@contember/engine-tenant-api 1.2.1 → 1.3.0-alpha.2

package/src/migrations/2022-11-08-project-update-notification.ts

@@ -0,0 +1,64 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+CREATE FUNCTION project_updated()
+	RETURNS TRIGGER AS
+$$
+BEGIN
+	NEW.updated_at = 'now';
+	PERFORM pg_notify('project_updated', new.id::text);
+	RETURN new;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE FUNCTION project_deleted()
+	RETURNS TRIGGER AS
+$$
+BEGIN
+	PERFORM pg_notify('project_updated', old.id::text);
+	RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+
+CREATE FUNCTION project_secret_updated()
+	RETURNS TRIGGER AS
+$$
+BEGIN
+	UPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);
+	PERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);
+	RETURN NULL;
+END;
+$$ LANGUAGE plpgsql;
+
+CREATE TRIGGER project_updated
+	BEFORE INSERT OR UPDATE OF name, slug, config
+	ON project
+	FOR EACH ROW
+EXECUTE PROCEDURE project_updated();
+
+CREATE TRIGGER project_deleted
+	AFTER DELETE
+	ON project
+	FOR EACH ROW
+EXECUTE PROCEDURE project_deleted();
+
+CREATE TRIGGER project_secret_updated
+	AFTER DELETE OR INSERT OR UPDATE
+	ON project_secret
+	FOR EACH ROW
+EXECUTE PROCEDURE project_secret_updated();
+
+
+DO LANGUAGE plpgsql
+$$
+	BEGIN
+		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
+	END
+$$;
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}
+

package/src/migrations/runner.ts

@@ -1,7 +1,39 @@
 import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'
 import { TenantMigrationArgs } from './types'
-import { loadMigrations, Migration, MigrationsRunner as DbMigrationsRunner } from '@contember/database-migrations'
-import tenantCredentials from './2020-06-08-134000-tenant-credentials'
+import { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'
+import _20180802174310init from './2018-08-02-174310-init'
+import _20180903140621identityproject from './2018-09-03-140621-identity-project'
+import _20181026165450setupapikey from './2018-10-26-165450-setup-api-key'
+import _20181026175155variables from './2018-10-26-175155-variables'
+import _20190218110949projectslug from './2019-02-18-110949-project-slug'
+import _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration'
+import _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at'
+import _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique'
+import _20190906111000membership from './2019-09-06-111000-membership'
+import _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member'
+import _20200129idenitynote from './2020-01-29-idenity-note'
+import _20200417fixpersonindex from './2020-04-17-fix-person-index'
+import _20200501170000apikeyindex from './2020-05-01-170000-api-key-index'
+import _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials'
+import _20200807110000personotp from './2020-08-07-110000-person-otp'
+import _20200817162200mailtemplates from './2020-08-17-162200-mail-templates'
+import _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset'
+import _20200907094200identityprovider from './2020-09-07-094200-identity-provider'
+import _20210328134000timestamp from './2021-03-28-134000-timestamp'
+import _20210726105000projectconfig from './2021-07-26-105000-project-config'
+import _20210726132000projectsecrets from './2021-07-26-132000-project-secrets'
+import _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index'
+import _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null'
+import _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null'
+import _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity'
+import _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted'
+import _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up'
+import _20220629105000personidp from './2022-06-29-105000-person-idp'
+import _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq'
+import _20220707141000persondisplayname from './2022-07-07-141000-person-display-name'
+import _20220714145000personloginoptions from './2022-07-14-145000-person-login-options'
+import _20221108projectupdatenotification from './2022-11-08-project-update-notification'
+import snapshot from './snapshot'
 import { computeTokenHash, Providers } from '../model'
 import { Logger } from '@contember/logger'
 
@@ -13,10 +45,39 @@ export interface TenantCredentials {
 	rootPassword?: string
 }
 
-const getMigrations = (): Promise<Migration<TenantMigrationArgs>[]> => {
-	return loadMigrations(process.env.CONTEMBER_TENANT_MIGRATIONS_DIR || __dirname, [
-		new Migration('2020-06-08-134000-tenant-credentials', tenantCredentials),
-	])
+const migrations = {
+	'2018-08-02-174310-init': _20180802174310init,
+	'2018-09-03-140621-identity-project': _20180903140621identityproject,
+	'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,
+	'2018-10-26-175155-variables': _20181026175155variables,
+	'2019-02-18-110949-project-slug': _20190218110949projectslug,
+	'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,
+	'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,
+	'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,
+	'2019-09-06-111000-membership': _20190906111000membership,
+	'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,
+	'2020-01-29-idenity-note': _20200129idenitynote,
+	'2020-04-17-fix-person-index': _20200417fixpersonindex,
+	'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,
+	'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,
+	'2020-08-07-110000-person-otp': _20200807110000personotp,
+	'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,
+	'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,
+	'2020-09-07-094200-identity-provider': _20200907094200identityprovider,
+	'2021-03-28-134000-timestamp': _20210328134000timestamp,
+	'2021-07-26-105000-project-config': _20210726105000projectconfig,
+	'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,
+	'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,
+	'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,
+	'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,
+	'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,
+	'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,
+	'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,
+	'2022-06-29-105000-person-idp': _20220629105000personidp,
+	'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,
+	'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,
+	'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,
+	'2022-11-08-project-update-notification': _20221108projectupdatenotification,
 }
 
 export class TenantMigrationsRunner {
@@ -24,7 +85,7 @@ export class TenantMigrationsRunner {
 		private readonly db: DatabaseConfig,
 		private readonly schema: string,
 		private readonly tenantCredentials: TenantCredentials,
-		private readonly providers: Providers,
+		private readonly providers: Pick<Providers, 'bcrypt' | 'uuid'>,
 	) {
 	}
 
@@ -32,7 +93,9 @@ export class TenantMigrationsRunner {
 		await createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))
 		const connection = Connection.createSingle(this.db, err => logger.error(err))
 		const result = await connection.scope(async connection => {
-			const innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, getMigrations)
+			const migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)
+
+			const innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)
 			return await innerRunner.migrate(message => logger.warn(message), {
 				getCredentials: async () => ({
 					loginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,
@@ -41,6 +104,7 @@ export class TenantMigrationsRunner {
 					rootEmail: this.tenantCredentials.rootEmail,
 					rootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,
 				}),
+				providers: this.providers,
 			})
 		})
 		await connection.end()

package/src/migrations/snapshot-factory.ts

@@ -0,0 +1,21 @@
+import { MigrationArgs, MigrationBuilder } from '@contember/database-migrations'
+import { TenantMigrationArgs } from './types'
+import { createCredentials } from './tenantCredentials'
+
+export default async (sqlFactory: () => string) => {
+	return async (builder: MigrationBuilder, args: MigrationArgs<TenantMigrationArgs>) => {
+
+		const sql = sqlFactory()
+		builder.sql(sql)
+
+		builder.sql(`DO LANGUAGE plpgsql
+$$
+	BEGIN
+		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
+	END
+$$;
+`)
+
+		await createCredentials(builder, args)
+	}
+}

package/src/migrations/snapshot-template-end.txt

@@ -0,0 +1,10 @@
+DO LANGUAGE plpgsql
+$$
+	BEGIN
+		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
+	END
+$$;
+`)
+
+	await createCredentials(builder, args)
+}

package/src/migrations/snapshot-template-start.txt

@@ -0,0 +1,6 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+import { TenantMigrationArgs } from './types'
+import { createCredentials } from './tenantCredentials'
+
+export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
+	builder.sql(`

package/src/migrations/snapshot.ts

@@ -0,0 +1,202 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+import { TenantMigrationArgs } from './types'
+import { createCredentials } from './tenantCredentials'
+
+export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
+	builder.sql(`
+CREATE FUNCTION "project_deleted"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	PERFORM pg_notify('project_updated', old.id::text);
+	RETURN NULL;
+END;
+$$;
+CREATE FUNCTION "project_secret_updated"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	UPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);
+	PERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);
+	RETURN NULL;
+END;
+$$;
+CREATE FUNCTION "project_updated"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	NEW.updated_at = 'now';
+	PERFORM pg_notify('project_updated', new.id::text);
+	RETURN new;
+END;
+$$;
+CREATE TABLE "api_key" (
+    "id" "uuid" NOT NULL,
+    "token_hash" "text" NOT NULL,
+    "type" "text" NOT NULL,
+    "identity_id" "uuid" NOT NULL,
+    "expires_at" timestamp with time zone,
+    "created_at" timestamp with time zone NOT NULL,
+    "expiration" integer,
+    "disabled_at" timestamp with time zone
+);
+CREATE TABLE "identity" (
+    "id" "uuid" NOT NULL,
+    "parent_id" "uuid",
+    "roles" "jsonb" NOT NULL,
+    "description" "text",
+    "created_at" timestamp with time zone NOT NULL
+);
+CREATE TABLE "identity_provider" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "type" "text" NOT NULL,
+    "configuration" "jsonb" NOT NULL,
+    "disabled_at" timestamp with time zone,
+    "auto_sign_up" boolean DEFAULT false NOT NULL,
+    "exclusive" boolean DEFAULT false
+);
+CREATE TABLE "mail_template" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid",
+    "mail_type" "text" NOT NULL,
+    "variant" "text" NOT NULL,
+    "subject" "text" NOT NULL,
+    "content" "text" NOT NULL,
+    "use_layout" boolean NOT NULL
+);
+CREATE TABLE "person" (
+    "id" "uuid" NOT NULL,
+    "email" "text",
+    "password_hash" "text",
+    "identity_id" "uuid" NOT NULL,
+    "otp_uri" "text",
+    "otp_activated_at" timestamp with time zone,
+    "name" "text",
+    "idp_only" boolean DEFAULT false NOT NULL,
+    CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
+);
+CREATE TABLE "person_identity_provider" (
+    "id" "uuid" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "identity_provider_id" "uuid" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "external_identifier" "text" NOT NULL
+);
+CREATE TABLE "person_password_reset" (
+    "id" "uuid" NOT NULL,
+    "token_hash" "text" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "expires_at" timestamp with time zone NOT NULL,
+    "created_at" timestamp with time zone NOT NULL,
+    "used_at" timestamp with time zone
+);
+CREATE TABLE "project" (
+    "id" "uuid" NOT NULL,
+    "name" "text" NOT NULL,
+    "slug" "text" NOT NULL,
+    "config" "jsonb" DEFAULT '{}'::"jsonb" NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL
+);
+CREATE TABLE "project_membership" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid" NOT NULL,
+    "identity_id" "uuid" NOT NULL,
+    "role" "text" NOT NULL
+);
+CREATE TABLE "project_membership_variable" (
+    "id" "uuid" NOT NULL,
+    "membership_id" "uuid" NOT NULL,
+    "variable" "text" NOT NULL,
+    "value" "jsonb" NOT NULL
+);
+CREATE TABLE "project_secret" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid" NOT NULL,
+    "key" "text" NOT NULL,
+    "created_at" timestamp with time zone NOT NULL,
+    "updated_at" timestamp with time zone NOT NULL,
+    "value" "bytea" NOT NULL,
+    "version" smallint NOT NULL
+);
+ALTER TABLE ONLY "api_key"
+    ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "email_unique" UNIQUE ("email");
+ALTER TABLE ONLY "identity"
+    ADD CONSTRAINT "identity_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "identity_provider"
+    ADD CONSTRAINT "identity_provider_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "identity_provider"
+    ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
+ALTER TABLE ONLY "mail_template"
+    ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_password_reset"
+    ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project"
+    ADD CONSTRAINT "project_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_unique" UNIQUE ("membership_id", "variable");
+ALTER TABLE ONLY "project_secret"
+    ADD CONSTRAINT "project_secret_pkey" PRIMARY KEY ("id");
+CREATE INDEX "api_key_identity_id" ON "api_key" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "api_key_token_hash" ON "api_key" USING "btree" ("token_hash");
+CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
+CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
+CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
+CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
+CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
+CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
+CREATE UNIQUE INDEX "person_password_reset_token" ON "person_password_reset" USING "btree" ("token_hash");
+CREATE INDEX "project_alias" ON "project" USING "gin" ((("config" -> 'alias'::"text")));
+CREATE INDEX "project_membership_identity_index" ON "project_membership" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "btree" ("project_id", "identity_id", "role");
+CREATE INDEX "project_secret_project_index" ON "project_secret" USING "btree" ("project_id");
+CREATE UNIQUE INDEX "project_secret_unique" ON "project_secret" USING "btree" ("project_id", "key");
+CREATE UNIQUE INDEX "project_slug" ON "project" USING "btree" ("slug");
+CREATE TRIGGER "project_deleted" AFTER DELETE ON "project" FOR EACH ROW EXECUTE FUNCTION "project_deleted"();
+CREATE TRIGGER "project_secret_updated" AFTER INSERT OR DELETE OR UPDATE ON "project_secret" FOR EACH ROW EXECUTE FUNCTION "project_secret_updated"();
+CREATE TRIGGER "project_updated" BEFORE INSERT OR UPDATE OF "name", "slug", "config" ON "project" FOR EACH ROW EXECUTE FUNCTION "project_updated"();
+ALTER TABLE ONLY "api_key"
+    ADD CONSTRAINT "api_key_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "identity"
+    ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "mail_template"
+    ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_password_reset"
+    ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_identity" FOREIGN KEY ("identity_id") REFERENCES "identity"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_membership" FOREIGN KEY ("membership_id") REFERENCES "project_membership"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_secret"
+    ADD CONSTRAINT "project_secret_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+DO LANGUAGE plpgsql
+$$
+	BEGIN
+		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
+	END
+$$;
+`)
+
+	await createCredentials(builder, args)
+}

package/src/migrations/tenantCredentials.ts

@@ -0,0 +1,58 @@
+import { escapeValue, MigrationBuilder } from '@contember/database-migrations'
+import { TenantMigrationArgs } from './types'
+
+export const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {
+	const credentials = await args.getCredentials()
+	if (credentials.loginTokenHash) {
+		const tokenHash = credentials.loginTokenHash
+		builder.sql(`
+			WITH identity AS (
+			    INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (${escapeValue(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
+			)
+			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+			SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+			FROM identity
+			`)
+	}
+
+	if (!credentials.rootTokenHash) {
+		throw 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'
+	}
+
+	if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
+		throw 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'
+	}
+	const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null
+	const rootPasswordHash = credentials.rootPasswordBcrypted || null
+
+	const rootTokenHash = credentials.rootTokenHash
+
+	builder.sql(`
+			WITH identity AS (
+				INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (
+						${escapeValue(args.providers.uuid())},
+						NULL,
+						'["super_admin"]'::JSONB
+							|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
+						'Superadmin',
+						now()
+					) RETURNING id
+			),
+			person AS (
+				INSERT INTO person(id, email, password_hash, identity_id)
+				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id
+				FROM identity
+				WHERE ${escapeValue(rootEmail)} IS NOT NULL
+			    RETURNING id
+			),
+			api_key AS (
+				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+				FROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL
+			    RETURNING id
+			)
+			SELECT * FROM person, api_key
+		`)
+}

package/src/migrations/types.ts

@@ -1,3 +1,5 @@
+import { Providers } from '../model'
+
 export interface TenantMigrationArgs {
 	getCredentials: () =>  Promise<{
 		loginTokenHash?: string
@@ -5,4 +7,5 @@ export interface TenantMigrationArgs {
 		rootTokenHash?: string
 		rootPasswordBcrypted?: string
 	}>
+	providers: Pick<Providers, 'uuid'>
 }

package/src/model/commands/idp/UpdateIdpCommand.ts

@@ -28,4 +28,5 @@ export class UpdateIdpCommand implements Command<void> {
 export type UpdateIdpData = {
 	options?: Partial<IdentityProviderData['options']>
 	configuration?: IdentityProviderData['configuration']
+	type?: string
 }

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -1,10 +1,12 @@
-import { ConditionBuilder, DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'
-import { MemberType } from '../../../schema'
+import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'
+import { MemberType, ProjectMembersInput } from '../../../schema'
+import { ImplementationException } from '../../../exceptions'
 
 export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {
+
 	constructor(
 		private readonly projectId: string,
-		private readonly memberType?: MemberType,
+		private readonly projectMemberInput: ProjectMembersInput,
 	) {
 		super()
 	}
@@ -17,22 +19,29 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 			.where(it => it.exists(
 				builder => builder
 					.from('project_membership')
-					.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id'])),
+					.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))
+					.where({ project_id: this.projectId }),
 			))
 			.match(qb => {
-				if (!this.memberType) {
-					return qb
+				const { email, memberType } = this.projectMemberInput.filter ?? {}
+				if (email && memberType === MemberType.ApiKey) {
+					throw new ImplementationException()
+				}
+				const personQuery = SelectBuilder.create()
+					.from('person')
+					.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))
+				if (email) {
+					return qb.where(it => it.exists(personQuery.where({ email })))
 				}
-				const expr = ConditionBuilder.create().exists(
-					builder => builder
-						.from('person')
-						.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id'])),
-				)
-				if (this.memberType === MemberType.Person) {
-					return qb.where(expr)
+				switch (memberType) {
+					case MemberType.ApiKey:
+						return qb.where(it => it.not(it => it.exists(personQuery)))
+					case MemberType.Person:
+						return qb.where(it => it.exists(personQuery))
 				}
-				return qb.where(ConditionBuilder.not(expr))
+				return qb
 			})
+			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)
 			.getResult(db)
 	}
 }

package/src/model/service/IDPSignInManager.ts

@@ -1,6 +1,6 @@
 import { ApiKeyManager } from './apiKey'
 import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPClaim, IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp'
+import { IDPClaim, IDPHandlerRegistry, IDPResponseError, IDPValidationError } from './idp'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { InitSignInIdpErrorCode, SignInIdpErrorCode } from '../../schema'
 import { DatabaseContext } from '../utils'
@@ -18,9 +18,7 @@ class IDPSignInManager {
 	async signInIDP(
 		dbContext: DatabaseContext,
 		idpSlug: string,
-		redirectUrl: string,
-		idpResponse: IDPResponse,
-		sessionData: any,
+		responseData: unknown,
 		expiration?: number,
 	): Promise<IDPSignInManager.SignInIDPResponse> {
 		return dbContext.transaction(async db => {
@@ -34,9 +32,7 @@ class IDPSignInManager {
 			try {
 				claim = await providerService.processResponse(
 					validatedConfig,
-					redirectUrl,
-					idpResponse,
-					sessionData,
+					responseData,
 				)
 			} catch (e) {
 				if (e instanceof IDPResponseError) {
@@ -57,15 +53,22 @@ class IDPSignInManager {
 		})
 	}
 
-	async initSignInIDP(dbContext: DatabaseContext, idpSlug: string, redirectUrl: string): Promise<IDPSignInManager.InitSignInIDPResponse> {
+	async initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {
 		const provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))
 		if (!provider || provider.disabledAt) {
 			return new ResponseError(InitSignInIdpErrorCode.ProviderNotFound, `Identity provider ${idpSlug} not found`)
 		}
 		const providerService = this.idpRegistry.getHandler(provider.type)
 		const validatedConfig = providerService.validateConfiguration(provider.configuration)
-		const initResponse = await providerService.initAuth(validatedConfig, redirectUrl)
-		return new ResponseOk(initResponse)
+		try {
+			const initResponse = await providerService.initAuth(validatedConfig, data)
+			return new ResponseOk(initResponse)
+		} catch (e) {
+			if (e instanceof IDPValidationError) {
+				return new ResponseError(InitSignInIdpErrorCode.IdpValidationFailed, e.message)
+			}
+			throw e
+		}
 	}
 
 	private async resolvePerson(db: DatabaseContext, claim: IDPClaim, provider: IdentityProviderRow): Promise<PersonRow | null> {

package/src/model/service/ProjectMemberManager.ts

@@ -8,7 +8,7 @@ import {
 	UpdateProjectMemberResponse,
 } from '../commands'
 import { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'
-import { AddProjectMemberErrorCode, MemberType } from '../../schema'
+import { AddProjectMemberErrorCode, MemberType, ProjectMembersInput } from '../../schema'
 import { AccessVerifier, PermissionActions, TenantRole } from '../authorization'
 import { indexListBy, notEmpty } from '../../utils/array'
 import { createSetMembershipVariables } from './membershipUtils'
@@ -105,9 +105,9 @@ export class ProjectMemberManager {
 	}
 
 
-	async getProjectMembers(dbContext: DatabaseContext, projectId: string, accessVerifier: AccessVerifier, memberType?: MemberType): Promise<GetProjectMembersResponse> {
+	async getProjectMembers(dbContext: DatabaseContext, projectId: string, accessVerifier: AccessVerifier, input: ProjectMembersInput): Promise<GetProjectMembersResponse> {
 		return dbContext.transaction(async db => {
-			const members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, memberType))
+			const members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))
 			const memberships = await db.queryHandler.fetch(
 				new ProjectMembershipByIdentityQuery(
 					{ id: projectId },

package/src/model/service/idp/IDPHandlerRegistry.ts

@@ -2,13 +2,13 @@ import { IdentityProviderHandler } from './IdentityProviderHandler'
 import { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'
 
 export class IDPHandlerRegistry {
-	private providers: Record<string, IdentityProviderHandler<any, any>> = {}
+	private providers: Record<string, IdentityProviderHandler<any>> = {}
 
-	public registerHandler(type: string, provider: IdentityProviderHandler<any, any>): void {
+	public registerHandler(type: string, provider: IdentityProviderHandler<any>): void {
 		this.providers[type] = provider
 	}
 
-	public getHandler(type: string): IdentityProviderHandler<any, any> {
+	public getHandler(type: string): IdentityProviderHandler<{}> {
 		const provider = this.providers[type]
 		if (!provider) {
 			throw new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)