userRepository.findOne({\n      where: {\n        reference: id,\n        userType: 'appliance'\n      },\n      relations: ['domains']\n    })\n\n    if (!appuser) {\n      const username = appuser?.username || `${appliance.id}@${domain?.subdomain}.z`\n\n      appuser = await userRepository.save({\n        username,\n        email: username,\n        name: appliance.name,\n        userType: 'appliance',\n        reference: id,\n        status: UserStatus.ACTIVATED,\n        domains: [domain],\n        updater: user,\n        creator: appuser?.creator || user\n      })\n\n      return await userRepository.findOne({\n        where: {\n          id: appuser.id\n        },\n        relations: ['domains']\n      })\n    } else if (!appuser.username) {\n      /* username을 사용하지 않았던 하위버전에서 생성된 데이타를 자동으로 수정하기 위한 로직임. */\n      const username = appuser.email || `${appliance.id}@${domain?.subdomain}.z`\n\n      appuser = await userRepository.save({\n        ...appuser,\n        username: appuser.username || username,\n        updater: user\n      })\n\n      return await userRepository.findOne({\n        where: {\n          id: appuser.id\n        },\n        relations: ['domains']\n      })\n    }\n\n    return appuser\n  }\n}\n"]}

package/dist-server/service/appliance/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/appliance/index.ts"],"names":[],"mappings":";;;AAAA,iDAA0C;AAC1C,6DAAqD;AACrD,mEAA2D;AAE9C,QAAA,QAAQ,GAAG,CAAC,wBAAS,CAAC,CAAA;AACtB,QAAA,SAAS,GAAG,CAAC,mCAAc,EAAE,yCAAiB,CAAC,CAAA","sourcesContent":["import { Appliance } from './appliance.js'\nimport { ApplianceQuery } from './appliance-query.js'\nimport { ApplianceMutation } from './appliance-mutation.js'\n\nexport const entities = [Appliance]\nexport const resolvers = [ApplianceQuery, ApplianceMutation]\n"]}