@webiny/app-admin 6.5.0 → 6.5.1-beta.1

package/features/security/LogIn/LogInUseCase.test.js

@@ -0,0 +1,321 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { Container } from "@webiny/di";
+import { MainGraphQLClient } from "@webiny/app/features/mainGraphQLClient/index.js";
+import { LocalStorage } from "@webiny/app/features/localStorage/index.js";
+import { LogInFeature } from "./feature.js";
+import { AuthenticationContextFeature } from "../AuthenticationContext/feature.js";
+import { IdentityContextFeature } from "../IdentityContext/feature.js";
+import { TenancyFeature } from "../../tenancy/feature.js";
+const createLocalStorage = (initial = {})=>{
+    const values = new Map(Object.entries(initial));
+    return {
+        get: (key)=>values.get(key),
+        set: (key, value)=>{
+            values.set(key, value);
+        },
+        remove: (key)=>{
+            values.delete(key);
+        },
+        clear: ()=>values.clear(),
+        keys: ()=>Array.from(values.keys())
+    };
+};
+const identityDto = {
+    __typename: "SecurityIdentity",
+    id: "user-1",
+    type: "admin",
+    displayName: "User 1",
+    roles: [],
+    teams: [],
+    permissions: [
+        {
+            name: "*"
+        }
+    ],
+    profile: {
+        firstName: "",
+        lastName: "",
+        email: "user-1@webiny.local"
+    },
+    currentTenant: {
+        id: "acme",
+        name: "Acme"
+    },
+    defaultTenant: {
+        id: "root",
+        name: "Root"
+    }
+};
+const loginResponse = (login)=>({
+        security: {
+            login: {
+                data: login.data ?? null,
+                error: login.error ?? null
+            }
+        }
+    });
+const tenantSelectionRequired = (tenants)=>loginResponse({
+        data: {
+            __typename: "SecurityLoginTenantSelection",
+            tenants
+        }
+    });
+describe("LogIn feature: tenant resolution", ()=>{
+    let container;
+    let execute;
+    let storage;
+    const setup = (storedTenant)=>{
+        container = new Container();
+        storage = createLocalStorage(storedTenant ? {
+            tenantId: storedTenant
+        } : {});
+        execute = vi.fn();
+        container.registerInstance(LocalStorage, storage);
+        container.registerInstance(MainGraphQLClient, {
+            execute
+        });
+        TenancyFeature.register(container);
+        AuthenticationContextFeature.register(container);
+        IdentityContextFeature.register(container);
+        LogInFeature.register(container);
+    };
+    const login = ()=>{
+        const { useCase } = LogInFeature.resolve(container);
+        return useCase.execute({
+            idTokenProvider: async ()=>"token"
+        });
+    };
+    const currentTenant = ()=>TenancyFeature.resolve(container).service.getCurrentTenant();
+    beforeEach(()=>{
+        setup();
+    });
+    it("logs in on the current tenant when the user has access to it", async ()=>{
+        setup("acme");
+        execute.mockResolvedValue(loginResponse({
+            data: identityDto
+        }));
+        const result = await login();
+        expect(result).toEqual({
+            type: "loggedIn"
+        });
+        expect(currentTenant()).toBe("acme");
+        expect(execute).toHaveBeenCalledTimes(1);
+    });
+    it("offers tenant switching only to a user with more than one tenant", async ()=>{
+        const identity = ()=>IdentityContextFeature.resolve(container).identityContext.getIdentity();
+        const tenants = [
+            {
+                id: "acme",
+                name: "Acme"
+            },
+            {
+                id: "beta",
+                name: "Beta"
+            }
+        ];
+        setup("acme");
+        execute.mockResolvedValue(loginResponse({
+            data: {
+                ...identityDto,
+                tenants
+            }
+        }));
+        await login();
+        expect(identity().tenants).toEqual(tenants);
+        expect(identity().canSwitchTenant).toBe(true);
+        setup("acme");
+        execute.mockResolvedValue(loginResponse({
+            data: {
+                ...identityDto,
+                tenants: [
+                    tenants[0]
+                ]
+            }
+        }));
+        await login();
+        expect(identity().canSwitchTenant).toBe(false);
+        setup("acme");
+        execute.mockResolvedValue(loginResponse({
+            data: identityDto
+        }));
+        await login();
+        expect(identity().tenants).toEqual([]);
+        expect(identity().canSwitchTenant).toBe(false);
+        setup("root");
+        execute.mockResolvedValue(loginResponse({
+            data: {
+                ...identityDto,
+                tenants: [
+                    {
+                        id: "root",
+                        name: "Root"
+                    },
+                    ...tenants
+                ]
+            }
+        }));
+        await login();
+        expect(identity().canSwitchTenant).toBe(false);
+    });
+    it("sends a root user to root instead of the tenant picker", async ()=>{
+        setup("deep");
+        execute.mockResolvedValue(tenantSelectionRequired([
+            {
+                id: "acme",
+                name: "Acme"
+            },
+            {
+                id: "root",
+                name: "Root"
+            }
+        ]));
+        const result = await login();
+        expect(result).toEqual({
+            type: "switchingTenant",
+            tenantId: "root"
+        });
+        expect(currentTenant()).toBe("root");
+    });
+    it("switches to the only tenant the user can access, and remembers it", async ()=>{
+        const onChange = vi.fn();
+        TenancyFeature.resolve(container).service.onTenantChange(onChange);
+        execute.mockResolvedValue(tenantSelectionRequired([
+            {
+                id: "acme",
+                name: "Acme"
+            }
+        ]));
+        const result = await login();
+        expect(result).toEqual({
+            type: "switchingTenant",
+            tenantId: "acme"
+        });
+        expect(currentTenant()).toBe("acme");
+        expect(storage.get("tenantId")).toBe("acme");
+        expect(onChange).toHaveBeenCalledWith("acme");
+    });
+    it("asks the user to pick when they can access several tenants", async ()=>{
+        const tenants = [
+            {
+                id: "acme",
+                name: "Acme"
+            },
+            {
+                id: "beta",
+                name: "Beta"
+            }
+        ];
+        execute.mockResolvedValue(tenantSelectionRequired(tenants));
+        const result = await login();
+        expect(result).toEqual({
+            type: "selectTenant",
+            tenants
+        });
+        expect(currentTenant()).toBe("root");
+    });
+    it("reports no access when the user has no tenant", async ()=>{
+        execute.mockResolvedValue(tenantSelectionRequired([]));
+        expect(await login()).toEqual({
+            type: "noTenantAccess"
+        });
+        execute.mockResolvedValue(loginResponse({
+            error: {
+                code: "Security/Identity/NotAuthorized",
+                message: "Missing user profile!"
+            }
+        }));
+        expect(await login()).toEqual({
+            type: "noTenantAccess"
+        });
+        expect(currentTenant()).toBe("root");
+    });
+    it("sends a user from a `?tenantId` they can't access to their own tenant", async ()=>{
+        setup("beta");
+        execute.mockResolvedValue(tenantSelectionRequired([
+            {
+                id: "acme",
+                name: "Acme"
+            }
+        ]));
+        const result = await login();
+        expect(result).toEqual({
+            type: "switchingTenant",
+            tenantId: "acme"
+        });
+        expect(currentTenant()).toBe("acme");
+    });
+    it("throws instead of switching to the tenant it's already on", async ()=>{
+        setup("acme");
+        const onChange = vi.fn();
+        TenancyFeature.resolve(container).service.onTenantChange(onChange);
+        execute.mockResolvedValue(tenantSelectionRequired([
+            {
+                id: "acme",
+                name: "Acme"
+            }
+        ]));
+        await expect(login()).rejects.toMatchObject({
+            code: "Security/Identity/TenantSelectionFailed"
+        });
+        expect(onChange).not.toHaveBeenCalled();
+    });
+    it.each([
+        [
+            "deleted",
+            {
+                message: "Unable to load tenant!",
+                code: "Tenancy/TenantNotFound"
+            }
+        ],
+        [
+            "disabled",
+            {
+                message: "Tenant is disabled!",
+                code: "Tenancy/TenantDisabled"
+            }
+        ]
+    ])("retries through root when the stored tenant is %s", async (_, requestError)=>{
+        setup("old-tenant");
+        execute.mockRejectedValue(requestError);
+        const result = await login();
+        expect(result).toEqual({
+            type: "switchingTenant",
+            tenantId: "root"
+        });
+        expect(currentTenant()).toBe("root");
+    });
+    it("doesn't loop when root itself can't be loaded", async ()=>{
+        setup("root");
+        execute.mockRejectedValue({
+            message: "Tenant is disabled!",
+            code: "Tenancy/TenantDisabled"
+        });
+        await expect(login()).rejects.toMatchObject({
+            code: "Tenancy/TenantDisabled"
+        });
+        expect(currentTenant()).toBe("root");
+    });
+    it("throws errors that aren't about the tenant, with their message", async ()=>{
+        execute.mockResolvedValue(loginResponse({
+            error: {
+                code: "SOMETHING",
+                message: "Something broke."
+            }
+        }));
+        await expect(login()).rejects.toMatchObject({
+            code: "SOMETHING",
+            message: "Something broke."
+        });
+    });
+    it("throws when the user has no permissions on the tenant", async ()=>{
+        execute.mockResolvedValue(loginResponse({
+            data: {
+                ...identityDto,
+                permissions: []
+            }
+        }));
+        await expect(login()).rejects.toThrow("You have no permissions on this tenant!");
+    });
+});
+
+//# sourceMappingURL=LogInUseCase.test.js.map

package/features/security/LogIn/LogInUseCase.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/LogIn/LogInUseCase.test.js","sources":["../../../../src/features/security/LogIn/LogInUseCase.test.ts"],"sourcesContent":["import { describe, it, expect, vi, beforeEach } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { MainGraphQLClient } from \"@webiny/app/features/mainGraphQLClient/index.js\";\nimport { LocalStorage } from \"@webiny/app/features/localStorage/index.js\";\nimport { LogInFeature } from \"./feature.js\";\nimport { AuthenticationContextFeature } from \"~/features/security/AuthenticationContext/feature.js\";\nimport { IdentityContextFeature } from \"~/features/security/IdentityContext/feature.js\";\nimport { TenancyFeature } from \"~/features/tenancy/feature.js\";\n\nconst createLocalStorage = (initial: Record<string, any> = {}): LocalStorage.Interface => {\n    const values = new Map<string, any>(Object.entries(initial));\n    return {\n        get: key => values.get(key),\n        set: (key, value) => {\n            values.set(key, value);\n        },\n        remove: key => {\n            values.delete(key);\n        },\n        clear: () => values.clear(),\n        keys: () => Array.from(values.keys())\n    };\n};\n\nconst identityDto = {\n    __typename: \"SecurityIdentity\",\n    id: \"user-1\",\n    type: \"admin\",\n    displayName: \"User 1\",\n    roles: [],\n    teams: [],\n    permissions: [{ name: \"*\" }],\n    profile: { firstName: \"\", lastName: \"\", email: \"user-1@webiny.local\" },\n    currentTenant: { id: \"acme\", name: \"Acme\" },\n    defaultTenant: { id: \"root\", name: \"Root\" }\n};\n\nconst loginResponse = (login: { data?: any; error?: any }) => {\n    return { security: { login: { data: login.data ?? null, error: login.error ?? null } } };\n};\n\nconst tenantSelectionRequired = (tenants: { id: string; name: string }[]) => {\n    return loginResponse({ data: { __typename: \"SecurityLoginTenantSelection\", tenants } });\n};\n\ndescribe(\"LogIn feature: tenant resolution\", () => {\n    let container: Container;\n    let execute: ReturnType<typeof vi.fn>;\n    let storage: LocalStorage.Interface;\n\n    const setup = (storedTenant?: string) => {\n        container = new Container();\n        storage = createLocalStorage(storedTenant ? { tenantId: storedTenant } : {});\n        execute = vi.fn();\n\n        container.registerInstance(LocalStorage, storage);\n        container.registerInstance(MainGraphQLClient, {\n            execute\n        } as unknown as MainGraphQLClient.Interface);\n\n        TenancyFeature.register(container);\n        AuthenticationContextFeature.register(container);\n        IdentityContextFeature.register(container);\n        LogInFeature.register(container);\n    };\n\n    const login = () => {\n        const { useCase } = LogInFeature.resolve(container);\n        return useCase.execute({ idTokenProvider: async () => \"token\" });\n    };\n\n    const currentTenant = () => TenancyFeature.resolve(container).service.getCurrentTenant();\n\n    beforeEach(() => {\n        setup();\n    });\n\n    it(\"logs in on the current tenant when the user has access to it\", async () => {\n        setup(\"acme\");\n        execute.mockResolvedValue(loginResponse({ data: identityDto }));\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"loggedIn\" });\n        expect(currentTenant()).toBe(\"acme\");\n        expect(execute).toHaveBeenCalledTimes(1);\n    });\n\n    it(\"offers tenant switching only to a user with more than one tenant\", async () => {\n        const identity = () =>\n            IdentityContextFeature.resolve(container).identityContext.getIdentity();\n        const tenants = [\n            { id: \"acme\", name: \"Acme\" },\n            { id: \"beta\", name: \"Beta\" }\n        ];\n\n        setup(\"acme\");\n        execute.mockResolvedValue(loginResponse({ data: { ...identityDto, tenants } }));\n        await login();\n        expect(identity().tenants).toEqual(tenants);\n        expect(identity().canSwitchTenant).toBe(true);\n\n        setup(\"acme\");\n        execute.mockResolvedValue(\n            loginResponse({ data: { ...identityDto, tenants: [tenants[0]] } })\n        );\n        await login();\n        expect(identity().canSwitchTenant).toBe(false);\n\n        // An API without the tenant list (before this change) offers no switching.\n        setup(\"acme\");\n        execute.mockResolvedValue(loginResponse({ data: identityDto }));\n        await login();\n        expect(identity().tenants).toEqual([]);\n        expect(identity().canSwitchTenant).toBe(false);\n\n        // Root users open tenants through Tenant Manager, even when they have records in several.\n        setup(\"root\");\n        execute.mockResolvedValue(\n            loginResponse({\n                data: { ...identityDto, tenants: [{ id: \"root\", name: \"Root\" }, ...tenants] }\n            })\n        );\n        await login();\n        expect(identity().canSwitchTenant).toBe(false);\n    });\n\n    it(\"sends a root user to root instead of the tenant picker\", async () => {\n        // A tenant below a child of root: the parent lookup doesn't reach the root record.\n        setup(\"deep\");\n        execute.mockResolvedValue(\n            tenantSelectionRequired([\n                { id: \"acme\", name: \"Acme\" },\n                { id: \"root\", name: \"Root\" }\n            ])\n        );\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"switchingTenant\", tenantId: \"root\" });\n        expect(currentTenant()).toBe(\"root\");\n    });\n\n    it(\"switches to the only tenant the user can access, and remembers it\", async () => {\n        const onChange = vi.fn();\n        TenancyFeature.resolve(container).service.onTenantChange(onChange);\n        execute.mockResolvedValue(tenantSelectionRequired([{ id: \"acme\", name: \"Acme\" }]));\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"switchingTenant\", tenantId: \"acme\" });\n        expect(currentTenant()).toBe(\"acme\");\n        expect(storage.get(\"tenantId\")).toBe(\"acme\");\n        // The tenancy provider reloads the app on this change.\n        expect(onChange).toHaveBeenCalledWith(\"acme\");\n    });\n\n    it(\"asks the user to pick when they can access several tenants\", async () => {\n        const tenants = [\n            { id: \"acme\", name: \"Acme\" },\n            { id: \"beta\", name: \"Beta\" }\n        ];\n        execute.mockResolvedValue(tenantSelectionRequired(tenants));\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"selectTenant\", tenants });\n        expect(currentTenant()).toBe(\"root\");\n    });\n\n    it(\"reports no access when the user has no tenant\", async () => {\n        execute.mockResolvedValue(tenantSelectionRequired([]));\n        expect(await login()).toEqual({ type: \"noTenantAccess\" });\n\n        execute.mockResolvedValue(\n            loginResponse({\n                error: { code: \"Security/Identity/NotAuthorized\", message: \"Missing user profile!\" }\n            })\n        );\n        expect(await login()).toEqual({ type: \"noTenantAccess\" });\n        expect(currentTenant()).toBe(\"root\");\n    });\n\n    it(\"sends a user from a `?tenantId` they can't access to their own tenant\", async () => {\n        // The tenancy provider has already stored the `?tenantId` tenant.\n        setup(\"beta\");\n        execute.mockResolvedValue(tenantSelectionRequired([{ id: \"acme\", name: \"Acme\" }]));\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"switchingTenant\", tenantId: \"acme\" });\n        expect(currentTenant()).toBe(\"acme\");\n    });\n\n    it(\"throws instead of switching to the tenant it's already on\", async () => {\n        setup(\"acme\");\n        const onChange = vi.fn();\n        TenancyFeature.resolve(container).service.onTenantChange(onChange);\n        execute.mockResolvedValue(tenantSelectionRequired([{ id: \"acme\", name: \"Acme\" }]));\n\n        await expect(login()).rejects.toMatchObject({\n            code: \"Security/Identity/TenantSelectionFailed\"\n        });\n        expect(onChange).not.toHaveBeenCalled();\n    });\n\n    it.each([\n        [\"deleted\", { message: \"Unable to load tenant!\", code: \"Tenancy/TenantNotFound\" }],\n        [\"disabled\", { message: \"Tenant is disabled!\", code: \"Tenancy/TenantDisabled\" }]\n    ])(\"retries through root when the stored tenant is %s\", async (_, requestError) => {\n        setup(\"old-tenant\");\n        execute.mockRejectedValue(requestError);\n\n        const result = await login();\n\n        expect(result).toEqual({ type: \"switchingTenant\", tenantId: \"root\" });\n        expect(currentTenant()).toBe(\"root\");\n    });\n\n    it(\"doesn't loop when root itself can't be loaded\", async () => {\n        setup(\"root\");\n        execute.mockRejectedValue({\n            message: \"Tenant is disabled!\",\n            code: \"Tenancy/TenantDisabled\"\n        });\n\n        await expect(login()).rejects.toMatchObject({ code: \"Tenancy/TenantDisabled\" });\n        expect(currentTenant()).toBe(\"root\");\n    });\n\n    it(\"throws errors that aren't about the tenant, with their message\", async () => {\n        execute.mockResolvedValue(\n            loginResponse({ error: { code: \"SOMETHING\", message: \"Something broke.\" } })\n        );\n\n        await expect(login()).rejects.toMatchObject({\n            code: \"SOMETHING\",\n            message: \"Something broke.\"\n        });\n    });\n\n    it(\"throws when the user has no permissions on the tenant\", async () => {\n        execute.mockResolvedValue(loginResponse({ data: { ...identityDto, permissions: [] } }));\n\n        await expect(login()).rejects.toThrow(\"You have no permissions on this tenant!\");\n    });\n});\n"],"names":["createLocalStorage","initial","values","Map","Object","key","value","Array","identityDto","loginResponse","login","tenantSelectionRequired","tenants","describe","container","execute","storage","setup","storedTenant","Container","vi","LocalStorage","MainGraphQLClient","TenancyFeature","AuthenticationContextFeature","IdentityContextFeature","LogInFeature","useCase","currentTenant","beforeEach","it","result","expect","identity","onChange","_","requestError"],"mappings":";;;;;;;;AASA,MAAMA,qBAAqB,CAACC,UAA+B,CAAC,CAAC;IACzD,MAAMC,SAAS,IAAIC,IAAiBC,OAAO,OAAO,CAACH;IACnD,OAAO;QACH,KAAKI,CAAAA,MAAOH,OAAO,GAAG,CAACG;QACvB,KAAK,CAACA,KAAKC;YACPJ,OAAO,GAAG,CAACG,KAAKC;QACpB;QACA,QAAQD,CAAAA;YACJH,OAAO,MAAM,CAACG;QAClB;QACA,OAAO,IAAMH,OAAO,KAAK;QACzB,MAAM,IAAMK,MAAM,IAAI,CAACL,OAAO,IAAI;IACtC;AACJ;AAEA,MAAMM,cAAc;IAChB,YAAY;IACZ,IAAI;IACJ,MAAM;IACN,aAAa;IACb,OAAO,EAAE;IACT,OAAO,EAAE;IACT,aAAa;QAAC;YAAE,MAAM;QAAI;KAAE;IAC5B,SAAS;QAAE,WAAW;QAAI,UAAU;QAAI,OAAO;IAAsB;IACrE,eAAe;QAAE,IAAI;QAAQ,MAAM;IAAO;IAC1C,eAAe;QAAE,IAAI;QAAQ,MAAM;IAAO;AAC9C;AAEA,MAAMC,gBAAgB,CAACC,QACZ;QAAE,UAAU;YAAE,OAAO;gBAAE,MAAMA,MAAM,IAAI,IAAI;gBAAM,OAAOA,MAAM,KAAK,IAAI;YAAK;QAAE;IAAE;AAG3F,MAAMC,0BAA0B,CAACC,UACtBH,cAAc;QAAE,MAAM;YAAE,YAAY;YAAgCG;QAAQ;IAAE;AAGzFC,SAAS,oCAAoC;IACzC,IAAIC;IACJ,IAAIC;IACJ,IAAIC;IAEJ,MAAMC,QAAQ,CAACC;QACXJ,YAAY,IAAIK;QAChBH,UAAUhB,mBAAmBkB,eAAe;YAAE,UAAUA;QAAa,IAAI,CAAC;QAC1EH,UAAUK,GAAG,EAAE;QAEfN,UAAU,gBAAgB,CAACO,cAAcL;QACzCF,UAAU,gBAAgB,CAACQ,mBAAmB;YAC1CP;QACJ;QAEAQ,eAAe,QAAQ,CAACT;QACxBU,6BAA6B,QAAQ,CAACV;QACtCW,uBAAuB,QAAQ,CAACX;QAChCY,aAAa,QAAQ,CAACZ;IAC1B;IAEA,MAAMJ,QAAQ;QACV,MAAM,EAAEiB,OAAO,EAAE,GAAGD,aAAa,OAAO,CAACZ;QACzC,OAAOa,QAAQ,OAAO,CAAC;YAAE,iBAAiB,UAAY;QAAQ;IAClE;IAEA,MAAMC,gBAAgB,IAAML,eAAe,OAAO,CAACT,WAAW,OAAO,CAAC,gBAAgB;IAEtFe,WAAW;QACPZ;IACJ;IAEAa,GAAG,gEAAgE;QAC/Db,MAAM;QACNF,QAAQ,iBAAiB,CAACN,cAAc;YAAE,MAAMD;QAAY;QAE5D,MAAMuB,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;QAAW;QAC1CC,OAAOJ,iBAAiB,IAAI,CAAC;QAC7BI,OAAOjB,SAAS,qBAAqB,CAAC;IAC1C;IAEAe,GAAG,oEAAoE;QACnE,MAAMG,WAAW,IACbR,uBAAuB,OAAO,CAACX,WAAW,eAAe,CAAC,WAAW;QACzE,MAAMF,UAAU;YACZ;gBAAE,IAAI;gBAAQ,MAAM;YAAO;YAC3B;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAC9B;QAEDK,MAAM;QACNF,QAAQ,iBAAiB,CAACN,cAAc;YAAE,MAAM;gBAAE,GAAGD,WAAW;gBAAEI;YAAQ;QAAE;QAC5E,MAAMF;QACNsB,OAAOC,WAAW,OAAO,EAAE,OAAO,CAACrB;QACnCoB,OAAOC,WAAW,eAAe,EAAE,IAAI,CAAC;QAExChB,MAAM;QACNF,QAAQ,iBAAiB,CACrBN,cAAc;YAAE,MAAM;gBAAE,GAAGD,WAAW;gBAAE,SAAS;oBAACI,OAAO,CAAC,EAAE;iBAAC;YAAC;QAAE;QAEpE,MAAMF;QACNsB,OAAOC,WAAW,eAAe,EAAE,IAAI,CAAC;QAGxChB,MAAM;QACNF,QAAQ,iBAAiB,CAACN,cAAc;YAAE,MAAMD;QAAY;QAC5D,MAAME;QACNsB,OAAOC,WAAW,OAAO,EAAE,OAAO,CAAC,EAAE;QACrCD,OAAOC,WAAW,eAAe,EAAE,IAAI,CAAC;QAGxChB,MAAM;QACNF,QAAQ,iBAAiB,CACrBN,cAAc;YACV,MAAM;gBAAE,GAAGD,WAAW;gBAAE,SAAS;oBAAC;wBAAE,IAAI;wBAAQ,MAAM;oBAAO;uBAAMI;iBAAQ;YAAC;QAChF;QAEJ,MAAMF;QACNsB,OAAOC,WAAW,eAAe,EAAE,IAAI,CAAC;IAC5C;IAEAH,GAAG,0DAA0D;QAEzDb,MAAM;QACNF,QAAQ,iBAAiB,CACrBJ,wBAAwB;YACpB;gBAAE,IAAI;gBAAQ,MAAM;YAAO;YAC3B;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAC9B;QAGL,MAAMoB,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;YAAmB,UAAU;QAAO;QACnEC,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,qEAAqE;QACpE,MAAMI,WAAWd,GAAG,EAAE;QACtBG,eAAe,OAAO,CAACT,WAAW,OAAO,CAAC,cAAc,CAACoB;QACzDnB,QAAQ,iBAAiB,CAACJ,wBAAwB;YAAC;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAAE;QAEhF,MAAMoB,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;YAAmB,UAAU;QAAO;QACnEC,OAAOJ,iBAAiB,IAAI,CAAC;QAC7BI,OAAOhB,QAAQ,GAAG,CAAC,aAAa,IAAI,CAAC;QAErCgB,OAAOE,UAAU,oBAAoB,CAAC;IAC1C;IAEAJ,GAAG,8DAA8D;QAC7D,MAAMlB,UAAU;YACZ;gBAAE,IAAI;gBAAQ,MAAM;YAAO;YAC3B;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAC9B;QACDG,QAAQ,iBAAiB,CAACJ,wBAAwBC;QAElD,MAAMmB,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;YAAgBnB;QAAQ;QACvDoB,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,iDAAiD;QAChDf,QAAQ,iBAAiB,CAACJ,wBAAwB,EAAE;QACpDqB,OAAO,MAAMtB,SAAS,OAAO,CAAC;YAAE,MAAM;QAAiB;QAEvDK,QAAQ,iBAAiB,CACrBN,cAAc;YACV,OAAO;gBAAE,MAAM;gBAAmC,SAAS;YAAwB;QACvF;QAEJuB,OAAO,MAAMtB,SAAS,OAAO,CAAC;YAAE,MAAM;QAAiB;QACvDsB,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,yEAAyE;QAExEb,MAAM;QACNF,QAAQ,iBAAiB,CAACJ,wBAAwB;YAAC;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAAE;QAEhF,MAAMoB,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;YAAmB,UAAU;QAAO;QACnEC,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,6DAA6D;QAC5Db,MAAM;QACN,MAAMiB,WAAWd,GAAG,EAAE;QACtBG,eAAe,OAAO,CAACT,WAAW,OAAO,CAAC,cAAc,CAACoB;QACzDnB,QAAQ,iBAAiB,CAACJ,wBAAwB;YAAC;gBAAE,IAAI;gBAAQ,MAAM;YAAO;SAAE;QAEhF,MAAMqB,OAAOtB,SAAS,OAAO,CAAC,aAAa,CAAC;YACxC,MAAM;QACV;QACAsB,OAAOE,UAAU,GAAG,CAAC,gBAAgB;IACzC;IAEAJ,GAAG,IAAI,CAAC;QACJ;YAAC;YAAW;gBAAE,SAAS;gBAA0B,MAAM;YAAyB;SAAE;QAClF;YAAC;YAAY;gBAAE,SAAS;gBAAuB,MAAM;YAAyB;SAAE;KACnF,EAAE,qDAAqD,OAAOK,GAAGC;QAC9DnB,MAAM;QACNF,QAAQ,iBAAiB,CAACqB;QAE1B,MAAML,SAAS,MAAMrB;QAErBsB,OAAOD,QAAQ,OAAO,CAAC;YAAE,MAAM;YAAmB,UAAU;QAAO;QACnEC,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,iDAAiD;QAChDb,MAAM;QACNF,QAAQ,iBAAiB,CAAC;YACtB,SAAS;YACT,MAAM;QACV;QAEA,MAAMiB,OAAOtB,SAAS,OAAO,CAAC,aAAa,CAAC;YAAE,MAAM;QAAyB;QAC7EsB,OAAOJ,iBAAiB,IAAI,CAAC;IACjC;IAEAE,GAAG,kEAAkE;QACjEf,QAAQ,iBAAiB,CACrBN,cAAc;YAAE,OAAO;gBAAE,MAAM;gBAAa,SAAS;YAAmB;QAAE;QAG9E,MAAMuB,OAAOtB,SAAS,OAAO,CAAC,aAAa,CAAC;YACxC,MAAM;YACN,SAAS;QACb;IACJ;IAEAoB,GAAG,yDAAyD;QACxDf,QAAQ,iBAAiB,CAACN,cAAc;YAAE,MAAM;gBAAE,GAAGD,WAAW;gBAAE,aAAa,EAAE;YAAC;QAAE;QAEpF,MAAMwB,OAAOtB,SAAS,OAAO,CAAC,OAAO,CAAC;IAC1C;AACJ"}

package/features/security/LogIn/abstractions.d.ts

@@ -5,13 +5,36 @@ export interface ILoginParams {
     idTokenProvider: AuthenticationContext.IdTokenProvider;
     logoutCallback?: AuthenticationContext.LogoutCallback;
 }
+export type LogInResult = 
+/** The identity is set: the user is logged in. */
+{
+    type: "loggedIn";
+}
+/** The current tenant was changed, and the app reloads to log in on it. */
+ | {
+    type: "switchingTenant";
+    tenantId: string;
+}
+/** The user has to pick one of these tenants. */
+ | {
+    type: "selectTenant";
+    tenants: Tenant[];
+}
+/** The user can't access any tenant. */
+ | {
+    type: "noTenantAccess";
+};
 export interface ILogInUseCase {
-    execute(params: ILoginParams): Promise<void>;
+    /**
+     * Log in on the current tenant. Errors that aren't about the tenant are thrown.
+     */
+    execute(params: ILoginParams): Promise<LogInResult>;
 }
 export declare const LogInUseCase: import("@webiny/di").Abstraction<ILogInUseCase>;
 export declare namespace LogInUseCase {
     type Interface = ILogInUseCase;
     type Params = ILoginParams;
+    type Result = LogInResult;
 }
 export interface IIdentityDTO {
     id: string;
@@ -22,22 +45,44 @@ export interface IIdentityDTO {
     permissions: Identity.Permission[];
     currentTenant: Tenant;
     defaultTenant: Tenant;
+    /** The enabled tenants in which the identity has a user record. */
+    tenants?: Tenant[];
     profile: Identity.Profile;
 }
+/** What `security.login` returned: the identity, or the tenants the user has to log into instead. */
+export type LogInStep<TIdentity> = 
+/** The user is logged in on the current tenant. */
+{
+    step: "done";
+    identity: TIdentity;
+}
+/** The user has no access to the current tenant, but has access to these. */
+ | {
+    step: "selectTenant";
+    tenants: Tenant[];
+};
 export interface ILogInRepository {
-    login(): Promise<Identity>;
+    /**
+     * Log in on the current tenant. A failed login throws a `LogInError`.
+     */
+    login(): Promise<LogInStep<Identity>>;
 }
 export declare const LogInRepository: import("@webiny/di").Abstraction<ILogInRepository>;
 export declare namespace LogInRepository {
     type Interface = ILogInRepository;
     type IdentityDTO = IIdentityDTO;
+    type Result = LogInStep<Identity>;
 }
 export interface ILogInGateway {
-    execute(): Promise<IIdentityDTO>;
+    /**
+     * Run `security.login`. An error in the response, or a failed request, throws a `LogInError`.
+     */
+    execute(): Promise<LogInStep<IIdentityDTO>>;
 }
 export declare const LogInGateway: import("@webiny/di").Abstraction<ILogInGateway>;
 export declare namespace LogInGateway {
     type Interface = ILogInGateway;
+    type Result = LogInStep<IIdentityDTO>;
 }
 export interface IIdentityMapper {
     toIdentity(dto: IIdentityDTO): Identity;

package/features/security/LogIn/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/LogIn/abstractions.js","sources":["../../../../src/features/security/LogIn/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { AuthenticationContext } from \"~/features/security/AuthenticationContext/index.js\";\nimport type { Identity, IRole, ITeam } from \"~/domain/Identity.js\";\nimport type { Tenant } from \"~/features/tenancy/abstractions.js\";\n\n// Use Case\nexport interface ILoginParams {\n    idTokenProvider: AuthenticationContext.IdTokenProvider;\n    logoutCallback?: AuthenticationContext.LogoutCallback;\n}\n\nexport interface ILogInUseCase {\n    execute(params: ILoginParams): Promise<void>;\n}\nexport const LogInUseCase = createAbstraction<ILogInUseCase>(\"LogInUseCase\");\n\nexport namespace LogInUseCase {\n    export type Interface = ILogInUseCase;\n    export type Params = ILoginParams;\n}\n\n// Repository\nexport interface IIdentityDTO {\n    id: string;\n    type: string;\n    displayName: string;\n    roles: IRole[];\n    teams: ITeam[];\n    permissions: Identity.Permission[];\n    currentTenant: Tenant;\n    defaultTenant: Tenant;\n    profile: Identity.Profile;\n}\n\nexport interface ILogInRepository {\n    login(): Promise<Identity>;\n}\n\nexport const LogInRepository = createAbstraction<ILogInRepository>(\"LogInRepository\");\n\nexport namespace LogInRepository {\n    export type Interface = ILogInRepository;\n    export type IdentityDTO = IIdentityDTO;\n}\n\n// Gateway\nexport interface ILogInGateway {\n    execute(): Promise<IIdentityDTO>;\n}\n\nexport const LogInGateway = createAbstraction<ILogInGateway>(\"LogInGateway\");\n\nexport namespace LogInGateway {\n    export type Interface = ILogInGateway;\n}\n\n// Identity Mapper\nexport interface IIdentityMapper {\n    toIdentity(dto: IIdentityDTO): Identity;\n}\n\nexport const IdentityMapper = createAbstraction<IIdentityMapper>(\"IdentityMapper\");\n\nexport namespace IdentityMapper {\n    export type Interface = IIdentityMapper;\n}\n"],"names":["LogInUseCase","createAbstraction","LogInRepository","LogInGateway","IdentityMapper"],"mappings":";AAcO,MAAMA,eAAeC,kBAAiC;AAwBtD,MAAMC,kBAAkBD,kBAAoC;AAY5D,MAAME,eAAeF,kBAAiC;AAWtD,MAAMG,iBAAiBH,kBAAmC"}
+{"version":3,"file":"features/security/LogIn/abstractions.js","sources":["../../../../src/features/security/LogIn/abstractions.ts"],"sourcesContent":["import { createAbstraction } from \"@webiny/feature/admin\";\nimport { AuthenticationContext } from \"~/features/security/AuthenticationContext/index.js\";\nimport type { Identity, IRole, ITeam } from \"~/domain/Identity.js\";\nimport type { Tenant } from \"~/features/tenancy/abstractions.js\";\n\n// Use Case\nexport interface ILoginParams {\n    idTokenProvider: AuthenticationContext.IdTokenProvider;\n    logoutCallback?: AuthenticationContext.LogoutCallback;\n}\n\nexport type LogInResult =\n    /** The identity is set: the user is logged in. */\n    | { type: \"loggedIn\" }\n    /** The current tenant was changed, and the app reloads to log in on it. */\n    | { type: \"switchingTenant\"; tenantId: string }\n    /** The user has to pick one of these tenants. */\n    | { type: \"selectTenant\"; tenants: Tenant[] }\n    /** The user can't access any tenant. */\n    | { type: \"noTenantAccess\" };\n\nexport interface ILogInUseCase {\n    /**\n     * Log in on the current tenant. Errors that aren't about the tenant are thrown.\n     */\n    execute(params: ILoginParams): Promise<LogInResult>;\n}\nexport const LogInUseCase = createAbstraction<ILogInUseCase>(\"LogInUseCase\");\n\nexport namespace LogInUseCase {\n    export type Interface = ILogInUseCase;\n    export type Params = ILoginParams;\n    export type Result = LogInResult;\n}\n\n// Repository\nexport interface IIdentityDTO {\n    id: string;\n    type: string;\n    displayName: string;\n    roles: IRole[];\n    teams: ITeam[];\n    permissions: Identity.Permission[];\n    currentTenant: Tenant;\n    defaultTenant: Tenant;\n    /** The enabled tenants in which the identity has a user record. */\n    tenants?: Tenant[];\n    profile: Identity.Profile;\n}\n\n/** What `security.login` returned: the identity, or the tenants the user has to log into instead. */\nexport type LogInStep<TIdentity> =\n    /** The user is logged in on the current tenant. */\n    | { step: \"done\"; identity: TIdentity }\n    /** The user has no access to the current tenant, but has access to these. */\n    | { step: \"selectTenant\"; tenants: Tenant[] };\n\nexport interface ILogInRepository {\n    /**\n     * Log in on the current tenant. A failed login throws a `LogInError`.\n     */\n    login(): Promise<LogInStep<Identity>>;\n}\n\nexport const LogInRepository = createAbstraction<ILogInRepository>(\"LogInRepository\");\n\nexport namespace LogInRepository {\n    export type Interface = ILogInRepository;\n    export type IdentityDTO = IIdentityDTO;\n    export type Result = LogInStep<Identity>;\n}\n\n// Gateway\nexport interface ILogInGateway {\n    /**\n     * Run `security.login`. An error in the response, or a failed request, throws a `LogInError`.\n     */\n    execute(): Promise<LogInStep<IIdentityDTO>>;\n}\n\nexport const LogInGateway = createAbstraction<ILogInGateway>(\"LogInGateway\");\n\nexport namespace LogInGateway {\n    export type Interface = ILogInGateway;\n    export type Result = LogInStep<IIdentityDTO>;\n}\n\n// Identity Mapper\nexport interface IIdentityMapper {\n    toIdentity(dto: IIdentityDTO): Identity;\n}\n\nexport const IdentityMapper = createAbstraction<IIdentityMapper>(\"IdentityMapper\");\n\nexport namespace IdentityMapper {\n    export type Interface = IIdentityMapper;\n}\n"],"names":["LogInUseCase","createAbstraction","LogInRepository","LogInGateway","IdentityMapper"],"mappings":";AA2BO,MAAMA,eAAeC,kBAAiC;AAqCtD,MAAMC,kBAAkBD,kBAAoC;AAgB5D,MAAME,eAAeF,kBAAiC;AAYtD,MAAMG,iBAAiBH,kBAAmC"}

package/features/security/LogIn/createLoginMutation.js

@@ -3,36 +3,49 @@ const createLoginMutation = ()=>`
             security {
                 login {
                     data {
-                        id
-                        displayName
-                        type
-                        roles {
+                        __typename
+                        ... on SecurityIdentity {
                             id
-                            slug
-                            name
+                            displayName
+                            type
+                            roles {
+                                id
+                                slug
+                                name
+                            }
+                            teams {
+                                id
+                                slug
+                                name
+                            }
+                            profile {
+                                firstName
+                                lastName
+                                email
+                                avatar
+                                external
+                                createdOn
+                            }
+                            currentTenant {
+                                id
+                                name
+                            }
+                            defaultTenant {
+                                id
+                                name
+                            }
+                            tenants {
+                                id
+                                name
+                            }
+                            permissions
                         }
-                        teams {
-                            id
-                            slug
-                            name
-                        }
-                        profile {
-                            firstName
-                            lastName
-                            email
-                            avatar
-                            external
-                            createdOn
-                        }
-                        currentTenant {
-                            id
-                            name
-                        }
-                        defaultTenant {
-                            id
-                            name
+                        ... on SecurityLoginTenantSelection {
+                            tenants {
+                                id
+                                name
+                            }
                         }
-                        permissions
                     }
                     error {
                         code

package/features/security/LogIn/createLoginMutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/LogIn/createLoginMutation.js","sources":["../../../../src/features/security/LogIn/createLoginMutation.ts"],"sourcesContent":["export const createLoginMutation = () => {\n    return /* GraphQL */ `\n        mutation Login {\n            security {\n                login {\n                    data {\n                        id\n                        displayName\n                        type\n                        roles {\n                            id\n                            slug\n                            name\n                        }\n                        teams {\n                            id\n                            slug\n                            name\n                        }\n                        profile {\n                            firstName\n                            lastName\n                            email\n                            avatar\n                            external\n                            createdOn\n                        }\n                        currentTenant {\n                            id\n                            name\n                        }\n                        defaultTenant {\n                            id\n                            name\n                        }\n                        permissions\n                    }\n                    error {\n                        code\n                        message\n                        data\n                    }\n                }\n            }\n        }\n    `;\n};\n"],"names":["createLoginMutation"],"mappings":"AAAO,MAAMA,sBAAsB,IACV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4CtB,CAAC"}
+{"version":3,"file":"features/security/LogIn/createLoginMutation.js","sources":["../../../../src/features/security/LogIn/createLoginMutation.ts"],"sourcesContent":["export const createLoginMutation = () => {\n    return /* GraphQL */ `\n        mutation Login {\n            security {\n                login {\n                    data {\n                        __typename\n                        ... on SecurityIdentity {\n                            id\n                            displayName\n                            type\n                            roles {\n                                id\n                                slug\n                                name\n                            }\n                            teams {\n                                id\n                                slug\n                                name\n                            }\n                            profile {\n                                firstName\n                                lastName\n                                email\n                                avatar\n                                external\n                                createdOn\n                            }\n                            currentTenant {\n                                id\n                                name\n                            }\n                            defaultTenant {\n                                id\n                                name\n                            }\n                            tenants {\n                                id\n                                name\n                            }\n                            permissions\n                        }\n                        ... on SecurityLoginTenantSelection {\n                            tenants {\n                                id\n                                name\n                            }\n                        }\n                    }\n                    error {\n                        code\n                        message\n                        data\n                    }\n                }\n            }\n        }\n    `;\n};\n"],"names":["createLoginMutation"],"mappings":"AAAO,MAAMA,sBAAsB,IACV,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyDtB,CAAC"}

package/features/security/LogIn/feature.js

@@ -4,6 +4,7 @@ import { LogInUseCase as external_LogInUseCase_js_LogInUseCase } from "./LogInUs
 import { IdentityMapper } from "./IdentityMapper.js";
 import { LogInGateway } from "./LogInGateway.js";
 import { LogInRepository } from "./LogInRepository.js";
+import { LoginTenantResolverFeature } from "../LoginTenantResolver/index.js";
 const LogInFeature = createFeature({
     name: "LogIn",
     register (container) {
@@ -11,6 +12,7 @@ const LogInFeature = createFeature({
         container.register(IdentityMapper).inSingletonScope();
         container.register(LogInGateway).inSingletonScope();
         container.register(LogInRepository).inSingletonScope();
+        LoginTenantResolverFeature.register(container);
     },
     resolve (container) {
         return {

package/features/security/LogIn/feature.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/security/LogIn/feature.js","sources":["../../../../src/features/security/LogIn/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/admin\";\nimport { LogInUseCase as UseCase } from \"./abstractions.js\";\nimport { LogInUseCase } from \"./LogInUseCase.js\";\nimport { IdentityMapper } from \"./IdentityMapper.js\";\nimport { LogInGateway } from \"./LogInGateway.js\";\nimport { LogInRepository } from \"./LogInRepository.js\";\n\nexport const LogInFeature = createFeature({\n    name: \"LogIn\",\n    register(container) {\n        container.register(LogInUseCase);\n        container.register(IdentityMapper).inSingletonScope();\n        container.register(LogInGateway).inSingletonScope();\n        container.register(LogInRepository).inSingletonScope();\n    },\n    resolve(container) {\n        return {\n            useCase: container.resolve(UseCase)\n        };\n    }\n});\n"],"names":["LogInFeature","createFeature","container","LogInUseCase","IdentityMapper","LogInGateway","LogInRepository","UseCase"],"mappings":";;;;;;AAOO,MAAMA,eAAeC,cAAc;IACtC,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE,gBAAgB,gBAAgB;QACnDF,UAAU,QAAQ,CAACG,cAAc,gBAAgB;QACjDH,UAAU,QAAQ,CAACI,iBAAiB,gBAAgB;IACxD;IACA,SAAQJ,SAAS;QACb,OAAO;YACH,SAASA,UAAU,OAAO,CAACK;QAC/B;IACJ;AACJ"}
+{"version":3,"file":"features/security/LogIn/feature.js","sources":["../../../../src/features/security/LogIn/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/admin\";\nimport { LogInUseCase as UseCase } from \"./abstractions.js\";\nimport { LogInUseCase } from \"./LogInUseCase.js\";\nimport { IdentityMapper } from \"./IdentityMapper.js\";\nimport { LogInGateway } from \"./LogInGateway.js\";\nimport { LogInRepository } from \"./LogInRepository.js\";\nimport { LoginTenantResolverFeature } from \"~/features/security/LoginTenantResolver/index.js\";\n\nexport const LogInFeature = createFeature({\n    name: \"LogIn\",\n    register(container) {\n        container.register(LogInUseCase);\n        container.register(IdentityMapper).inSingletonScope();\n        container.register(LogInGateway).inSingletonScope();\n        container.register(LogInRepository).inSingletonScope();\n        LoginTenantResolverFeature.register(container);\n    },\n    resolve(container) {\n        return {\n            useCase: container.resolve(UseCase)\n        };\n    }\n});\n"],"names":["LogInFeature","createFeature","container","LogInUseCase","IdentityMapper","LogInGateway","LogInRepository","LoginTenantResolverFeature","UseCase"],"mappings":";;;;;;;AAQO,MAAMA,eAAeC,cAAc;IACtC,MAAM;IACN,UAASC,SAAS;QACdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,QAAQ,CAACE,gBAAgB,gBAAgB;QACnDF,UAAU,QAAQ,CAACG,cAAc,gBAAgB;QACjDH,UAAU,QAAQ,CAACI,iBAAiB,gBAAgB;QACpDC,2BAA2B,QAAQ,CAACL;IACxC;IACA,SAAQA,SAAS;QACb,OAAO;YACH,SAASA,UAAU,OAAO,CAACM;QAC/B;IACJ;AACJ"}

package/features/security/LogIn/index.d.ts

@@ -1 +1,2 @@
 export { LogInUseCase } from "./abstractions.js";
+export { LogInError } from "./LogInError.js";

package/features/security/LogIn/index.js

@@ -1 +1,2 @@
 export { LogInUseCase } from "./abstractions.js";
+export { LogInError } from "./LogInError.js";

package/features/security/LoginTenantResolver/LoginTenantResolver.d.ts

@@ -0,0 +1,14 @@
+import { LoginTenantResolver as Abstraction } from "./abstractions.js";
+import { TenantContext } from "../../../features/tenancy/abstractions.js";
+import type { Tenant } from "../../../features/tenancy/abstractions.js";
+import type { LogInError } from "../../../features/security/LogIn/index.js";
+declare class LoginTenantResolverImpl implements Abstraction.Interface {
+    private tenantContext;
+    constructor(tenantContext: TenantContext.Interface);
+    resolveTenants(tenants: Tenant[]): Promise<Abstraction.Resolution>;
+    resolveError(error: LogInError): Promise<Abstraction.Resolution>;
+}
+export declare const LoginTenantResolver: typeof LoginTenantResolverImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").ILoginTenantResolver>;
+};
+export {};

package/features/security/LoginTenantResolver/LoginTenantResolver.js

@@ -0,0 +1,52 @@
+import { LoginTenantResolver } from "./abstractions.js";
+import { TenantContext } from "../../tenancy/abstractions.js";
+const ROOT_TENANT = "root";
+const UNAVAILABLE_TENANT_CODES = [
+    "Tenancy/TenantNotFound",
+    "Tenancy/TenantDisabled"
+];
+class LoginTenantResolverImpl {
+    constructor(tenantContext){
+        this.tenantContext = tenantContext;
+    }
+    async resolveTenants(tenants) {
+        if (tenants.some((tenant)=>tenant.id === ROOT_TENANT)) return {
+            type: "switchTenant",
+            tenantId: ROOT_TENANT
+        };
+        if (1 === tenants.length) return {
+            type: "switchTenant",
+            tenantId: tenants[0].id
+        };
+        if (tenants.length > 1) return {
+            type: "selectTenant",
+            tenants
+        };
+        return {
+            type: "noTenantAccess"
+        };
+    }
+    async resolveError(error) {
+        if ("Security/Identity/NotAuthorized" === error.code) return {
+            type: "noTenantAccess"
+        };
+        if (UNAVAILABLE_TENANT_CODES.includes(error.code)) {
+            if (this.tenantContext.getCurrentTenant() !== ROOT_TENANT) return {
+                type: "switchTenant",
+                tenantId: ROOT_TENANT
+            };
+        }
+        return {
+            type: "unresolved"
+        };
+    }
+}
+const LoginTenantResolver_LoginTenantResolver = LoginTenantResolver.createImplementation({
+    implementation: LoginTenantResolverImpl,
+    dependencies: [
+        TenantContext
+    ]
+});
+export { LoginTenantResolver_LoginTenantResolver as LoginTenantResolver };
+
+//# sourceMappingURL=LoginTenantResolver.js.map

package/features/security/LoginTenantResolver/LoginTenantResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/security/LoginTenantResolver/LoginTenantResolver.js","sources":["../../../../src/features/security/LoginTenantResolver/LoginTenantResolver.ts"],"sourcesContent":["import { LoginTenantResolver as Abstraction } from \"./abstractions.js\";\nimport { TenantContext } from \"~/features/tenancy/abstractions.js\";\nimport type { Tenant } from \"~/features/tenancy/abstractions.js\";\nimport type { LogInError } from \"~/features/security/LogIn/index.js\";\n\nconst ROOT_TENANT = \"root\";\n\n// The API couldn't load the tenant from the `x-tenant` header: it was deleted or disabled.\nconst UNAVAILABLE_TENANT_CODES = [\"Tenancy/TenantNotFound\", \"Tenancy/TenantDisabled\"];\n\nclass LoginTenantResolverImpl implements Abstraction.Interface {\n    constructor(private tenantContext: TenantContext.Interface) {}\n\n    async resolveTenants(tenants: Tenant[]): Promise<Abstraction.Resolution> {\n        // Root users never pick a tenant: they log in on root and open tenants through Tenant Manager.\n        if (tenants.some(tenant => tenant.id === ROOT_TENANT)) {\n            return { type: \"switchTenant\", tenantId: ROOT_TENANT };\n        }\n\n        if (tenants.length === 1) {\n            return { type: \"switchTenant\", tenantId: tenants[0].id };\n        }\n\n        if (tenants.length > 1) {\n            return { type: \"selectTenant\", tenants };\n        }\n\n        return { type: \"noTenantAccess\" };\n    }\n\n    async resolveError(error: LogInError): Promise<Abstraction.Resolution> {\n        if (error.code === \"Security/Identity/NotAuthorized\") {\n            return { type: \"noTenantAccess\" };\n        }\n\n        // A stale tenant (from localStorage or `?tenantId`) fails every request. Root always loads,\n        // so this retries through root at most once.\n        if (UNAVAILABLE_TENANT_CODES.includes(error.code)) {\n            if (this.tenantContext.getCurrentTenant() !== ROOT_TENANT) {\n                return { type: \"switchTenant\", tenantId: ROOT_TENANT };\n            }\n        }\n\n        return { type: \"unresolved\" };\n    }\n}\n\nexport const LoginTenantResolver = Abstraction.createImplementation({\n    implementation: LoginTenantResolverImpl,\n    dependencies: [TenantContext]\n});\n"],"names":["ROOT_TENANT","UNAVAILABLE_TENANT_CODES","LoginTenantResolverImpl","tenantContext","tenants","tenant","error","LoginTenantResolver","Abstraction","TenantContext"],"mappings":";;AAKA,MAAMA,cAAc;AAGpB,MAAMC,2BAA2B;IAAC;IAA0B;CAAyB;AAErF,MAAMC;IACF,YAAoBC,aAAsC,CAAE;aAAxCA,aAAa,GAAbA;IAAyC;IAE7D,MAAM,eAAeC,OAAiB,EAAmC;QAErE,IAAIA,QAAQ,IAAI,CAACC,CAAAA,SAAUA,OAAO,EAAE,KAAKL,cACrC,OAAO;YAAE,MAAM;YAAgB,UAAUA;QAAY;QAGzD,IAAII,AAAmB,MAAnBA,QAAQ,MAAM,EACd,OAAO;YAAE,MAAM;YAAgB,UAAUA,OAAO,CAAC,EAAE,CAAC,EAAE;QAAC;QAG3D,IAAIA,QAAQ,MAAM,GAAG,GACjB,OAAO;YAAE,MAAM;YAAgBA;QAAQ;QAG3C,OAAO;YAAE,MAAM;QAAiB;IACpC;IAEA,MAAM,aAAaE,KAAiB,EAAmC;QACnE,IAAIA,AAAe,sCAAfA,MAAM,IAAI,EACV,OAAO;YAAE,MAAM;QAAiB;QAKpC,IAAIL,yBAAyB,QAAQ,CAACK,MAAM,IAAI,GAC5C;YAAA,IAAI,IAAI,CAAC,aAAa,CAAC,gBAAgB,OAAON,aAC1C,OAAO;gBAAE,MAAM;gBAAgB,UAAUA;YAAY;QACzD;QAGJ,OAAO;YAAE,MAAM;QAAa;IAChC;AACJ;AAEO,MAAMO,0CAAsBC,oBAAAA,oBAAgC,CAAC;IAChE,gBAAgBN;IAChB,cAAc;QAACO;KAAc;AACjC"}