feat: support new auth methods for Tenants

- New Time scalar type is implemented on the Server
- Single Sign-On keys can now be generated
- Single Sign-On keys can be regenerated
- Single Sign-On keys now store the date they were generated on.
- Initial implementation of `AuthenticationTargetFilter`'s

src/core/server/graph/common/scalars/time.ts

@@ -0,0 +1,36 @@
+import { GraphQLScalarType } from "graphql";
+import { Kind } from "graphql/language";
+import { DateTime } from "luxon";
+
+export default new GraphQLScalarType({
+  name: "Time",
+  description: "Time represented as an ISO8601 string.",
+  serialize(value) {
+    if (typeof value === "string") {
+      return value;
+    }
+
+    return value.toISOString();
+  },
+  parseValue(value) {
+    return new Date(value);
+  },
+  parseLiteral(ast) {
+    switch (ast.kind) {
+      case Kind.STRING:
+        // This handles an empty string.
+        if (ast.value && ast.value.length === 0) {
+          return null;
+        }
+
+        const date = DateTime.fromISO(ast.value, {});
+        if (!date.isValid) {
+          return null;
+        }
+
+        return date.toJSDate();
+      default:
+        return null;
+    }
+  },
+});

src/core/server/graph/management/resolvers/index.ts

@@ -1,5 +1,9 @@
+import Time from "talk-server/graph/common/scalars/time";
+
 import { GQLResolver } from "talk-server/graph/management/schema/__generated__/types";
 
-const Resolvers: GQLResolver = {};
+const Resolvers: GQLResolver = {
+  Time,
+};
 
 export default Resolvers;

src/core/server/graph/tenant/mutators/settings.ts

@@ -3,9 +3,11 @@ import { isNull, omitBy } from "lodash";
 import TenantContext from "talk-server/graph/tenant/context";
 import { GQLSettingsInput } from "talk-server/graph/tenant/schema/__generated__/types";
 import { Tenant } from "talk-server/models/tenant";
-import { update } from "talk-server/services/tenant";
+import { regenerateSSOKey, update } from "talk-server/services/tenant";
 
 export default ({ mongo, redis, tenantCache, tenant }: TenantContext) => ({
   update: (input: GQLSettingsInput): Promise<Tenant | null> =>
     update(mongo, redis, tenantCache, tenant, omitBy(input, isNull)),
+  regenerateSSOKey: (): Promise<Tenant | null> =>
+    regenerateSSOKey(mongo, redis, tenantCache, tenant),
 });

src/core/server/graph/tenant/resolvers/index.ts

@@ -1,4 +1,6 @@
 import Cursor from "talk-server/graph/common/scalars/cursor";
+import Time from "talk-server/graph/common/scalars/time";
+
 import { GQLResolver } from "talk-server/graph/tenant/schema/__generated__/types";
 
 import Asset from "./asset";
@@ -20,6 +22,7 @@ const Resolvers: GQLResolver = {
   Profile,
   Query,
   User,
+  Time,
 };
 
 export default Resolvers;

src/core/server/graph/tenant/resolvers/mutation.ts

@@ -47,6 +47,10 @@ const Mutation: GQLMutationTypeResolver<void> = {
     comment: await ctx.mutators.Comment.deleteFlag(input),
     clientMutationId: input.clientMutationId,
   }),
+  regenerateSSOKey: async (source, { input }, ctx) => ({
+    settings: await ctx.mutators.Settings.regenerateSSOKey(),
+    clientMutationId: input.clientMutationId,
+  }),
 };
 
 export default Mutation;

src/core/server/graph/tenant/schema/schema.graphql

@@ -244,12 +244,32 @@ type Wordlist {
 ## Auth
 ################################################################################
 
+##########################
+## AuthenticationTargetFilter
+##########################
+
+"""
+AuthenticationTargetFilter when non-null, will specify the targets that a
+specific authentication integration will be enabled on.
+"""
+type AuthenticationTargetFilter {
+  admin: Boolean!
+  stream: Boolean!
+}
+
 ##########################
 ## LocalAuthIntegration
 ##########################
 
 type LocalAuthIntegration {
   enabled: Boolean!
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: AuthenticationTargetFilter
 }
 
 ##########################
@@ -264,11 +284,23 @@ embed to allow single sign on.
 type SSOAuthIntegration {
   enabled: Boolean!
 
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: AuthenticationTargetFilter
+
   """
   key is the secret that is used to sign tokens.
   """
   key: String @auth(roles: [ADMIN])
 
+  """
+  keyGeneratedAt is the Time that the key was effective from.
+  """
+  keyGeneratedAt: Time @auth(roles: [ADMIN])
+
   """
   displayNameEnable when enabled, will allow Users to set and view their
   displayName's.
@@ -287,6 +319,16 @@ will be used in the admin to provide staff logins for users.
 type OIDCAuthIntegration {
   enabled: Boolean!
 
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: AuthenticationTargetFilter
+
+  """
+  name is the label assigned to reference the provider of the OIDC integration.
+  """
   name: String
   clientID: String @auth(roles: [ADMIN])
   clientSecret: String @auth(roles: [ADMIN])
@@ -308,6 +350,14 @@ type OIDCAuthIntegration {
 
 type GoogleAuthIntegration {
   enabled: Boolean!
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: AuthenticationTargetFilter
+
   clientID: String @auth(roles: [ADMIN])
   clientSecret: String @auth(roles: [ADMIN])
 }
@@ -318,6 +368,14 @@ type GoogleAuthIntegration {
 
 type FacebookAuthIntegration {
   enabled: Boolean!
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: AuthenticationTargetFilter
+
   clientID: String @auth(roles: [ADMIN])
   clientSecret: String @auth(roles: [ADMIN])
 }
@@ -1258,17 +1316,31 @@ input SettingsWordlistInput {
   suspect: [String!]
 }
 
+input SettingsAuthenticationTargetFilterInput {
+  admin: Boolean!
+  stream: Boolean!
+}
+
 input SettingsLocalAuthIntegrationInput {
   enabled: Boolean
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: SettingsAuthenticationTargetFilterInput
 }
 
 input SettingsSSOAuthIntegrationInput {
   enabled: Boolean
 
   """
-  key is the secret that is used to sign tokens.
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
   """
-  key: String
+  targetFilter: SettingsAuthenticationTargetFilterInput
 
   """
   displayNameEnable when enabled, will allow Users to set and view their
@@ -1280,11 +1352,23 @@ input SettingsSSOAuthIntegrationInput {
 input SettingsOIDCAuthIntegrationInput {
   enabled: Boolean
 
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: SettingsAuthenticationTargetFilterInput
+
+  """
+  name is the label assigned to reference the provider of the OIDC integration.
+  """
   name: String
   clientID: String
   clientSecret: String
   authorizationURL: String
   tokenURL: String
+  jwksURI: String
+  issuer: String
 
   """
   displayNameEnable when enabled, will allow Users to set and view their
@@ -1295,12 +1379,28 @@ input SettingsOIDCAuthIntegrationInput {
 
 input SettingsGoogleAuthIntegrationInput {
   enabled: Boolean
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: SettingsAuthenticationTargetFilterInput
+
   clientID: String
   clientSecret: String
 }
 
 input SettingsFacebookAuthIntegrationInput {
   enabled: Boolean
+
+  """
+  targetFilter will restrict where the authentication integration should be
+  displayed. If the value of targetFilter is null, then the authentication
+  integration should be displayed in all targets.
+  """
+  targetFilter: SettingsAuthenticationTargetFilterInput
+
   clientID: String
   clientSecret: String
 }
@@ -1777,6 +1877,29 @@ type DeleteCommentFlagPayload {
   clientMutationId: String!
 }
 
+##################
+## regenerateSSOKey
+##################
+
+input RegenerateSSOKeyInput {
+  """
+  clientMutationId is required for Relay support.
+  """
+  clientMutationId: String!
+}
+
+type RegenerateSSOKeyPayload {
+  """
+  settings is the Settings that the SSO key was regenerated on.
+  """
+  settings: Settings
+
+  """
+  clientMutationId is required for Relay support.
+  """
+  clientMutationId: String!
+}
+
 ##################
 ## Mutation
 ##################
@@ -1799,6 +1922,13 @@ type Mutation {
   updateSettings(input: UpdateSettingsInput!): UpdateSettingsPayload
     @auth(roles: [ADMIN, MODERATOR])
 
+  """
+  regenerateSSOKey will regenerate the SSO key used to sign secrets. This will
+  invalidate any existing user sessions.
+  """
+  regenerateSSOKey(input: RegenerateSSOKeyInput!): RegenerateSSOKeyPayload
+    @auth(roles: [ADMIN])
+
   """
   createCommentReaction will create a Reaction authored by the current logged in
   User on a Comment.