@contember/engine-tenant-api 1.3.0-alpha.8 → 1.3.0-beta.2

package/graphql-tenant.codegen.yml

@@ -6,7 +6,8 @@ config:
 generates:
   ./src/schema/index.ts:
     config:
-      immutableTypes: "1"
+      immutableTypes: true
+      enumsAsTypes: true
     plugins:
       - "typescript"
       - "typescript-operations"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "1.3.0-alpha.8",
+  "version": "1.3.0-beta.2",
   "license": "Apache-2.0",
   "main": "dist/src/index.js",
   "typings": "dist/src/index.d.ts",
@@ -10,19 +10,19 @@
   },
   "scripts": {
     "generate": "gql-gen --config graphql-tenant.codegen.yml",
-    "test": "vitest --no-threads"
+    "test": "vitest --dir ./tests/cases --no-threads"
   },
   "dependencies": {
-    "@contember/authorization": "^1.3.0-alpha.8",
-    "@contember/config-loader": "^1.3.0-alpha.8",
-    "@contember/database": "^1.3.0-alpha.8",
-    "@contember/database-migrations": "^1.3.0-alpha.8",
-    "@contember/dic": "^1.3.0-alpha.8",
-    "@contember/graphql-utils": "^1.3.0-alpha.8",
-    "@contember/logger": "^1.3.0-alpha.8",
-    "@contember/schema": "^1.3.0-alpha.8",
-    "@contember/schema-utils": "^1.3.0-alpha.8",
-    "@contember/typesafe": "^1.3.0-alpha.8",
+    "@contember/authorization": "1.3.0-beta.2",
+    "@contember/config-loader": "1.3.0-beta.2",
+    "@contember/database": "1.3.0-beta.2",
+    "@contember/database-migrations": "1.3.0-beta.2",
+    "@contember/dic": "1.3.0-beta.2",
+    "@contember/graphql-utils": "1.3.0-beta.2",
+    "@contember/logger": "1.3.0-beta.2",
+    "@contember/schema": "1.3.0-beta.2",
+    "@contember/schema-utils": "1.3.0-beta.2",
+    "@contember/typesafe": "1.3.0-beta.2",
     "@graphql-tools/utils": "^8.6.13",
     "graphql-tag": "^2.12.5",
     "jose": "^4.10",
@@ -32,7 +32,7 @@
     "otpauth": "^7.0.6"
   },
   "devDependencies": {
-    "@contember/database-tester": "^1.3.0-alpha.8",
+    "@contember/database-tester": "1.3.0-beta.2",
     "@graphql-codegen/cli": "^2.6.2",
     "@graphql-codegen/typescript": "^2.5.1",
     "@graphql-codegen/typescript-operations": "^2.4.2",
@@ -47,4 +47,4 @@
     "graphql": ">= 14.6.0",
     "pg": "^8.9.0"
   }
-}
+}

package/src/TenantContainer.ts

@@ -4,9 +4,11 @@ import { Builder } from '@contember/dic'
 import {
 	AclSchemaAccessNodeFactory,
 	ApiKeyManager,
-	ApiKeyService, AppleProvider,
+	ApiKeyService,
+	AppleProvider,
 	DatabaseContext,
-	DatabaseContextFactory, FacebookProvider,
+	DatabaseContextFactory,
+	FacebookProvider,
 	Identity,
 	IdentityFactory,
 	IDPHandlerRegistry,
@@ -27,10 +29,12 @@ import {
 	ProjectSchemaResolver,
 	ProjectScopeFactory,
 	Providers,
+	RolesManager,
 	SecretsManager,
 	SignInManager,
 	SignUpManager,
 	UserMailer,
+	PersonAccessManager,
 } from './model'
 import {
 	AddIDPMutationResolver,
@@ -41,6 +45,7 @@ import {
 	DisableApiKeyMutationResolver,
 	DisableIDPMutationResolver,
 	EnableIDPMutationResolver,
+	IdentityGlobalRolesMutationResolver,
 	IdentityTypeResolver,
 	IDPMutationResolver,
 	InviteMutationResolver,
@@ -69,6 +74,8 @@ import { IDPManager } from './model/service/idp/IDPManager'
 import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver'
 import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver'
 import { TenantCredentials, TenantMigrationsRunner } from './migrations'
+import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver'
+import { PersonManager } from './model/service/PersonManager'
 
 export interface TenantContainer {
 	projectMemberManager: ProjectMemberManager
@@ -153,6 +160,10 @@ export class TenantContainerFactory {
 				new SecretsManager(providers))
 			.addService('projectManager', ({ secretManager, apiKeyService }) =>
 				new ProjectManager(secretManager, args.projectInitializer, apiKeyService))
+			.addService('personAccessManager', ({ apiKeyManager }) =>
+				new PersonAccessManager(apiKeyManager))
+			.addService('personManager', () =>
+				new PersonManager())
 			.addService('passwordResetManager', ({ userMailer, projectManager }) =>
 				new PasswordResetManager(userMailer, projectManager))
 			.addService('idpRegistry', () => {
@@ -178,6 +189,8 @@ export class TenantContainerFactory {
 				new OtpManager(otpAuthenticator))
 			.addService('mailTemplateManager', () =>
 				new MailTemplateManager())
+			.addService('rolesManager', () =>
+				new RolesManager())
 
 			.addService('identityTypeResolver', ({ projectMemberManager, projectManager, permissionContextFactory }) =>
 				new IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory))
@@ -231,10 +244,14 @@ export class TenantContainerFactory {
 				new EnableIDPMutationResolver(idpManager))
 			.addService('createProjectMutationResolver', ({ projectManager }) =>
 				new CreateProjectMutationResolver(projectManager))
+			.addService('disablePersonMutationResolver', ({ personAccessManager, personManager }) =>
+				new DisablePersonMutationResolver(personAccessManager, personManager))
 			.addService('updateProjectMutationResolver', ({ projectManager }) =>
 				new UpdateProjectMutationResolver(projectManager))
 			.addService('setProjectSecretMutationResolver', ({ projectManager, secretManager }) =>
 				new SetProjectSecretMutationResolver(projectManager, secretManager))
+			.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) =>
+				new IdentityGlobalRolesMutationResolver(rolesManager))
 			.addService('resolverContextFactory', ({ permissionContextFactory }) =>
 				new TenantResolverContextFactory(permissionContextFactory))
 			.addService('resolvers', container =>

package/src/migrations/2023-01-20-135500-person-email-normalize.ts

@@ -0,0 +1,28 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+WITH
+	normalized AS (
+		SELECT id, email, REGEXP_REPLACE(LOWER(email), '\\s', '', 'g') AS normalized
+		FROM person
+	),
+	not_exist AS (
+		SELECT *
+		FROM normalized
+		 WHERE NOT EXISTS(SELECT FROM person WHERE person.email = normalized.normalized)
+	),
+	uniq AS (
+		SELECT DISTINCT ON (normalized) *
+		FROM not_exist
+		ORDER BY normalized
+	)
+UPDATE person
+SET email = uniq.normalized
+FROM uniq
+WHERE person.id = uniq.id;
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}
+

package/src/migrations/2023-06-03-104000-person-disabled.ts

@@ -0,0 +1,10 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+ALTER TABLE person
+	ADD disabled_at TIMESTAMP WITH TIME ZONE;
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -33,6 +33,8 @@ import _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-
 import _20220707141000persondisplayname from './2022-07-07-141000-person-display-name'
 import _20220714145000personloginoptions from './2022-07-14-145000-person-login-options'
 import _20221108projectupdatenotification from './2022-11-08-project-update-notification'
+import _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize'
+import _20230603104000persondisabled from './2023-06-03-104000-person-disabled'
 import snapshot from './snapshot'
 import { computeTokenHash, Providers } from '../model'
 import { Logger } from '@contember/logger'
@@ -78,6 +80,8 @@ const migrations = {
 	'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,
 	'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,
 	'2022-11-08-project-update-notification': _20221108projectupdatenotification,
+	'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,
+	'2023-06-03-104000-person-disabled': _20230603104000persondisabled,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -74,6 +74,7 @@ CREATE TABLE "person" (
     "otp_activated_at" timestamp with time zone,
     "name" "text",
     "idp_only" boolean DEFAULT false NOT NULL,
+    "disabled_at" timestamp with time zone,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
 CREATE TABLE "person_identity_provider" (

package/src/model/authorization/AclSchemaAccessNodeFactory.ts

@@ -6,23 +6,33 @@ import { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'
 
 export class AclSchemaAccessNodeFactory {
 	create(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {
-		const membershipMatcher = new MembershipMatcher(memberships.map(it => ({
-			...it,
-			matchRule: schema.roles[it.role]?.tenant?.manage ?? {},
-		})))
 
-		const verifier = ({ memberships }: { memberships: readonly Acl.Membership[] }) => {
-			return memberships.every(it => membershipMatcher.matches(it))
+		const createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {
+			const membershipMatcher = new MembershipMatcher(memberships.map(it => ({
+				...it,
+				matchRule: getRule(schema.roles[it.role]?.tenant ?? {}),
+			})))
+
+			return ({ memberships }: { memberships: readonly Acl.Membership[] }) => {
+				return memberships.every(it => membershipMatcher.matches(it))
+			}
 		}
+
 		const membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)
 		const node = new DirectPermissionsAccessNode()
+
 		if (membershipRoles.some(it => it.tenant?.invite)) {
+			const verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})
 			node.allow(PermissionActions.PERSON_INVITE([]), verifier)
 		}
+
 		if (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {
+			const verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})
 			node.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)
 		}
+
 		if (membershipRoles.some(it => it.tenant?.manage)) {
+			const verifier = createVerifier(it => it.manage ?? {})
 			node.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)
 			node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)
 			node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)

package/src/model/authorization/PermissionActions.ts

@@ -13,6 +13,10 @@ namespace PermissionActions {
 	}
 
 	export const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')
+	export const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })
+	export const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
+
+	export const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })
 
 	export const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')
 	export const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })
@@ -39,6 +43,7 @@ namespace PermissionActions {
 	export const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'removeMember', { memberships })
 	export const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'updateMember', { memberships })
 
+
 	export const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')
 	export const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })
 	export const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')

package/src/model/authorization/PermissionsFactory.ts

@@ -4,7 +4,7 @@ import { TenantRole } from './Roles'
 
 const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN])
 
-const projectAdminCreateRolesVerifier = ({ roles }: {roles?: readonly string[]}) => {
+const projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {
 	return roles === undefined || roles.every(it => allowedRoles.has(it))
 }
 
@@ -34,17 +34,25 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminCreateRolesVerifier)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminCreateRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)
+
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)
+
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))
+
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))
+
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)
+
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)

package/src/model/commands/identity/PatchIdentityGlobalRoles.ts

@@ -0,0 +1,28 @@
+import { Command } from '../Command'
+import { UpdateBuilder } from '@contember/database'
+
+export class PatchIdentityGlobalRoles implements Command<boolean> {
+	constructor(
+		private readonly id: string,
+		private readonly add: readonly string[],
+		private readonly remove: readonly string[],
+	) {
+	}
+
+	public async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const result = await UpdateBuilder.create()
+			.table('identity')
+			.where({
+				id: this.id,
+			})
+			.values({
+				roles: it => it.raw(`(
+						SELECT JSONB_AGG(DISTINCT out_role)
+						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
+						WHERE NOT(out_role = ANY (?::text[]))
+					)`, JSON.stringify(this.add), this.remove),
+			})
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/identity/index.ts

@@ -1 +1,2 @@
 export * from './CreateIdentityCommand'
+export * from './PatchIdentityGlobalRoles'

package/src/model/commands/membership/AddProjectMemberCommand.ts

@@ -4,7 +4,7 @@ import { Response, ResponseError, ResponseOk } from '../../utils/Response'
 import { SelectBuilder } from '@contember/database'
 import { MembershipInput } from './types'
 
-type CommandResponse = Response<undefined, AddProjectMemberCommandError>
+type CommandResponse = Response<null, AddProjectMemberCommandError>
 
 export class AddProjectMemberCommand implements Command<CommandResponse> {
 	constructor(
@@ -24,7 +24,7 @@ export class AddProjectMemberCommand implements Command<CommandResponse> {
 			.getResult(db)
 		if (result.length > 0) {
 			return new ResponseError(
-				AddProjectMemberCommandError.alreadyMember,
+				'ALREADY_MEMBER',
 				`This identity is already a project member. Use updateProjectMember mutation to change memberships.`,
 			)
 		}
@@ -33,16 +33,16 @@ export class AddProjectMemberCommand implements Command<CommandResponse> {
 			for (const membership of this.memberships) {
 				await bus.execute(new CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membership))
 			}
-			return new ResponseOk(undefined)
+			return new ResponseOk(null)
 		} catch (e) {
 			if (!(e instanceof Error)) {
 				throw e
 			}
 			switch ((e as any).constraint) {
 				case 'project_membership_project':
-					return new ResponseError(AddProjectMemberCommandError.projectNotFound, 'Project not found')
+					return new ResponseError('PROJECT_NOT_FOUND', 'Project not found')
 				case 'project_membership_identity':
-					return new ResponseError(AddProjectMemberCommandError.identityNotfound, 'Identity not found')
+					return new ResponseError('IDENTITY_NOT_FOUND', 'Identity not found')
 				default:
 					throw e
 			}
@@ -50,8 +50,7 @@ export class AddProjectMemberCommand implements Command<CommandResponse> {
 	}
 }
 
-export enum AddProjectMemberCommandError {
-	alreadyMember,
-	projectNotFound,
-	identityNotfound,
-}
+export type AddProjectMemberCommandError =
+	| 'ALREADY_MEMBER'
+	| 'PROJECT_NOT_FOUND'
+	| 'IDENTITY_NOT_FOUND'

package/src/model/commands/membership/RemoveProjectMemberCommand.ts

@@ -17,7 +17,7 @@ export class RemoveProjectMemberCommand implements Command<RemoveProjectMemberRe
 			.execute(db)
 
 		if (result === 0) {
-			return new ResponseError(RemoveProjectMemberErrorCode.NotMember, 'Not a project member')
+			return new ResponseError('NOT_MEMBER', 'Not a project member')
 		}
 		return new ResponseOk(null)
 	}

package/src/model/commands/membership/UpdateProjectMemberCommand.ts

@@ -23,7 +23,7 @@ export class UpdateProjectMemberCommand implements Command<UpdateProjectMemberRe
 			})
 			.getResult(db)
 		if (result.length === 0) {
-			return new ResponseError(UpdateProjectMemberErrorCode.NotMember, 'Not a project member')
+			return new ResponseError('NOT_MEMBER', 'Not a project member')
 		}
 
 		try {
@@ -44,7 +44,7 @@ export class UpdateProjectMemberCommand implements Command<UpdateProjectMemberRe
 			}
 			switch ((e as any).constraint) {
 				case 'project_membership_project':
-					return new ResponseError(UpdateProjectMemberErrorCode.ProjectNotFound, 'Project not found')
+					return new ResponseError('PROJECT_NOT_FOUND', 'Project not found')
 				default:
 					throw e
 			}

package/src/model/commands/passwordReset/ResetPasswordCommand.ts

@@ -23,20 +23,14 @@ export class ResetPasswordCommand implements Command<ResetPasswordCommandRespons
 					.getResult(db)
 			)[0] || null
 		if (!result) {
-			return new ResponseError(ResetPasswordCommandErrorCode.TOKEN_NOT_FOUND, 'Token was not found')
+			return new ResponseError('TOKEN_NOT_FOUND', 'Token was not found')
 		}
 		if (result.used_at) {
-			return new ResponseError(
-				ResetPasswordCommandErrorCode.TOKEN_USED,
-				`Token was used at ${result.used_at.toISOString()}`,
-			)
+			return new ResponseError('TOKEN_USED', `Token was used at ${result.used_at.toISOString()}`)
 		}
 		const now = providers.now()
 		if (result.expires_at < now) {
-			return new ResponseError(
-				ResetPasswordCommandErrorCode.TOKEN_EXPIRED,
-				`Token expired at ${result.expires_at.toISOString()}`,
-			)
+			return new ResponseError('TOKEN_EXPIRED', `Token expired at ${result.expires_at.toISOString()}`)
 		}
 		const count = await UpdateBuilder.create()
 			.table('person_password_reset')
@@ -52,13 +46,12 @@ export class ResetPasswordCommand implements Command<ResetPasswordCommandRespons
 
 		await bus.execute(new ChangePasswordCommand(result.person_id, this.password))
 
-		return new ResponseOk(undefined)
+		return new ResponseOk(null)
 	}
 }
-export enum ResetPasswordCommandErrorCode {
-	TOKEN_NOT_FOUND = 'TOKEN_NOT_FOUND',
-	TOKEN_USED = 'TOKEN_USED',
-	TOKEN_EXPIRED = 'TOKEN_EXPIRED',
-}
+export type ResetPasswordCommandErrorCode =
+	|  'TOKEN_NOT_FOUND'
+	|  'TOKEN_USED'
+	|  'TOKEN_EXPIRED'
 
-export type ResetPasswordCommandResponse = Response<undefined, ResetPasswordCommandErrorCode>
+export type ResetPasswordCommandResponse = Response<null, ResetPasswordCommandErrorCode>

package/src/model/commands/person/CreatePersonCommand.ts

@@ -1,7 +1,8 @@
 import { Command } from '../Command'
 import { PersonRow } from '../../queries'
-import { InsertBuilder } from '@contember/database'
+import { InsertBuilder, Literal } from '@contember/database'
 import { MaybePassword } from '../../dtos/Password'
+import { normalizeEmail } from '../../utils/email'
 
 export class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {
 	constructor(private readonly data: {
@@ -16,12 +17,14 @@ export class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {
 		const id = providers.uuid()
 
 		const password_hash = await this.data.password.getHash(providers)
+		const email = this.data.email ? normalizeEmail(this.data.email) : null
+		const name = this.data.name ?? this.data.email?.split('@')[0] ?? null
 		await InsertBuilder.create()
 			.into('person')
 			.values({
 				id: id,
-				email: this.data.email ?? null,
-				name: this.data.name ?? this.data.email?.split('@')[0] ?? null,
+				email,
+				name: name,
 				password_hash,
 				identity_id: this.data.identityId,
 				idp_only: this.data.idpOnly ?? false,
@@ -30,11 +33,13 @@ export class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {
 
 		return {
 			id,
-			email: this.data.email,
+			email,
+			name,
 			password_hash, identity_id:
 			this.data.identityId,
 			otp_uri: null,
 			otp_activated_at: null,
+			disabled_at: null,
 		}
 	}
 }

package/src/model/commands/person/DisablePersonCommand.ts

@@ -0,0 +1,18 @@
+import { Command } from '../Command'
+import { UpdateBuilder } from '@contember/database'
+
+export class DisablePersonCommand implements Command<void> {
+	constructor(private readonly personId: string) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await UpdateBuilder.create()
+			.table('person')
+			.values({
+				disabled_at: new Date(),
+			})
+			.where({
+				id: this.personId,
+			})
+			.execute(db)
+	}
+}

package/src/model/queries/apiKey/ApiKeyQuery.ts

@@ -0,0 +1,64 @@
+import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'
+import { ApiKey } from '../../type'
+import { computeTokenHash } from '../../utils'
+
+export class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {
+	constructor(private readonly apiKeyId: string) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {
+		const rows = await apiKeyBaseQuery
+			.where(
+				where => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),
+			)
+			.getResult(db)
+
+		return this.fetchOneOrNull(rows)
+	}
+}
+
+export class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {
+	constructor(private readonly token: string) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {
+		const tokenHash = computeTokenHash(this.token)
+		const rows = await apiKeyBaseQuery
+			.where({ token_hash: tokenHash })
+			.getResult(db)
+
+		return this.fetchOneOrNull(rows)
+	}
+}
+
+export type ApiKeyRow = {
+	readonly id: string
+	readonly type: ApiKey.Type
+	readonly identity_id: string
+	readonly disabled_at: Date | null
+	readonly expires_at: Date | null
+	readonly expiration: number | null
+	readonly roles: string[]
+	readonly person_id: string | null
+}
+
+const apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()
+	.select(['api_key', 'id'])
+	.select(['api_key', 'type'])
+	.select(['api_key', 'identity_id'])
+	.select(['api_key', 'disabled_at'])
+	.select(['api_key', 'expires_at'])
+	.select(['identity', 'roles'])
+	.select(['api_key', 'expiration'])
+	.select(['person', 'id'], 'person_id')
+	.from('api_key')
+	.join('identity', 'identity', joinClause =>
+		joinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']),
+	)
+	.leftJoin(
+		'person', 'person', on => on.compareColumns(
+			['person', 'identity_id'], Operator.eq, ['identity', 'id'],
+		),
+	)

package/src/model/queries/apiKey/index.ts

@@ -1 +1 @@
-export * from './ApiKeyByTokenQuery'
+export * from './ApiKeyQuery'

package/src/model/queries/idp/types.ts

@@ -4,7 +4,7 @@ export type IdentityProviderRow = {
 	id: string
 	slug: string
 	type: string
-	disabledAt: Date | unknown
+	disabledAt: Date | null
 	configuration: Record<string, unknown>
 	autoSignUp: boolean
 	exclusive: boolean
@@ -13,6 +13,6 @@ export type IdentityProviderRow = {
 export type IdentityProviderDto =
 	& {
 		id: string
-		disabledAt: Date | unknown
+		disabledAt: Date | null
 	}
 	& IdentityProviderData

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -24,7 +24,7 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 			))
 			.match(qb => {
 				const { email, memberType } = this.projectMemberInput.filter ?? {}
-				if (email && memberType === MemberType.ApiKey) {
+				if (email && memberType === 'API_KEY') {
 					throw new ImplementationException()
 				}
 				const personQuery = SelectBuilder.create()
@@ -34,9 +34,9 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 					return qb.where(it => it.exists(personQuery.where({ email })))
 				}
 				switch (memberType) {
-					case MemberType.ApiKey:
+					case 'API_KEY':
 						return qb.where(it => it.not(it => it.exists(personQuery)))
-					case MemberType.Person:
+					case 'PERSON':
 						return qb.where(it => it.exists(personQuery))
 				}
 				return qb