@contember/engine-tenant-api 2.1.0-alpha.16 → 2.1.0-alpha.17

package/src/model/service/IDPSignInManager.ts

@@ -8,6 +8,7 @@ import { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProvide
 import { TenantRole } from '../authorization'
 import { NoPassword } from '../dtos'
 import { IdentityProviderRow } from '../queries/idp/types'
+import { AuthLogService } from './AuthLogService'
 
 class IDPSignInManager {
 	constructor(
@@ -36,25 +37,56 @@ class IDPSignInManager {
 				)
 			} catch (e) {
 				if (e instanceof IDPResponseError) {
-					return new ResponseError('INVALID_IDP_RESPONSE', e.message)
+					return new ResponseError('INVALID_IDP_RESPONSE', e.message, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: undefined,
+							identityProviderId: provider.id,
+						}),
+					})
 				}
 				if (e instanceof IDPValidationError) {
-					return new ResponseError('IDP_VALIDATION_FAILED', e.message)
+					return new ResponseError('IDP_VALIDATION_FAILED', e.message, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: undefined,
+							identityProviderId: provider.id,
+						}),
+					})
 				}
 				throw e
 			}
 			const personRow = await this.resolvePerson(db, claim, provider)
 
 			if (!personRow) {
-				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`)
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						identityProviderId: provider.id,
+						personInput: claim.email,
+						personId: undefined,
+					}),
+				})
 			}
 
 			if (personRow.disabled_at !== null) {
-				return new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`)
+				return new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						identityProviderId: provider.id,
+						personInput: claim.email,
+						personId: personRow.id,
+					}),
+				})
 			}
 
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
-			return new ResponseOk({ person: personRow, token: sessionToken, idpResponse: claim })
+			return new ResponseOk({
+				person: personRow,
+				token: sessionToken,
+				idpResponse: claim,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: personRow.id,
+					identityProviderId: provider.id,
+					personInput: claim.email,
+				}),
+			})
 		})
 	}
 
@@ -137,9 +169,12 @@ namespace IDPSignInManager {
 		readonly person: PersonRow
 		readonly token: string
 		readonly idpResponse?: Record<string, unknown>
+		[AuthLogService.Key]: AuthLogService.Bag
 	}
 
-	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode>
+	export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 }
 
 export { IDPSignInManager }

package/src/model/service/PasswordChangeManager.ts

@@ -1,29 +1,32 @@
-import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'
+import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'
 import { ChangePasswordCommand } from '../commands'
-import { getPasswordWeaknessMessage } from '../utils/password'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
-import { PersonRow } from '../queries'
+import { ConfigurationQuery, PersonRow } from '../queries'
 import { Providers } from '../providers'
 import { DatabaseContext } from '../utils'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
 
 class PasswordChangeManager {
 	constructor(
 		private readonly providers: Providers,
+		private readonly passwordStrengthVerifier: PasswordStrengthValidator,
 	) {}
 
-	async changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+	async changePassword(dbContext: DatabaseContext, person: PersonRow, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')
+		if (!passwordVerifyResult.ok) {
+			return passwordVerifyResult
 		}
-		await dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))
+		await dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))
 		return new ResponseOk(null)
 	}
 
 	async changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')
+		if (!passwordVerifyResult.ok) {
+			return passwordVerifyResult
 		}
 		if (!person.password_hash) {
 			return new ResponseError('NO_PASSWORD_SET', 'No password set')
@@ -38,7 +41,9 @@ class PasswordChangeManager {
 }
 
 namespace PasswordChangeManager {
-	export type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>
+	export type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {
+		weakPasswordReasons?: WeakPasswordReason[]
+	}>
 }
 
 export { PasswordChangeManager }

package/src/model/service/PasswordResetManager.ts

@@ -1,13 +1,16 @@
-import { Response, ResponseError } from '../utils/Response'
-import { getPasswordWeaknessMessage } from '../utils/password'
+import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { UserMailer } from '../mailing'
-import { PersonRow } from '../queries'
+import { ConfigurationQuery, PersonRow } from '../queries'
 import { PermissionContext } from '../authorization'
 import { ProjectManager } from './ProjectManager'
 import { DatabaseContext } from '../utils'
 import { ImplementationException } from '../../exceptions'
 import { getPreferredProject } from './helpers/getPreferredProject'
-import { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'
+import { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
+import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'
+import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
+import { AuthLogService } from './AuthLogService'
 
 interface MailOptions {
 	project?: string
@@ -18,6 +21,7 @@ export class PasswordResetManager {
 	constructor(
 		private readonly mailer: UserMailer,
 		private readonly projectManager: ProjectManager,
+		private readonly passwordStrengthValidator: PasswordStrengthValidator,
 	) { }
 
 	public async createPasswordResetRequest(
@@ -49,14 +53,41 @@ export class PasswordResetManager {
 	}
 
 	public async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {
-		const weakPassword = getPasswordWeaknessMessage(password)
-		if (weakPassword) {
-			return new ResponseError('PASSWORD_TOO_WEAK', weakPassword)
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))
+		if (!tokenRow) {
+			return new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {
+				[AuthLogService.Key]: new AuthLogService.Bag({}),
+			})
 		}
-		return await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))
+
+		const authLogData = new AuthLogService.Bag({
+			personId: tokenRow.person_id,
+			tokenId: tokenRow.id,
+		})
+		const weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')
+		if (!weakPassword.ok) {
+			return new ResponseError(weakPassword.error, weakPassword.errorMessage, {
+				...weakPassword.metadata ?? {},
+				[AuthLogService.Key]: authLogData,
+			})
+		}
+		const resetPasswordResult =  await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))
+		if (!resetPasswordResult.ok) {
+			return new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {
+				...resetPasswordResult.metadata ?? {},
+				[AuthLogService.Key]: authLogData,
+			})
+		}
+		return new ResponseOk({
+			[AuthLogService.Key]: authLogData,
+		})
 	}
 }
 
-export type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'
-
-export type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>
+export type ResetPasswordResponse = Response<{
+	[AuthLogService.Key]: AuthLogService.Bag
+}, ResetPasswordErrorCode, {
+	weakPasswordReasons?: WeakPasswordReason[]
+	[AuthLogService.Key]: AuthLogService.Bag
+}>

package/src/model/service/PasswordStrengthValidator.ts

@@ -0,0 +1,85 @@
+import { Config } from '../type/Config'
+import { blacklist } from '../utils/blacklist'
+import { WeakPasswordReason } from '../../schema'
+import { ResponseError, Response, ResponseOk } from '../utils/Response'
+
+export class PasswordStrengthValidator {
+	public async verify<const Code extends string>(password: string, passwordConfig: Config['password'], errorCode: Code): Promise<ResponseOk<null> | ResponseError<Code, {
+		weakPasswordReasons: WeakPasswordReason[]
+	}>> {
+		const failureReasons: WeakPasswordReason[] = []
+		const developerMessage: string[] = []
+
+		if (password.length < passwordConfig.minLength) {
+			failureReasons.push('TOO_SHORT')
+			developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)
+		}
+
+		if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+			failureReasons.push('MISSING_UPPERCASE')
+			developerMessage.push(`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`)
+		}
+
+		if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+			failureReasons.push('MISSING_LOWERCASE')
+			developerMessage.push(`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`)
+		}
+
+		if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+			failureReasons.push('MISSING_DIGIT')
+			developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)
+		}
+
+		if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+			failureReasons.push('MISSING_SPECIAL')
+			developerMessage.push(`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`)
+		}
+
+		if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+			failureReasons.push('INVALID_PATTERN')
+			developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)
+		}
+
+		if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+			failureReasons.push('BLACKLISTED')
+			developerMessage.push(`Password is blacklisted.`)
+		}
+
+		if (failureReasons.length > 0) {
+			return new ResponseError(errorCode as any, developerMessage.join(' '), {
+				weakPasswordReasons: failureReasons,
+			})
+		}
+		return new ResponseOk(null)
+	}
+
+
+	private isBlacklisted(password: string): boolean {
+		return blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))
+	}
+
+	private decodeLeetspeak(input: string): string {
+		const leetspeakMap: { [key: string]: string } = {
+			'@': 'a',
+			'$': 's',
+			'0': 'o',
+			'1': 'l',
+			'3': 'e',
+			'7': 't',
+			'!': 'i',
+		}
+		return input
+			.split('')
+			.map(char => {
+				return leetspeakMap[char] || char
+			})
+			.join('')
+	}
+}
+
+namespace PasswordStrengthValidator {
+	export type Result =
+		| { ok: true }
+		| { ok: false; reasons: WeakPasswordReason[]; message: string }
+}
+

package/src/model/service/PasswordlessSignInManager.ts

@@ -1,30 +1,23 @@
 import { ApiKeyManager } from './apiKey'
-import { PersonQuery, PersonRow } from '../queries'
+import { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
-import {
-	ActivatePasswordlessOtpErrorCode,
-	ConfigPolicy,
-	InitSignInPasswordlessErrorCode,
-	InitSignInPasswordlessResult,
-	SignInPasswordlessErrorCode,
-} from '../../schema'
+import { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'
 import { DatabaseContext, validateToken } from '../utils'
-import { ConfigurationManager } from './ConfigurationManager'
 import { UserMailer } from '../mailing'
-import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'
+import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'
 import { getPreferredProject } from './helpers/getPreferredProject'
 import { ProjectManager } from './ProjectManager'
 import { PermissionContext } from '../authorization'
 import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
 import { ImplementationException } from '../../exceptions'
 import { OtpAuthenticator } from './OtpAuthenticator'
-import { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'
 import { PersonToken } from '../type'
+import { AuthLogService } from './AuthLogService'
+import { intervalToSeconds } from '../utils/interval'
 
 class PasswordlessSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
-		private readonly configurationManager: ConfigurationManager,
 		private readonly mailer: UserMailer,
 		private readonly projectManager: ProjectManager,
 		private readonly otpAuthenticator: OtpAuthenticator,
@@ -39,20 +32,31 @@ class PasswordlessSignInManager {
 		mailProject?: string
 	}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {
 		return db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {
-			const configuration = await this.configurationManager.fetchConfiguration(db)
+			const configuration = await db.queryHandler.fetch(new ConfigurationQuery())
 			if (configuration.passwordless.enabled === 'never') {
-				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {
+					[AuthLogService.Key]: new AuthLogService.Bag({}),
+				})
 			}
 
 			const person = await db.queryHandler.fetch(PersonQuery.byEmail(email))
 			if (!person) {
-				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+					}),
+				})
 			}
 			if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
-				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+						personId: person.id,
+					}),
+				})
 			}
 
-			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)
+			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)
 			const result = await db.commandBus.execute(createTokenCommand)
 
 
@@ -72,7 +76,16 @@ class PasswordlessSignInManager {
 				projectId: project?.id ?? null,
 			})
 
-			return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })
+			return new ResponseOk({
+				requestId: result.id,
+				expiresAt: result.expiresAt,
+				person,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personInput: email,
+					personId: person.id,
+					tokenId: result.id,
+				}),
+			})
 		})
 	}
 
@@ -108,30 +121,61 @@ class PasswordlessSignInManager {
 				if (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {
 					await db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))
 				}
-				return tokenValidationResult
+				return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+					...tokenValidationResult.metadata ?? {},
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: tokenResult?.person_id,
+						tokenId: tokenResult?.id,
+					}),
+				})
+			}
+			if (!tokenResult) {
+				throw new ImplementationException()
 			}
 			const personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))
 			if (!personRow) {
 				throw new ImplementationException()
 			}
 			if (personRow.disabled_at !== null) {
-				return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+				return new ResponseError('PERSON_DISABLED', `Person is disabled`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: personRow.id,
+						tokenId: tokenResult?.id,
+					}),
+				})
 			}
 
 			if (personRow.otp_uri && personRow.otp_activated_at) {
 				if (!mfaOtp) {
-					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: personRow.id,
+							tokenId: tokenResult?.id,
+						}),
+					})
 				}
 
 				if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
-					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: personRow.id,
+							tokenId: tokenResult?.id,
+						}),
+					})
 				}
 			}
 
 			await db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
 
-			return new ResponseOk({ person: personRow, token: sessionToken })
+			return new ResponseOk({
+				person: personRow,
+				token: sessionToken,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: personRow.id,
+					tokenId: tokenResult?.id,
+				}),
+			})
 		})
 	}
 
@@ -151,12 +195,24 @@ class PasswordlessSignInManager {
 				validationType: 'token',
 			})
 			if (!tokenValidationResult.ok) {
-				return tokenValidationResult
+				return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+					...tokenValidationResult.metadata ?? {},
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: tokenResult?.person_id,
+						tokenId: tokenResult?.id,
+					}),
+				})
 			}
 
 			await db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))
 
-			return new ResponseOk(null)
+			return new ResponseOk({
+				person: tokenResult?.person_id,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: tokenResult?.person_id,
+					tokenId: tokenResult?.id,
+				}),
+			})
 		})
 	}
 
@@ -175,16 +231,27 @@ class PasswordlessSignInManager {
 }
 
 namespace PasswordlessSignInManager {
-	export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>
+	export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}, InitSignInPasswordlessErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 
 
 	interface SignInPasswordlessResult {
 		readonly person: PersonRow
 		readonly token: string
+		[AuthLogService.Key]: AuthLogService.Bag
 	}
-	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>
+	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 
-	export type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>
+	export type ActivatePasswordlessOtpResponse = Response<{
+		[AuthLogService.Key]: AuthLogService.Bag
+	}, ActivatePasswordlessOtpErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 }
 
 export { PasswordlessSignInManager }

package/src/model/service/PersonAccessManager.ts

@@ -1,4 +1,4 @@
-import { PersonQuery } from '../queries'
+import { PersonQuery, PersonRow } from '../queries'
 import { DatabaseContext } from '../utils'
 import { DisablePersonCommand } from '../commands/person/DisablePersonCommand'
 import { ApiKeyManager } from './apiKey'
@@ -9,37 +9,18 @@ class PersonAccessManager {
 
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
 
-	async disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {
-		const result = await dbContext.transaction(async trx => {
-			const personRow = await trx.queryHandler.fetch(
-				PersonQuery.byId(personId),
-			)
-
-			if (personRow === null) {
-				return 'PERSON_NOT_FOUND'
-			}
-
-			if (personRow.disabled_at !== null) {
-				return 'PERSON_ALREADY_DISABLED'
+	async disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {
+		return await dbContext.transaction(async trx => {
+			if (person.disabled_at !== null) {
+				return new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')
 			}
 
 			// Deactivate person & invalidate all api keys associated with person identity
-			await this.disablePersonAccount(trx, personRow.id)
-			await this.disableIdentityApiKeys(trx, personRow.identity_id)
+			await this.disablePersonAccount(trx, person.id)
+			await this.disableIdentityApiKeys(trx, person.identity_id)
 
-			return null
+			return new ResponseOk(null)
 		})
-
-		switch (result) {
-			case null:
-				return new ResponseOk(null)
-
-			case 'PERSON_ALREADY_DISABLED':
-				return new ResponseError(result, 'Person is already disable')
-
-			case 'PERSON_NOT_FOUND':
-				return new ResponseError(result, 'Person not found')
-		}
 	}
 
 	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {