Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
return args.credentials.map(async input => {
// Validate `id`.
if (!validateIdFormat(input.id)) {
throw new ValidationError("The provided `id` is an invalid ID.");
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Credential.read(tx, input.id, credentialMap, {
forUpdate: true
});
if (!(before instanceof PasswordCredential)) {
throw new NotFoundError(
"The authority uses a strategy other than password."
);
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this credential."
);
}
if (
typeof input.password === "string" &&
!(await before.isAccessibleBy(realm, a, tx, "write.*"))
) {
throw new ForbiddenError(
"You do not have permission to update this credential's details."
} catch (error) {
if (!(error instanceof NotFoundError)) {
throw error;
}
}
}
const id = input.id || v4();
const authority = await Authority.read(
tx,
input.authorityId,
authorityMap,
{ forUpdate: true }
);
if (!(authority instanceof EmailAuthority)) {
throw new NotFoundError("No email authority exists with this ID.");
}
// Check if the email is used in a different credential
const existingCredentials = await EmailCredential.read(
tx,
(
await tx.query(
`
SELECT entity_id as id
FROM authx.credential_record
WHERE
replacement_record_id IS NULL
AND enabled = TRUE
AND authority_id = $1
AND authority_user_id = $2
FOR UPDATE
return args.authorities.map(async input => {
// Validate `id`.
if (!validateIdFormat(input.id)) {
throw new ValidationError("The provided `id` is an invalid ID.");
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Authority.read(tx, input.id, authorityMap, {
forUpdate: true
});
if (!(before instanceof PasswordAuthority)) {
throw new NotFoundError("No password authority exists with this ID.");
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this authority."
);
}
if (
typeof input.rounds === "number" &&
!(await before.isAccessibleBy(realm, a, tx, "write.*"))
) {
throw new ForbiddenError(
"You do not have permission to update this authority's details."
);
}
return args.authorities.map(async input => {
// Validate `id`.
if (!validateIdFormat(input.id)) {
throw new ValidationError("The provided `id` is an invalid ID.");
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Authority.read(tx, input.id, authorityMap, {
forUpdate: true
});
if (!(before instanceof EmailAuthority)) {
throw new NotFoundError(
"The authority uses a strategy other than email."
);
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this authority."
);
}
if (
(typeof input.privateKey === "string" ||
input.addPublicKeys ||
input.removePublicKeys ||
typeof input.proofValidityDuration === "number" ||
typeof input.authenticationEmailSubject === "string" ||
return args.credentials.map(async input => {
// Validate `id`.
if (!validateIdFormat(input.id)) {
throw new ValidationError("The provided `id` is an invalid ID.");
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Credential.read(tx, input.id, credentialMap, {
forUpdate: true
});
if (!(before instanceof OpenIdCredential)) {
throw new NotFoundError("No openid credential exists with this ID.");
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this credential."
);
}
const credential = await OpenIdCredential.write(
tx,
{
...before,
enabled:
typeof input.enabled === "boolean"
? input.enabled
: before.enabled
throw error;
}
}
}
const id = input.id || v4();
// Fetch the authority.
const authority = await Authority.read(
tx,
input.authorityId,
authorityMap
);
if (!(authority instanceof OpenIdAuthority)) {
throw new NotFoundError(
"The authority uses a strategy other than openid."
);
}
if (!input.code && !input.subject) {
throw new ValidationError(
"Either a `code` or `subject` must be provided."
);
}
if (
typeof input.code === "string" &&
typeof input.subject === "string"
) {
throw new ValidationError(
"Only one of `code` or `subject` may be provided."
return args.credentials.map(async input => {
// Validate `id`.
if (!validateIdFormat(input.id)) {
throw new ValidationError("The provided `id` is an invalid ID.");
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Credential.read(tx, input.id, credentialMap, {
forUpdate: true
});
if (!(before instanceof EmailCredential)) {
throw new NotFoundError("No email credential exists with this ID.");
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this credential."
);
}
const credential = await EmailCredential.write(
tx,
{
...before,
enabled:
typeof input.enabled === "boolean"
? input.enabled
: before.enabled
throw new ConflictError();
} catch (error) {
if (!(error instanceof NotFoundError)) {
throw error;
}
}
}
const id = input.id || v4();
const authority = await Authority.read(
tx,
input.authorityId,
authorityMap
);
if (!(authority instanceof PasswordAuthority)) {
throw new NotFoundError(
"No password authority exists with this ID."
);
}
const credential = await PasswordCredential.write(
tx,
{
id,
enabled: input.enabled,
authorityId: input.authorityId,
userId: input.userId,
authorityUserId: input.userId,
details: {
hash: await hash(input.password, authority.details.rounds)
}
},
) {
throw new ValidationError(
"The provided `emailAuthorityId` is an invalid ID."
);
}
const tx = await pool.connect();
try {
await tx.query("BEGIN DEFERRABLE");
const before = await Authority.read(tx, input.id, authorityMap, {
forUpdate: true
});
if (!(before instanceof OpenIdAuthority)) {
throw new NotFoundError("No openid authority exists with this ID.");
}
if (!(await before.isAccessibleBy(realm, a, tx, "write.basic"))) {
throw new ForbiddenError(
"You do not have permission to update this authority."
);
}
if (
(typeof input.clientId === "string" ||
typeof input.clientSecret === "string") &&
!(await before.isAccessibleBy(realm, a, tx, "write.*"))
) {
throw new ForbiddenError(
"You do not have permission to update this authority's details."
);