@webiny/api-core 0.0.0-unstable.0d717d18dd

package/graphql/system/SystemSchemaFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql/system/SystemSchemaFactory.js","sources":["../../../src/graphql/system/SystemSchemaFactory.ts"],"sourcesContent":["import { CoreGraphQLSchemaFactory } from \"@webiny/api-graphql/graphql/abstractions.js\";\nimport type { IGraphQLSchemaBuilder } from \"@webiny/api-graphql/features/GraphQLSchemaBuilder/abstractions.js\";\nimport { ErrorResponse, Response } from \"@webiny/api-graphql\";\nimport { type AppInstallationData } from \"~/features/tenancy/InstallTenant/index.js\";\nimport { GetRootTenantUseCase } from \"~/features/tenancy/GetRootTenant/index.js\";\nimport { InstallSystemUseCase } from \"~/features/system/InstallSystem/index.js\";\n\ninterface InstallTenantArgs {\n    installationInput: AppInstallationData[];\n}\n\nclass SystemSchemaFactoryImpl implements CoreGraphQLSchemaFactory.Interface {\n    async execute(builder: IGraphQLSchemaBuilder): Promise<IGraphQLSchemaBuilder> {\n        builder.addTypeDefs(/* GraphQL */ `\n            type SystemQuery {\n                isSystemInstalled: BooleanResponse\n            }\n\n            type SystemMutation {\n                installSystem(installationInput: JSON!): BooleanResponse\n            }\n\n            extend type Query {\n                system: SystemQuery\n            }\n\n            extend type Mutation {\n                system: SystemMutation\n            }\n        `);\n\n        builder.addResolver({\n            path: \"Query.system\",\n            resolver: () => async () => ({})\n        });\n\n        builder.addResolver({\n            path: \"Mutation.system\",\n            resolver: () => async () => ({})\n        });\n\n        builder.addResolver({\n            path: \"SystemQuery.isSystemInstalled\",\n            dependencies: [GetRootTenantUseCase],\n            resolver: (getRootTenant: GetRootTenantUseCase.Interface) => async () => {\n                const result = await getRootTenant.execute();\n\n                return new Response(result.isOk());\n            }\n        });\n\n        builder.addResolver<InstallTenantArgs>({\n            path: \"SystemMutation.installSystem\",\n            dependencies: [InstallSystemUseCase],\n            resolver:\n                (installSystem: InstallSystemUseCase.Interface) =>\n                async ({ args }) => {\n                    const result = await installSystem.execute(args.installationInput);\n\n                    if (result.isOk()) {\n                        return new Response(true);\n                    }\n\n                    return new ErrorResponse({\n                        code: result.error.code,\n                        message: result.error.message,\n                        data: result.error.data\n                    });\n                }\n        });\n\n        return builder;\n    }\n}\n\nexport const SystemSchemaFactory = CoreGraphQLSchemaFactory.createImplementation({\n    implementation: SystemSchemaFactoryImpl,\n    dependencies: []\n});\n"],"names":["SystemSchemaFactoryImpl","builder","GetRootTenantUseCase","getRootTenant","result","Response","InstallSystemUseCase","installSystem","args","ErrorResponse","SystemSchemaFactory","CoreGraphQLSchemaFactory"],"mappings":";;;;AAWA,MAAMA;IACF,MAAM,QAAQC,OAA8B,EAAkC;QAC1EA,QAAQ,WAAW,CAAe,CAAC;;;;;;;;;;;;;;;;QAgBnC,CAAC;QAEDA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,UAAU,IAAM,UAAa,EAAC;QAClC;QAEAA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,UAAU,IAAM,UAAa,EAAC;QAClC;QAEAA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACC;aAAqB;YACpC,UAAU,CAACC,gBAAkD;oBACzD,MAAMC,SAAS,MAAMD,cAAc,OAAO;oBAE1C,OAAO,IAAIE,SAASD,OAAO,IAAI;gBACnC;QACJ;QAEAH,QAAQ,WAAW,CAAoB;YACnC,MAAM;YACN,cAAc;gBAACK;aAAqB;YACpC,UACI,CAACC,gBACD,OAAO,EAAEC,IAAI,EAAE;oBACX,MAAMJ,SAAS,MAAMG,cAAc,OAAO,CAACC,KAAK,iBAAiB;oBAEjE,IAAIJ,OAAO,IAAI,IACX,OAAO,IAAIC,SAAS;oBAGxB,OAAO,IAAII,cAAc;wBACrB,MAAML,OAAO,KAAK,CAAC,IAAI;wBACvB,SAASA,OAAO,KAAK,CAAC,OAAO;wBAC7B,MAAMA,OAAO,KAAK,CAAC,IAAI;oBAC3B;gBACJ;QACR;QAEA,OAAOH;IACX;AACJ;AAEO,MAAMS,sBAAsBC,yBAAyB,oBAAoB,CAAC;IAC7E,gBAAgBX;IAChB,cAAc,EAAE;AACpB"}

package/graphql/users/UsersSchemaFactory.d.ts

@@ -0,0 +1,9 @@
+import { CoreGraphQLSchemaFactory } from "@webiny/api-graphql/graphql/abstractions.js";
+import type { IGraphQLSchemaBuilder } from "@webiny/api-graphql/features/GraphQLSchemaBuilder/abstractions.js";
+declare class UsersSchemaFactoryImpl implements CoreGraphQLSchemaFactory.Interface {
+    execute(builder: IGraphQLSchemaBuilder): Promise<IGraphQLSchemaBuilder>;
+}
+export declare const UsersSchemaFactory: typeof UsersSchemaFactoryImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-graphql/graphql/abstractions.core").ICoreGraphQLSchemaFactory>;
+};
+export {};

package/graphql/users/UsersSchemaFactory.js

@@ -0,0 +1,191 @@
+import { CoreGraphQLSchemaFactory } from "@webiny/api-graphql/graphql/abstractions.js";
+import { ErrorResponse, ListErrorResponse, ListResponse, NotFoundResponse, Response } from "@webiny/api-graphql/responses.js";
+import { GetUserUseCase } from "../../features/users/GetUser/index.js";
+import NotAuthorizedResponse from "../security/NotAuthorizedResponse.js";
+import { ListUsersUseCase } from "../../features/users/ListUsers/index.js";
+import { IdentityContext } from "../../features/security/IdentityContext/abstractions.js";
+import { ListRolesUseCase } from "../../features/security/roles/ListRoles/index.js";
+import { ListTeamsUseCase } from "../../features/security/teams/ListTeams/index.js";
+class UsersSchemaFactoryImpl {
+    async execute(builder) {
+        builder.addTypeDefs(`
+            type AdminUsersQuery {
+                _empty: String
+            }
+
+            type AdminUsersMutation {
+                _empty: String
+            }
+
+            extend type Query {
+                adminUsers: AdminUsersQuery
+            }
+
+            extend type Mutation {
+                adminUsers: AdminUsersMutation
+            }
+
+            type AdminUsersCreatedBy {
+                id: ID
+                displayName: String
+            }
+
+            type AdminUsersError {
+                code: String
+                message: String
+                data: JSON
+                stack: String
+            }
+
+            type AdminUsersBooleanResponse {
+                data: Boolean
+                error: AdminUsersError
+            }
+
+            type AdminUser {
+                id: ID!
+                displayName: String!
+                email: String!
+
+                roles: [SecurityRole]
+                firstName: String
+                lastName: String
+                avatar: JSON
+                external: Boolean
+                createdOn: DateTime
+            }
+
+            type AdminUsersResponse {
+                data: AdminUser
+                error: AdminUsersError
+            }
+
+            type AdminUsersListResponse {
+                data: [AdminUser]
+                error: AdminUsersError
+            }
+
+            input AdminUsersGetUserWhereInput {
+                id: ID
+                email: String
+            }
+
+            extend type AdminUsersQuery {
+                getUser(where: AdminUsersGetUserWhereInput): AdminUsersResponse
+                getCurrentUser: AdminUsersResponse
+                listUsers: AdminUsersListResponse
+            }
+
+            extend type AdminUser {
+                teams: [SecurityTeam]
+            }
+        `);
+        builder.addResolver({
+            path: "Query.adminUsers",
+            resolver: ()=>async ()=>({})
+        });
+        builder.addResolver({
+            path: "Mutation.adminUsers",
+            resolver: ()=>async ()=>({})
+        });
+        builder.addResolver({
+            path: "AdminUser.roles",
+            dependencies: [
+                ListRolesUseCase
+            ],
+            resolver: (listRoles)=>async ({ parent })=>{
+                    if (!parent.roles) return null;
+                    const result = await listRoles.execute({
+                        where: {
+                            id_in: parent.roles
+                        }
+                    });
+                    if (result.isFail()) throw result.error;
+                    return result.value;
+                }
+        });
+        builder.addResolver({
+            path: "AdminUser.teams",
+            dependencies: [
+                ListTeamsUseCase
+            ],
+            resolver: (listTeams)=>async ({ parent })=>{
+                    const hasTeams = Array.isArray(parent.teams) && parent.teams.length > 0;
+                    if (!hasTeams) return [];
+                    const result = await listTeams.execute({
+                        where: {
+                            id_in: parent.teams
+                        }
+                    });
+                    if (result.isFail()) throw result.error;
+                    return result.value;
+                }
+        });
+        builder.addResolver({
+            path: "AdminUsersQuery.getUser",
+            dependencies: [
+                GetUserUseCase
+            ],
+            resolver: (getUser)=>async ({ args })=>{
+                    const { where } = args;
+                    const userResult = await getUser.execute({
+                        id: where.id,
+                        email: where.email
+                    });
+                    if (userResult.isFail()) {
+                        const error = userResult.error;
+                        if ("AdminUser/NotFound" === error.code) return new NotFoundResponse(`User "${JSON.stringify(where)}" was not found!`);
+                        return new ErrorResponse({
+                            message: error.message,
+                            code: error.code,
+                            data: error.data
+                        });
+                    }
+                    return new Response(userResult.value);
+                }
+        });
+        builder.addResolver({
+            path: "AdminUsersQuery.getCurrentUser",
+            dependencies: [
+                IdentityContext,
+                GetUserUseCase
+            ],
+            resolver: (identityContext, getUser)=>async ()=>{
+                    const identity = identityContext.getIdentity();
+                    if (!identity.isAdmin()) throw new NotAuthorizedResponse();
+                    const userResponse = await identityContext.withoutAuthorization(async ()=>await getUser.execute({
+                            id: identity.id
+                        }));
+                    if (userResponse.isFail()) {
+                        const error = userResponse.error;
+                        if ("AdminUser/NotFound" === error.code) return new NotFoundResponse(`User with ID ${identity.id} was not found!`);
+                        return new ErrorResponse({
+                            message: error.message,
+                            code: error.code,
+                            data: error.data
+                        });
+                    }
+                    return new Response(userResponse.value);
+                }
+        });
+        builder.addResolver({
+            path: "AdminUsersQuery.listUsers",
+            dependencies: [
+                ListUsersUseCase
+            ],
+            resolver: (listUsers)=>async ()=>{
+                    const users = await listUsers.execute();
+                    if (users.isFail()) return new ListErrorResponse(users.error);
+                    return new ListResponse(users.value);
+                }
+        });
+        return builder;
+    }
+}
+const UsersSchemaFactory = CoreGraphQLSchemaFactory.createImplementation({
+    implementation: UsersSchemaFactoryImpl,
+    dependencies: []
+});
+export { UsersSchemaFactory };
+
+//# sourceMappingURL=UsersSchemaFactory.js.map

package/graphql/users/UsersSchemaFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql/users/UsersSchemaFactory.js","sources":["../../../src/graphql/users/UsersSchemaFactory.ts"],"sourcesContent":["import { CoreGraphQLSchemaFactory } from \"@webiny/api-graphql/graphql/abstractions.js\";\nimport {\n    ErrorResponse,\n    ListErrorResponse,\n    ListResponse,\n    NotFoundResponse,\n    Response\n} from \"@webiny/api-graphql/responses.js\";\nimport type { IGraphQLSchemaBuilder } from \"@webiny/api-graphql/features/GraphQLSchemaBuilder/abstractions.js\";\nimport type { AdminUser } from \"~/types/users.js\";\nimport { GetUserUseCase } from \"~/features/users/GetUser/index.js\";\nimport NotAuthorizedResponse from \"~/graphql/security/NotAuthorizedResponse.js\";\nimport { ListUsersUseCase } from \"~/features/users/ListUsers/index.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { ListRolesUseCase } from \"~/features/security/roles/ListRoles/index.js\";\nimport { ListTeamsUseCase } from \"~/features/security/teams/ListTeams/index.js\";\n\nclass UsersSchemaFactoryImpl implements CoreGraphQLSchemaFactory.Interface {\n    async execute(builder: IGraphQLSchemaBuilder): Promise<IGraphQLSchemaBuilder> {\n        builder.addTypeDefs(/* GraphQL */ `\n            type AdminUsersQuery {\n                _empty: String\n            }\n\n            type AdminUsersMutation {\n                _empty: String\n            }\n\n            extend type Query {\n                adminUsers: AdminUsersQuery\n            }\n\n            extend type Mutation {\n                adminUsers: AdminUsersMutation\n            }\n\n            type AdminUsersCreatedBy {\n                id: ID\n                displayName: String\n            }\n\n            type AdminUsersError {\n                code: String\n                message: String\n                data: JSON\n                stack: String\n            }\n\n            type AdminUsersBooleanResponse {\n                data: Boolean\n                error: AdminUsersError\n            }\n\n            type AdminUser {\n                id: ID!\n                displayName: String!\n                email: String!\n\n                roles: [SecurityRole]\n                firstName: String\n                lastName: String\n                avatar: JSON\n                external: Boolean\n                createdOn: DateTime\n            }\n\n            type AdminUsersResponse {\n                data: AdminUser\n                error: AdminUsersError\n            }\n\n            type AdminUsersListResponse {\n                data: [AdminUser]\n                error: AdminUsersError\n            }\n\n            input AdminUsersGetUserWhereInput {\n                id: ID\n                email: String\n            }\n\n            extend type AdminUsersQuery {\n                getUser(where: AdminUsersGetUserWhereInput): AdminUsersResponse\n                getCurrentUser: AdminUsersResponse\n                listUsers: AdminUsersListResponse\n            }\n\n            extend type AdminUser {\n                teams: [SecurityTeam]\n            }\n        `);\n\n        builder.addResolver({\n            path: \"Query.adminUsers\",\n            resolver: () => async () => ({})\n        });\n\n        builder.addResolver({\n            path: \"Mutation.adminUsers\",\n            resolver: () => async () => ({})\n        });\n\n        builder.addResolver({\n            path: \"AdminUser.roles\",\n            dependencies: [ListRolesUseCase],\n            resolver:\n                (listRoles: ListRolesUseCase.Interface) =>\n                async ({ parent }: { parent: AdminUser }) => {\n                    if (!parent.roles) {\n                        return null;\n                    }\n\n                    const result = await listRoles.execute({ where: { id_in: parent.roles } });\n                    if (result.isFail()) {\n                        throw result.error;\n                    }\n                    return result.value;\n                }\n        });\n\n        builder.addResolver({\n            path: \"AdminUser.teams\",\n            dependencies: [ListTeamsUseCase],\n            resolver:\n                (listTeams: ListTeamsUseCase.Interface) =>\n                async ({ parent }: { parent: AdminUser }) => {\n                    const hasTeams = Array.isArray(parent.teams) && parent.teams.length > 0;\n                    if (!hasTeams) {\n                        return [];\n                    }\n\n                    const result = await listTeams.execute({ where: { id_in: parent.teams } });\n                    if (result.isFail()) {\n                        throw result.error;\n                    }\n                    return result.value;\n                }\n        });\n\n        builder.addResolver<{ where: any }>({\n            path: \"AdminUsersQuery.getUser\",\n            dependencies: [GetUserUseCase],\n            resolver:\n                (getUser: GetUserUseCase.Interface) =>\n                async ({ args }) => {\n                    const { where } = args;\n                    const userResult = await getUser.execute({\n                        id: where.id,\n                        email: where.email\n                    });\n\n                    if (userResult.isFail()) {\n                        const error = userResult.error;\n                        if (error.code === \"AdminUser/NotFound\") {\n                            return new NotFoundResponse(\n                                `User \"${JSON.stringify(where)}\" was not found!`\n                            );\n                        }\n\n                        return new ErrorResponse({\n                            message: error.message,\n                            code: error.code,\n                            data: error.data\n                        });\n                    }\n\n                    return new Response(userResult.value);\n                }\n        });\n\n        builder.addResolver({\n            path: \"AdminUsersQuery.getCurrentUser\",\n            dependencies: [IdentityContext, GetUserUseCase],\n            resolver:\n                (identityContext: IdentityContext.Interface, getUser: GetUserUseCase.Interface) =>\n                async () => {\n                    const identity = identityContext.getIdentity();\n\n                    if (!identity.isAdmin()) {\n                        throw new NotAuthorizedResponse();\n                    }\n\n                    // Current user might not have permissions to execute `getUser` (this method can load any user in the system),\n                    // but loading your own user record should be allowed. For that reason, let's temporarily disable authorization.\n                    const userResponse = await identityContext.withoutAuthorization(async () => {\n                        // Get user record using the identity ID.\n                        return await getUser.execute({ id: identity.id });\n                    });\n\n                    if (userResponse.isFail()) {\n                        const error = userResponse.error;\n                        if (error.code === \"AdminUser/NotFound\") {\n                            return new NotFoundResponse(\n                                `User with ID ${identity.id} was not found!`\n                            );\n                        }\n\n                        return new ErrorResponse({\n                            message: error.message,\n                            code: error.code,\n                            data: error.data\n                        });\n                    }\n\n                    return new Response(userResponse.value);\n                }\n        });\n\n        builder.addResolver({\n            path: \"AdminUsersQuery.listUsers\",\n            dependencies: [ListUsersUseCase],\n            resolver: (listUsers: ListUsersUseCase.Interface) => async () => {\n                const users = await listUsers.execute();\n\n                if (users.isFail()) {\n                    return new ListErrorResponse(users.error);\n                }\n\n                return new ListResponse(users.value);\n            }\n        });\n\n        return builder;\n    }\n}\n\nexport const UsersSchemaFactory = CoreGraphQLSchemaFactory.createImplementation({\n    implementation: UsersSchemaFactoryImpl,\n    dependencies: []\n});\n"],"names":["UsersSchemaFactoryImpl","builder","ListRolesUseCase","listRoles","parent","result","ListTeamsUseCase","listTeams","hasTeams","Array","GetUserUseCase","getUser","args","where","userResult","error","NotFoundResponse","JSON","ErrorResponse","Response","IdentityContext","identityContext","identity","NotAuthorizedResponse","userResponse","ListUsersUseCase","listUsers","users","ListErrorResponse","ListResponse","UsersSchemaFactory","CoreGraphQLSchemaFactory"],"mappings":";;;;;;;;AAiBA,MAAMA;IACF,MAAM,QAAQC,OAA8B,EAAkC;QAC1EA,QAAQ,WAAW,CAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuEnC,CAAC;QAEDA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,UAAU,IAAM,UAAa,EAAC;QAClC;QAEAA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,UAAU,IAAM,UAAa,EAAC;QAClC;QAEAA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACC;aAAiB;YAChC,UACI,CAACC,YACD,OAAO,EAAEC,MAAM,EAAyB;oBACpC,IAAI,CAACA,OAAO,KAAK,EACb,OAAO;oBAGX,MAAMC,SAAS,MAAMF,UAAU,OAAO,CAAC;wBAAE,OAAO;4BAAE,OAAOC,OAAO,KAAK;wBAAC;oBAAE;oBACxE,IAAIC,OAAO,MAAM,IACb,MAAMA,OAAO,KAAK;oBAEtB,OAAOA,OAAO,KAAK;gBACvB;QACR;QAEAJ,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACK;aAAiB;YAChC,UACI,CAACC,YACD,OAAO,EAAEH,MAAM,EAAyB;oBACpC,MAAMI,WAAWC,MAAM,OAAO,CAACL,OAAO,KAAK,KAAKA,OAAO,KAAK,CAAC,MAAM,GAAG;oBACtE,IAAI,CAACI,UACD,OAAO,EAAE;oBAGb,MAAMH,SAAS,MAAME,UAAU,OAAO,CAAC;wBAAE,OAAO;4BAAE,OAAOH,OAAO,KAAK;wBAAC;oBAAE;oBACxE,IAAIC,OAAO,MAAM,IACb,MAAMA,OAAO,KAAK;oBAEtB,OAAOA,OAAO,KAAK;gBACvB;QACR;QAEAJ,QAAQ,WAAW,CAAiB;YAChC,MAAM;YACN,cAAc;gBAACS;aAAe;YAC9B,UACI,CAACC,UACD,OAAO,EAAEC,IAAI,EAAE;oBACX,MAAM,EAAEC,KAAK,EAAE,GAAGD;oBAClB,MAAME,aAAa,MAAMH,QAAQ,OAAO,CAAC;wBACrC,IAAIE,MAAM,EAAE;wBACZ,OAAOA,MAAM,KAAK;oBACtB;oBAEA,IAAIC,WAAW,MAAM,IAAI;wBACrB,MAAMC,QAAQD,WAAW,KAAK;wBAC9B,IAAIC,AAAe,yBAAfA,MAAM,IAAI,EACV,OAAO,IAAIC,iBACP,CAAC,MAAM,EAAEC,KAAK,SAAS,CAACJ,OAAO,gBAAgB,CAAC;wBAIxD,OAAO,IAAIK,cAAc;4BACrB,SAASH,MAAM,OAAO;4BACtB,MAAMA,MAAM,IAAI;4BAChB,MAAMA,MAAM,IAAI;wBACpB;oBACJ;oBAEA,OAAO,IAAII,SAASL,WAAW,KAAK;gBACxC;QACR;QAEAb,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACmB;gBAAiBV;aAAe;YAC/C,UACI,CAACW,iBAA4CV,UAC7C;oBACI,MAAMW,WAAWD,gBAAgB,WAAW;oBAE5C,IAAI,CAACC,SAAS,OAAO,IACjB,MAAM,IAAIC;oBAKd,MAAMC,eAAe,MAAMH,gBAAgB,oBAAoB,CAAC,UAErD,MAAMV,QAAQ,OAAO,CAAC;4BAAE,IAAIW,SAAS,EAAE;wBAAC;oBAGnD,IAAIE,aAAa,MAAM,IAAI;wBACvB,MAAMT,QAAQS,aAAa,KAAK;wBAChC,IAAIT,AAAe,yBAAfA,MAAM,IAAI,EACV,OAAO,IAAIC,iBACP,CAAC,aAAa,EAAEM,SAAS,EAAE,CAAC,eAAe,CAAC;wBAIpD,OAAO,IAAIJ,cAAc;4BACrB,SAASH,MAAM,OAAO;4BACtB,MAAMA,MAAM,IAAI;4BAChB,MAAMA,MAAM,IAAI;wBACpB;oBACJ;oBAEA,OAAO,IAAII,SAASK,aAAa,KAAK;gBAC1C;QACR;QAEAvB,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACwB;aAAiB;YAChC,UAAU,CAACC,YAA0C;oBACjD,MAAMC,QAAQ,MAAMD,UAAU,OAAO;oBAErC,IAAIC,MAAM,MAAM,IACZ,OAAO,IAAIC,kBAAkBD,MAAM,KAAK;oBAG5C,OAAO,IAAIE,aAAaF,MAAM,KAAK;gBACvC;QACJ;QAEA,OAAO1B;IACX;AACJ;AAEO,MAAM6B,qBAAqBC,yBAAyB,oBAAoB,CAAC;IAC5E,gBAAgB/B;IAChB,cAAc,EAAE;AACpB"}

package/graphql/wcp/WcpSchemaFactory.d.ts

@@ -0,0 +1,9 @@
+import { CoreGraphQLSchemaFactory } from "@webiny/api-graphql/graphql/abstractions.js";
+import type { IGraphQLSchemaBuilder } from "@webiny/api-graphql/features/GraphQLSchemaBuilder/abstractions.js";
+declare class WcpSchemaFactoryImpl implements CoreGraphQLSchemaFactory.Interface {
+    execute(builder: IGraphQLSchemaBuilder): Promise<IGraphQLSchemaBuilder>;
+}
+export declare const WcpSchemaFactory: typeof WcpSchemaFactoryImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("@webiny/api-graphql/graphql/abstractions.core").ICoreGraphQLSchemaFactory>;
+};
+export {};

package/graphql/wcp/WcpSchemaFactory.js

@@ -0,0 +1,95 @@
+import { CoreGraphQLSchemaFactory } from "@webiny/api-graphql/graphql/abstractions.js";
+import { ErrorResponse, Response } from "@webiny/api-graphql/responses.js";
+import { WcpContext } from "../../features/wcp/WcpContext/index.js";
+class WcpSchemaFactoryImpl {
+    async execute(builder) {
+        builder.addTypeDefs(`
+            type WcpProjectPackageFeaturesFeature {
+                enabled: Boolean
+                options: JSON
+            }
+
+            type WcpProjectPackageFeatures {
+                seats: WcpProjectPackageFeaturesFeature
+                multiTenancy: WcpProjectPackageFeaturesFeature
+                advancedPublishingWorkflow: WcpProjectPackageFeaturesFeature
+                advancedAccessControlLayer: WcpProjectPackageFeaturesFeature
+                auditLogs: WcpProjectPackageFeaturesFeature
+                recordLocking: WcpProjectPackageFeaturesFeature
+                fileManager: WcpProjectPackageFeaturesFeature
+                aiPowerups: WcpProjectPackageFeaturesFeature
+                abTesting: WcpProjectPackageFeaturesFeature
+            }
+
+            type WcpProjectPackage {
+                features: WcpProjectPackageFeatures
+            }
+
+            type WcpProject {
+                orgId: ID
+                projectId: ID
+                package: WcpProjectPackage
+            }
+
+            type WcpError {
+                code: String
+                message: String
+                data: JSON
+                stack: String
+            }
+
+            type WcpProjectResponse {
+                data: WcpProject
+                error: WcpError
+            }
+
+            type WcpQuery {
+                getProject: WcpProjectResponse
+            }
+
+            type WcpMutation {
+                updateProject: WcpProjectResponse
+            }
+
+            extend type Query {
+                wcp: WcpQuery
+            }
+
+            extend type Mutation {
+                wcp: WcpMutation
+            }
+        `);
+        builder.addResolver({
+            path: "Query.wcp",
+            resolver: ()=>async ()=>({})
+        });
+        builder.addResolver({
+            path: "WcpQuery.getProject",
+            dependencies: [
+                WcpContext
+            ],
+            resolver: (wcpContext)=>async ()=>{
+                    try {
+                        const project = wcpContext.getProjectWithFeatureFlags();
+                        if (!project) throw Error("Could not get project!");
+                        return new Response(project);
+                    } catch (e) {
+                        return new ErrorResponse({
+                            code: "COULD_NOT_GET_PROJECT",
+                            message: e.message,
+                            data: null,
+                            stack: e.stack
+                        });
+                    }
+                }
+        });
+        return builder;
+    }
+}
+const WcpSchemaFactory = CoreGraphQLSchemaFactory.createImplementation({
+    implementation: WcpSchemaFactoryImpl,
+    dependencies: []
+});
+export { WcpSchemaFactory };
+
+//# sourceMappingURL=WcpSchemaFactory.js.map

package/graphql/wcp/WcpSchemaFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql/wcp/WcpSchemaFactory.js","sources":["../../../src/graphql/wcp/WcpSchemaFactory.ts"],"sourcesContent":["import { CoreGraphQLSchemaFactory } from \"@webiny/api-graphql/graphql/abstractions.js\";\nimport type { IGraphQLSchemaBuilder } from \"@webiny/api-graphql/features/GraphQLSchemaBuilder/abstractions.js\";\nimport { ErrorResponse, Response } from \"@webiny/api-graphql/responses.js\";\nimport { WcpContext } from \"~/features/wcp/WcpContext/index.js\";\n\nclass WcpSchemaFactoryImpl implements CoreGraphQLSchemaFactory.Interface {\n    async execute(builder: IGraphQLSchemaBuilder): Promise<IGraphQLSchemaBuilder> {\n        builder.addTypeDefs(/* GraphQL */ `\n            type WcpProjectPackageFeaturesFeature {\n                enabled: Boolean\n                options: JSON\n            }\n\n            type WcpProjectPackageFeatures {\n                seats: WcpProjectPackageFeaturesFeature\n                multiTenancy: WcpProjectPackageFeaturesFeature\n                advancedPublishingWorkflow: WcpProjectPackageFeaturesFeature\n                advancedAccessControlLayer: WcpProjectPackageFeaturesFeature\n                auditLogs: WcpProjectPackageFeaturesFeature\n                recordLocking: WcpProjectPackageFeaturesFeature\n                fileManager: WcpProjectPackageFeaturesFeature\n                aiPowerups: WcpProjectPackageFeaturesFeature\n                abTesting: WcpProjectPackageFeaturesFeature\n            }\n\n            type WcpProjectPackage {\n                features: WcpProjectPackageFeatures\n            }\n\n            type WcpProject {\n                orgId: ID\n                projectId: ID\n                package: WcpProjectPackage\n            }\n\n            type WcpError {\n                code: String\n                message: String\n                data: JSON\n                stack: String\n            }\n\n            type WcpProjectResponse {\n                data: WcpProject\n                error: WcpError\n            }\n\n            type WcpQuery {\n                getProject: WcpProjectResponse\n            }\n\n            type WcpMutation {\n                updateProject: WcpProjectResponse\n            }\n\n            extend type Query {\n                wcp: WcpQuery\n            }\n\n            extend type Mutation {\n                wcp: WcpMutation\n            }\n        `);\n\n        builder.addResolver({\n            path: \"Query.wcp\",\n            resolver: () => async () => ({})\n        });\n\n        builder.addResolver({\n            path: \"WcpQuery.getProject\",\n            dependencies: [WcpContext],\n            resolver: (wcpContext: WcpContext.Interface) => async () => {\n                try {\n                    const project = wcpContext.getProjectWithFeatureFlags();\n\n                    if (!project) {\n                        throw Error(`Could not get project!`);\n                    }\n\n                    return new Response(project);\n                } catch (e) {\n                    return new ErrorResponse({\n                        code: \"COULD_NOT_GET_PROJECT\",\n                        message: e.message,\n                        data: null,\n                        stack: e.stack\n                    });\n                }\n            }\n        });\n\n        return builder;\n    }\n}\n\nexport const WcpSchemaFactory = CoreGraphQLSchemaFactory.createImplementation({\n    implementation: WcpSchemaFactoryImpl,\n    dependencies: []\n});\n"],"names":["WcpSchemaFactoryImpl","builder","WcpContext","wcpContext","project","Error","Response","e","ErrorResponse","WcpSchemaFactory","CoreGraphQLSchemaFactory"],"mappings":";;;AAKA,MAAMA;IACF,MAAM,QAAQC,OAA8B,EAAkC;QAC1EA,QAAQ,WAAW,CAAe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAuDnC,CAAC;QAEDA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,UAAU,IAAM,UAAa,EAAC;QAClC;QAEAA,QAAQ,WAAW,CAAC;YAChB,MAAM;YACN,cAAc;gBAACC;aAAW;YAC1B,UAAU,CAACC,aAAqC;oBAC5C,IAAI;wBACA,MAAMC,UAAUD,WAAW,0BAA0B;wBAErD,IAAI,CAACC,SACD,MAAMC,MAAM;wBAGhB,OAAO,IAAIC,SAASF;oBACxB,EAAE,OAAOG,GAAG;wBACR,OAAO,IAAIC,cAAc;4BACrB,MAAM;4BACN,SAASD,EAAE,OAAO;4BAClB,MAAM;4BACN,OAAOA,EAAE,KAAK;wBAClB;oBACJ;gBACJ;QACJ;QAEA,OAAON;IACX;AACJ;AAEO,MAAMQ,mBAAmBC,yBAAyB,oBAAoB,CAAC;IAC1E,gBAAgBV;IAChB,cAAc,EAAE;AACpB"}

package/idp/JwksCache.d.ts

@@ -0,0 +1,7 @@
+import type { Jwk } from "../features/security/utils/verifyJwtUsingJwk.js";
+import { JwkCache } from "./abstractions.js";
+export declare class JwksCache implements JwkCache.Interface {
+    private cache;
+    getKeys(issuer: string): Promise<Jwk[]>;
+    clearCache(): void;
+}

package/idp/JwksCache.js

@@ -0,0 +1,26 @@
+class JwksCache {
+    async getKeys(issuer) {
+        const cached = this.cache.get(issuer);
+        if (cached) return cached.jwks;
+        const openidUrl = new URL(issuer);
+        const pathname = openidUrl.pathname + "/.well-known/openid-configuration";
+        openidUrl.pathname = pathname.replace(/\/+/g, "/");
+        const oidcConfig = await fetch(openidUrl.toString()).then((res)=>res.json());
+        const jwksResponse = await fetch(oidcConfig.jwks_uri).then((res)=>res.json());
+        const jwks = jwksResponse.keys;
+        this.cache.set(issuer, {
+            oidcConfig,
+            jwks
+        });
+        return jwks;
+    }
+    clearCache() {
+        this.cache.clear();
+    }
+    constructor(){
+        this.cache = new Map();
+    }
+}
+export { JwksCache };
+
+//# sourceMappingURL=JwksCache.js.map

package/idp/JwksCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp/JwksCache.js","sources":["../../src/idp/JwksCache.ts"],"sourcesContent":["import type { Jwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport { JwkCache } from \"./abstractions.js\";\n\ninterface OidcConfiguration {\n    jwks_uri: string;\n    [key: string]: any;\n}\n\ninterface CacheEntry {\n    oidcConfig: OidcConfiguration;\n    jwks: Jwk[];\n}\n\nexport class JwksCache implements JwkCache.Interface {\n    private cache = new Map<string, CacheEntry>();\n\n    async getKeys(issuer: string): Promise<Jwk[]> {\n        // Check cache first\n        const cached = this.cache.get(issuer);\n        if (cached) {\n            return cached.jwks;\n        }\n\n        // Fetch OIDC configuration\n        const openidUrl = new URL(issuer);\n        const pathname = openidUrl.pathname + \"/.well-known/openid-configuration\";\n        openidUrl.pathname = pathname.replace(/\\/+/g, \"/\");\n\n        const oidcConfig = await fetch(openidUrl.toString()).then(\n            res => res.json() as Promise<OidcConfiguration>\n        );\n\n        // Fetch JWKs from jwks_uri\n        const jwksResponse = await fetch(oidcConfig.jwks_uri).then(res => res.json());\n        const jwks = jwksResponse.keys as Jwk[];\n\n        // Cache both config and JWKs\n        this.cache.set(issuer, {\n            oidcConfig,\n            jwks\n        });\n\n        return jwks;\n    }\n\n    clearCache(): void {\n        this.cache.clear();\n    }\n}\n"],"names":["JwksCache","issuer","cached","openidUrl","URL","pathname","oidcConfig","fetch","res","jwksResponse","jwks","Map"],"mappings":"AAaO,MAAMA;IAGT,MAAM,QAAQC,MAAc,EAAkB;QAE1C,MAAMC,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAACD;QAC9B,IAAIC,QACA,OAAOA,OAAO,IAAI;QAItB,MAAMC,YAAY,IAAIC,IAAIH;QAC1B,MAAMI,WAAWF,UAAU,QAAQ,GAAG;QACtCA,UAAU,QAAQ,GAAGE,SAAS,OAAO,CAAC,QAAQ;QAE9C,MAAMC,aAAa,MAAMC,MAAMJ,UAAU,QAAQ,IAAI,IAAI,CACrDK,CAAAA,MAAOA,IAAI,IAAI;QAInB,MAAMC,eAAe,MAAMF,MAAMD,WAAW,QAAQ,EAAE,IAAI,CAACE,CAAAA,MAAOA,IAAI,IAAI;QAC1E,MAAME,OAAOD,aAAa,IAAI;QAG9B,IAAI,CAAC,KAAK,CAAC,GAAG,CAACR,QAAQ;YACnBK;YACAI;QACJ;QAEA,OAAOA;IACX;IAEA,aAAmB;QACf,IAAI,CAAC,KAAK,CAAC,KAAK;IACpB;;aAjCQ,KAAK,GAAG,IAAIC;;AAkCxB"}

package/idp/JwtAuthenticator.d.ts

@@ -0,0 +1,12 @@
+import { Authenticator } from "../features/security/authentication/Authenticator/abstractions.js";
+import { JwtIdentityProvider } from "./abstractions.js";
+import type { IdentityData } from "../features/security/IdentityContext/Identity.js";
+declare class JwtAuthenticatorImpl implements Authenticator.Interface {
+    private providers;
+    constructor(providers: JwtIdentityProvider.Interface[]);
+    authenticate(token: string): Promise<IdentityData | null>;
+}
+export declare const JwtAuthenticator: typeof JwtAuthenticatorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("~/features/security/authentication/Authenticator/abstractions.js").IAuthenticator>;
+};
+export {};

package/idp/JwtAuthenticator.js

@@ -0,0 +1,46 @@
+import jsonwebtoken from "jsonwebtoken";
+import { Authenticator } from "../features/security/authentication/Authenticator/abstractions.js";
+import { JwtIdentityProvider } from "./abstractions.js";
+import { isJwt } from "../features/security/utils/isJwt.js";
+class JwtAuthenticatorImpl {
+    constructor(providers){
+        this.providers = providers;
+    }
+    async authenticate(token) {
+        if (!isJwt(token)) return null;
+        const decoded = jsonwebtoken.decode(token, {
+            complete: true
+        });
+        if (!decoded || "string" == typeof decoded) return null;
+        if ("string" == typeof decoded.payload) return null;
+        for (const provider of this.providers)if (provider.isApplicable(decoded.payload)) {
+            const identity = await provider.getIdentity(token, decoded);
+            if (identity) {
+                const isExternal = identity.profile?.external ?? true;
+                return {
+                    ...identity,
+                    type: identity.type ?? "admin",
+                    profile: {
+                        ...identity.profile ?? {},
+                        external: isExternal
+                    }
+                };
+            }
+        }
+        return null;
+    }
+}
+const JwtAuthenticator = Authenticator.createImplementation({
+    implementation: JwtAuthenticatorImpl,
+    dependencies: [
+        [
+            JwtIdentityProvider,
+            {
+                multiple: true
+            }
+        ]
+    ]
+});
+export { JwtAuthenticator };
+
+//# sourceMappingURL=JwtAuthenticator.js.map

package/idp/JwtAuthenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp/JwtAuthenticator.js","sources":["../../src/idp/JwtAuthenticator.ts"],"sourcesContent":["import jwt from \"jsonwebtoken\";\nimport { Authenticator } from \"~/features/security/authentication/Authenticator/abstractions.js\";\nimport { IdentityProvider, JwtIdentityProvider } from \"./abstractions.js\";\nimport { isJwt } from \"~/features/security/utils/isJwt.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\n\nclass JwtAuthenticatorImpl implements Authenticator.Interface {\n    constructor(private providers: JwtIdentityProvider.Interface[]) {}\n\n    async authenticate(token: string): Promise<IdentityData | null> {\n        if (!isJwt(token)) {\n            return null;\n        }\n\n        // Decode JWT to get payload\n        const decoded = jwt.decode(token, { complete: true });\n        if (!decoded || typeof decoded === \"string\") {\n            return null;\n        }\n\n        if (typeof decoded.payload === \"string\") {\n            return null;\n        }\n\n        // TODO: validate expiration claim and exit early if expired\n\n        for (const provider of this.providers) {\n            // Check if provider is applicable\n            if (provider.isApplicable(decoded.payload as IdentityProvider.JwtPayload)) {\n                // Use provider to get identity\n                const identity = await provider.getIdentity(\n                    token,\n                    decoded as JwtIdentityProvider.Jwt\n                );\n\n                if (identity) {\n                    // We treat all IDP identities as external by default.\n                    const isExternal = identity.profile?.external ?? true;\n                    return {\n                        ...identity,\n                        type: identity.type ?? \"admin\",\n                        profile: {\n                            ...(identity.profile ?? {}),\n                            external: isExternal\n                        }\n                    };\n                }\n            }\n        }\n\n        // No applicable provider found\n        return null;\n    }\n}\n\nexport const JwtAuthenticator = Authenticator.createImplementation({\n    implementation: JwtAuthenticatorImpl,\n    dependencies: [[JwtIdentityProvider, { multiple: true }]]\n});\n"],"names":["JwtAuthenticatorImpl","providers","token","isJwt","decoded","jwt","provider","identity","isExternal","JwtAuthenticator","Authenticator","JwtIdentityProvider"],"mappings":";;;;AAMA,MAAMA;IACF,YAAoBC,SAA0C,CAAE;aAA5CA,SAAS,GAATA;IAA6C;IAEjE,MAAM,aAAaC,KAAa,EAAgC;QAC5D,IAAI,CAACC,MAAMD,QACP,OAAO;QAIX,MAAME,UAAUC,aAAAA,MAAU,CAACH,OAAO;YAAE,UAAU;QAAK;QACnD,IAAI,CAACE,WAAW,AAAmB,YAAnB,OAAOA,SACnB,OAAO;QAGX,IAAI,AAA2B,YAA3B,OAAOA,QAAQ,OAAO,EACtB,OAAO;QAKX,KAAK,MAAME,YAAY,IAAI,CAAC,SAAS,CAEjC,IAAIA,SAAS,YAAY,CAACF,QAAQ,OAAO,GAAkC;YAEvE,MAAMG,WAAW,MAAMD,SAAS,WAAW,CACvCJ,OACAE;YAGJ,IAAIG,UAAU;gBAEV,MAAMC,aAAaD,SAAS,OAAO,EAAE,YAAY;gBACjD,OAAO;oBACH,GAAGA,QAAQ;oBACX,MAAMA,SAAS,IAAI,IAAI;oBACvB,SAAS;wBACL,GAAIA,SAAS,OAAO,IAAI,CAAC,CAAC;wBAC1B,UAAUC;oBACd;gBACJ;YACJ;QACJ;QAIJ,OAAO;IACX;AACJ;AAEO,MAAMC,mBAAmBC,cAAc,oBAAoB,CAAC;IAC/D,gBAAgBV;IAChB,cAAc;QAAC;YAACW;YAAqB;gBAAE,UAAU;YAAK;SAAE;KAAC;AAC7D"}

package/idp/OidcJwtIdentityProvider.d.ts

@@ -0,0 +1,15 @@
+import type { IdentityData } from "../features/security/IdentityContext/Identity.js";
+import { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";
+declare class OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {
+    private oidcIdentityProviders;
+    private jwksCache;
+    constructor(oidcIdentityProviders: OidcIdentityProvider.Interface[], jwksCache: JwkCache.Interface);
+    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean;
+    getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null>;
+    private getApplicableProvider;
+    private verifyToken;
+}
+export declare const OidcJwtIdentityProvider: typeof OidcJwtIdentityProviderImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IJwtIdentityProvider>;
+};
+export {};

package/idp/OidcJwtIdentityProvider.js

@@ -0,0 +1,63 @@
+import { verifyJwtUsingJwk } from "../features/security/utils/verifyJwtUsingJwk.js";
+import { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from "./abstractions.js";
+class OidcJwtIdentityProviderImpl {
+    constructor(oidcIdentityProviders, jwksCache){
+        this.oidcIdentityProviders = oidcIdentityProviders;
+        this.jwksCache = jwksCache;
+    }
+    isApplicable(token) {
+        return this.oidcIdentityProviders.some((provider)=>provider.isApplicable(token));
+    }
+    async getIdentity(token, jwt) {
+        const { header, payload } = jwt;
+        const provider = this.getApplicableProvider(payload);
+        if (!provider) return null;
+        const verifiedPayload = await this.verifyToken(provider, token, header);
+        if (!verifiedPayload) return null;
+        const providerIdentity = await provider.getIdentity(verifiedPayload);
+        const identity = {
+            ...providerIdentity,
+            type: providerIdentity.type ?? "admin"
+        };
+        const context = identity.context ?? {
+            canAccessTenant: true,
+            defaultTenantId: "root"
+        };
+        if (void 0 === context.canAccessTenant) context.canAccessTenant = true;
+        if (void 0 === context.defaultTenantId) context.defaultTenantId = "root";
+        identity.context = context;
+        return identity;
+    }
+    getApplicableProvider(payload) {
+        return this.oidcIdentityProviders.find((provider)=>provider.isApplicable(payload));
+    }
+    async verifyToken(provider, token, header) {
+        let verifiedPayload;
+        if ("function" == typeof provider.verifyToken) {
+            const result = await provider.verifyToken(token);
+            if (result) return result;
+            return null;
+        }
+        const jwks = await this.jwksCache.getKeys(provider.issuer);
+        const jwk = jwks.find((key)=>key.kid === header.kid);
+        if (!jwk) return null;
+        if (!verifiedPayload) verifiedPayload = await verifyJwtUsingJwk(token, jwk);
+        if (provider.verifyTokenClaims) await provider.verifyTokenClaims(verifiedPayload);
+        return verifiedPayload;
+    }
+}
+const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({
+    implementation: OidcJwtIdentityProviderImpl,
+    dependencies: [
+        [
+            OidcIdentityProvider,
+            {
+                multiple: true
+            }
+        ],
+        JwkCache
+    ]
+});
+export { OidcJwtIdentityProvider };
+
+//# sourceMappingURL=OidcJwtIdentityProvider.js.map

package/idp/OidcJwtIdentityProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp/OidcJwtIdentityProvider.js","sources":["../../src/idp/OidcJwtIdentityProvider.ts"],"sourcesContent":["import { verifyJwtUsingJwk } from \"~/features/security/utils/verifyJwtUsingJwk.js\";\nimport type { IdentityData } from \"~/features/security/IdentityContext/Identity.js\";\nimport { JwkCache, JwtIdentityProvider, OidcIdentityProvider } from \"./abstractions.js\";\n\nclass OidcJwtIdentityProviderImpl implements JwtIdentityProvider.Interface {\n    constructor(\n        private oidcIdentityProviders: OidcIdentityProvider.Interface[],\n        private jwksCache: JwkCache.Interface\n    ) {}\n\n    isApplicable(token: JwtIdentityProvider.JwtPayload): boolean {\n        return this.oidcIdentityProviders.some(provider => provider.isApplicable(token));\n    }\n\n    async getIdentity(token: string, jwt: JwtIdentityProvider.Jwt): Promise<IdentityData | null> {\n        const { header, payload } = jwt;\n\n        const provider = this.getApplicableProvider(payload);\n\n        if (!provider) {\n            return null;\n        }\n\n        const verifiedPayload = await this.verifyToken(provider, token, header);\n\n        if (!verifiedPayload) {\n            return null;\n        }\n\n        // Call config.getIdentity to get IdentityData\n        const providerIdentity = await provider.getIdentity(verifiedPayload);\n\n        const identity: IdentityData = {\n            ...providerIdentity,\n            type: providerIdentity.type ?? \"admin\"\n        };\n\n        // Handle default values\n        const context = identity.context ?? { canAccessTenant: true, defaultTenantId: \"root\" };\n        if (context.canAccessTenant === undefined) {\n            context.canAccessTenant = true;\n        }\n        if (context.defaultTenantId === undefined) {\n            context.defaultTenantId = \"root\";\n        }\n\n        identity.context = context;\n\n        return identity;\n    }\n\n    private getApplicableProvider(\n        payload: JwtIdentityProvider.JwtPayload\n    ): OidcIdentityProvider.Interface | undefined {\n        return this.oidcIdentityProviders.find(provider => provider.isApplicable(payload));\n    }\n\n    private async verifyToken(\n        provider: OidcIdentityProvider.Interface,\n        token: string,\n        header: JwtIdentityProvider.JwtHeader\n    ) {\n        // If the implementation specifies a custom verification function, use it.\n        let verifiedPayload: JwtIdentityProvider.JwtPayload | undefined;\n        if (typeof provider.verifyToken === \"function\") {\n            // Use custom verification\n            const result = await provider.verifyToken(token);\n            if (result) {\n                return result;\n            }\n            return null;\n        }\n\n        // Otherwise, continue with OIDC best practices, using JWKs.\n\n        // Fetch JWKs from cache\n        const jwks = await this.jwksCache.getKeys(provider.issuer);\n\n        // Find matching JWK using header.kid\n        const jwk = jwks.find(key => key.kid === header.kid);\n        if (!jwk) {\n            return null;\n        }\n\n        if (!verifiedPayload) {\n            // Default JWK verification\n            verifiedPayload = await verifyJwtUsingJwk(token, jwk);\n        }\n\n        // Call verifyTokenClaims if provided\n        if (provider.verifyTokenClaims) {\n            await provider.verifyTokenClaims(verifiedPayload);\n        }\n\n        return verifiedPayload;\n    }\n}\n\nexport const OidcJwtIdentityProvider = JwtIdentityProvider.createImplementation({\n    implementation: OidcJwtIdentityProviderImpl,\n    dependencies: [[OidcIdentityProvider, { multiple: true }], JwkCache]\n});\n"],"names":["OidcJwtIdentityProviderImpl","oidcIdentityProviders","jwksCache","token","provider","jwt","header","payload","verifiedPayload","providerIdentity","identity","context","undefined","result","jwks","jwk","key","verifyJwtUsingJwk","OidcJwtIdentityProvider","JwtIdentityProvider","OidcIdentityProvider","JwkCache"],"mappings":";;AAIA,MAAMA;IACF,YACYC,qBAAuD,EACvDC,SAA6B,CACvC;aAFUD,qBAAqB,GAArBA;aACAC,SAAS,GAATA;IACT;IAEH,aAAaC,KAAqC,EAAW;QACzD,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACC,CAAAA,WAAYA,SAAS,YAAY,CAACD;IAC7E;IAEA,MAAM,YAAYA,KAAa,EAAEE,GAA4B,EAAgC;QACzF,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGF;QAE5B,MAAMD,WAAW,IAAI,CAAC,qBAAqB,CAACG;QAE5C,IAAI,CAACH,UACD,OAAO;QAGX,MAAMI,kBAAkB,MAAM,IAAI,CAAC,WAAW,CAACJ,UAAUD,OAAOG;QAEhE,IAAI,CAACE,iBACD,OAAO;QAIX,MAAMC,mBAAmB,MAAML,SAAS,WAAW,CAACI;QAEpD,MAAME,WAAyB;YAC3B,GAAGD,gBAAgB;YACnB,MAAMA,iBAAiB,IAAI,IAAI;QACnC;QAGA,MAAME,UAAUD,SAAS,OAAO,IAAI;YAAE,iBAAiB;YAAM,iBAAiB;QAAO;QACrF,IAAIC,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAE9B,IAAIA,AAA4BC,WAA5BD,QAAQ,eAAe,EACvBA,QAAQ,eAAe,GAAG;QAG9BD,SAAS,OAAO,GAAGC;QAEnB,OAAOD;IACX;IAEQ,sBACJH,OAAuC,EACG;QAC1C,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAACH,CAAAA,WAAYA,SAAS,YAAY,CAACG;IAC7E;IAEA,MAAc,YACVH,QAAwC,EACxCD,KAAa,EACbG,MAAqC,EACvC;QAEE,IAAIE;QACJ,IAAI,AAAgC,cAAhC,OAAOJ,SAAS,WAAW,EAAiB;YAE5C,MAAMS,SAAS,MAAMT,SAAS,WAAW,CAACD;YAC1C,IAAIU,QACA,OAAOA;YAEX,OAAO;QACX;QAKA,MAAMC,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAACV,SAAS,MAAM;QAGzD,MAAMW,MAAMD,KAAK,IAAI,CAACE,CAAAA,MAAOA,IAAI,GAAG,KAAKV,OAAO,GAAG;QACnD,IAAI,CAACS,KACD,OAAO;QAGX,IAAI,CAACP,iBAEDA,kBAAkB,MAAMS,kBAAkBd,OAAOY;QAIrD,IAAIX,SAAS,iBAAiB,EAC1B,MAAMA,SAAS,iBAAiB,CAACI;QAGrC,OAAOA;IACX;AACJ;AAEO,MAAMU,0BAA0BC,oBAAoB,oBAAoB,CAAC;IAC5E,gBAAgBnB;IAChB,cAAc;QAAC;YAACoB;YAAsB;gBAAE,UAAU;YAAK;SAAE;QAAEC;KAAS;AACxE"}

package/idp/abstractions.d.ts

@@ -0,0 +1,66 @@
+import type { JwtPayload as IJwtPayload, JwtHeader as IJwtHeader } from "jsonwebtoken";
+import type { IdentityData as IIdentityData } from "../features/security/IdentityContext/Identity.js";
+import type { Jwk as IJwk } from "../features/security/utils/verifyJwtUsingJwk.js";
+export type IJwt = {
+    header: IJwtHeader;
+    payload: IJwtPayload;
+};
+export type OptionalExternal<T> = Omit<T, "external"> & {
+    external?: boolean;
+};
+export type IProviderIdentityData = Omit<IIdentityData, "type" | "profile"> & {
+    /**
+     * Defaults to `admin` it omitted.
+     */
+    type?: string;
+    profile?: OptionalExternal<NonNullable<IIdentityData["profile"]>>;
+};
+export interface IIdentityProvider {
+    isApplicable(token: string): boolean;
+    getIdentity(token: string): Promise<IProviderIdentityData | null>;
+}
+/** Generic identity provider for token-based authentication. */
+export declare const IdentityProvider: import("@webiny/di").Abstraction<IIdentityProvider>;
+export declare namespace IdentityProvider {
+    type Interface = IIdentityProvider;
+    type IdentityData = IProviderIdentityData;
+    type JwtPayload = IJwtPayload;
+}
+export interface IJwtIdentityProvider {
+    isApplicable(token: IJwtPayload): boolean;
+    getIdentity(token: string, jwt: IJwt): Promise<IProviderIdentityData | null>;
+}
+/** JWT-specific identity provider for token validation. */
+export declare const JwtIdentityProvider: import("@webiny/di").Abstraction<IJwtIdentityProvider>;
+export declare namespace JwtIdentityProvider {
+    type Interface = IJwtIdentityProvider;
+    type Jwt = IJwt;
+    type JwtPayload = IJwtPayload;
+    type JwtHeader = IJwtHeader;
+    type IdentityData = IProviderIdentityData;
+}
+export interface IOidcIdentityProvider {
+    issuer: string;
+    clientId: string;
+    isApplicable(token: IJwtPayload): boolean;
+    getIdentity(jwt: IJwtPayload): Promise<IProviderIdentityData>;
+    verifyToken?(token: string): Promise<IJwtPayload | undefined>;
+    verifyTokenClaims?(token: IJwtPayload): Promise<void>;
+}
+/** OIDC-compliant identity provider with issuer validation. */
+export declare const OidcIdentityProvider: import("@webiny/di").Abstraction<IOidcIdentityProvider>;
+export declare namespace OidcIdentityProvider {
+    type Interface = IOidcIdentityProvider;
+    type JwtPayload = IJwtPayload;
+    type IdentityData = IProviderIdentityData;
+}
+interface IJwkCache {
+    getKeys(issuer: string): Promise<IJwk[]>;
+}
+/** Cache for JSON Web Keys used in JWT verification. */
+export declare const JwkCache: import("@webiny/di").Abstraction<IJwkCache>;
+export declare namespace JwkCache {
+    type Interface = IJwkCache;
+    type Jwk = IJwk;
+}
+export {};

package/idp/abstractions.js

@@ -0,0 +1,8 @@
+import { createAbstraction } from "@webiny/feature/api";
+const IdentityProvider = createAbstraction("IdentityProvider");
+const JwtIdentityProvider = createAbstraction("JwtIdentityProvider");
+const OidcIdentityProvider = createAbstraction("OidcIdentityProvider");
+const JwkCache = createAbstraction("JwkCache");
+export { IdentityProvider, JwkCache, JwtIdentityProvider, OidcIdentityProvider };
+
+//# sourceMappingURL=abstractions.js.map