@contember/engine-tenant-api 2.1.0-alpha.16 → 2.1.0-alpha.18

package/src/schema/index.ts

@@ -1,3 +1,5 @@
+import { Interval } from './types'
+import { OutputInterval } from './types'
 import { GraphQLResolveInfo, GraphQLScalarType, GraphQLScalarTypeConfig } from 'graphql'
 export type Maybe<T> = T | null
 export type InputMaybe<T> = Maybe<T>
@@ -15,8 +17,9 @@ export type Scalars = {
 	Boolean: { input: boolean; output: boolean }
 	Int: { input: number; output: number }
 	Float: { input: number; output: number }
-	DateTime: { input: any; output: any }
-	Json: { input: any; output: any }
+	DateTime: { input: Date; output: Date }
+	Interval: { input: Interval; output: OutputInterval }
+	Json: { input: unknown; output: unknown }
 }
 
 export type ActivatePasswordlessOtpError = {
@@ -139,6 +142,7 @@ export type ChangeMyPasswordError = {
 	readonly __typename?: 'ChangeMyPasswordError'
 	readonly code: ChangeMyPasswordErrorCode
 	readonly developerMessage: Scalars['String']['output']
+	readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>
 }
 
 export type ChangeMyPasswordErrorCode =
@@ -176,6 +180,7 @@ export type ChangePasswordError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
+	readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>
 }
 
 export type ChangePasswordErrorCode =
@@ -226,23 +231,67 @@ export type CommonSignInResult = {
 
 export type Config = {
 	readonly __typename?: 'Config'
+	readonly login: ConfigLogin
+	readonly password: ConfigPassword
 	readonly passwordless: ConfigPasswordless
 }
 
 export type ConfigInput = {
+	readonly login?: InputMaybe<ConfigLoginInput>
+	readonly password?: InputMaybe<ConfigPasswordInput>
 	readonly passwordless?: InputMaybe<ConfigPasswordlessInput>
 }
 
+export type ConfigLogin = {
+	readonly __typename?: 'ConfigLogin'
+	readonly attemptWindow: Scalars['Interval']['output']
+	readonly baseBackoff: Scalars['Interval']['output']
+	readonly defaultTokenExpiration: Scalars['Interval']['output']
+	readonly maxBackoff: Scalars['Interval']['output']
+	readonly maxTokenExpiration?: Maybe<Scalars['Interval']['output']>
+	readonly revealUserExists: Scalars['Boolean']['output']
+}
+
+export type ConfigLoginInput = {
+	readonly attemptWindow?: InputMaybe<Scalars['Interval']['input']>
+	readonly baseBackoff?: InputMaybe<Scalars['Interval']['input']>
+	readonly defaultTokenExpiration?: InputMaybe<Scalars['Interval']['input']>
+	readonly maxBackoff?: InputMaybe<Scalars['Interval']['input']>
+	readonly maxTokenExpiration?: InputMaybe<Scalars['Interval']['input']>
+	readonly revealUserExists?: InputMaybe<Scalars['Boolean']['input']>
+}
+
+export type ConfigPassword = {
+	readonly __typename?: 'ConfigPassword'
+	readonly checkBlacklist: Scalars['Boolean']['output']
+	readonly minLength: Scalars['Int']['output']
+	readonly pattern?: Maybe<Scalars['String']['output']>
+	readonly requireDigit: Scalars['Int']['output']
+	readonly requireLowercase: Scalars['Int']['output']
+	readonly requireSpecial: Scalars['Int']['output']
+	readonly requireUppercase: Scalars['Int']['output']
+}
+
+export type ConfigPasswordInput = {
+	readonly checkBlacklist?: InputMaybe<Scalars['Boolean']['input']>
+	readonly minLength?: InputMaybe<Scalars['Int']['input']>
+	readonly pattern?: InputMaybe<Scalars['String']['input']>
+	readonly requireDigit?: InputMaybe<Scalars['Int']['input']>
+	readonly requireLowercase?: InputMaybe<Scalars['Int']['input']>
+	readonly requireSpecial?: InputMaybe<Scalars['Int']['input']>
+	readonly requireUppercase?: InputMaybe<Scalars['Int']['input']>
+}
+
 export type ConfigPasswordless = {
 	readonly __typename?: 'ConfigPasswordless'
 	readonly enabled: ConfigPolicy
-	readonly expirationMinutes: Scalars['Int']['output']
+	readonly expiration: Scalars['Interval']['output']
 	readonly url?: Maybe<Scalars['String']['output']>
 }
 
 export type ConfigPasswordlessInput = {
 	readonly enabled?: InputMaybe<ConfigPolicy>
-	readonly expirationMinutes?: InputMaybe<Scalars['Int']['input']>
+	readonly expiration?: InputMaybe<Scalars['Interval']['input']>
 	readonly url?: InputMaybe<Scalars['String']['input']>
 }
 
@@ -1169,6 +1218,7 @@ export type ResetPasswordError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
+	readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>
 }
 
 export type ResetPasswordErrorCode =
@@ -1234,14 +1284,17 @@ export type SignInError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endUserMessage?: Maybe<Scalars['String']['output']>
+	readonly retryAfter?: Maybe<Scalars['Int']['output']>
 }
 
 export type SignInErrorCode =
+  | 'INVALID_CREDENTIALS'
   | 'INVALID_OTP_TOKEN'
   | 'INVALID_PASSWORD'
   | 'NO_PASSWORD_SET'
   | 'OTP_REQUIRED'
   | 'PERSON_DISABLED'
+  | 'RATE_LIMIT_EXCEEDED'
   | 'UNKNOWN_EMAIL'
 
 export type SignInIdpError = {
@@ -1344,6 +1397,7 @@ export type SignUpError = {
 	readonly developerMessage: Scalars['String']['output']
 	/** @deprecated Field no longer supported */
 	readonly endPersonMessage?: Maybe<Scalars['String']['output']>
+	readonly weakPasswordReasons?: Maybe<ReadonlyArray<WeakPasswordReason>>
 }
 
 export type SignUpErrorCode =
@@ -1453,6 +1507,15 @@ export type VariableEntryInput = {
 	readonly values: ReadonlyArray<Scalars['String']['input']>
 }
 
+export type WeakPasswordReason =
+  | 'BLACKLISTED'
+  | 'INVALID_PATTERN'
+  | 'MISSING_DIGIT'
+  | 'MISSING_LOWERCASE'
+  | 'MISSING_SPECIAL'
+  | 'MISSING_UPPERCASE'
+  | 'TOO_SHORT'
+
 
 
 export type ResolverTypeWrapper<T> = Promise<T> | T
@@ -1565,6 +1628,10 @@ export type ResolversTypes = {
 	CommonSignInResult: ResolverTypeWrapper<ResolversInterfaceTypes<ResolversTypes>['CommonSignInResult']>
 	Config: ResolverTypeWrapper<Config>
 	ConfigInput: ConfigInput
+	ConfigLogin: ResolverTypeWrapper<ConfigLogin>
+	ConfigLoginInput: ConfigLoginInput
+	ConfigPassword: ResolverTypeWrapper<ConfigPassword>
+	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ResolverTypeWrapper<ConfigPasswordless>
 	ConfigPasswordlessInput: ConfigPasswordlessInput
 	ConfigPolicy: ConfigPolicy
@@ -1624,6 +1691,7 @@ export type ResolversTypes = {
 	InitSignInPasswordlessResponse: ResolverTypeWrapper<InitSignInPasswordlessResponse>
 	InitSignInPasswordlessResult: ResolverTypeWrapper<InitSignInPasswordlessResult>
 	Int: ResolverTypeWrapper<Scalars['Int']['output']>
+	Interval: ResolverTypeWrapper<Scalars['Interval']['output']>
 	InviteError: ResolverTypeWrapper<InviteError>
 	InviteErrorCode: InviteErrorCode
 	InviteMethod: InviteMethod
@@ -1707,6 +1775,7 @@ export type ResolversTypes = {
 	UpdateProjectResponse: ResolverTypeWrapper<UpdateProjectResponse>
 	VariableEntry: ResolverTypeWrapper<VariableEntry>
 	VariableEntryInput: VariableEntryInput
+	WeakPasswordReason: WeakPasswordReason
 }
 
 /** Mapping between all available schema types and the resolvers parents */
@@ -1737,6 +1806,10 @@ export type ResolversParentTypes = {
 	CommonSignInResult: ResolversInterfaceTypes<ResolversParentTypes>['CommonSignInResult']
 	Config: Config
 	ConfigInput: ConfigInput
+	ConfigLogin: ConfigLogin
+	ConfigLoginInput: ConfigLoginInput
+	ConfigPassword: ConfigPassword
+	ConfigPasswordInput: ConfigPasswordInput
 	ConfigPasswordless: ConfigPasswordless
 	ConfigPasswordlessInput: ConfigPasswordlessInput
 	ConfigureError: ConfigureError
@@ -1782,6 +1855,7 @@ export type ResolversParentTypes = {
 	InitSignInPasswordlessResponse: InitSignInPasswordlessResponse
 	InitSignInPasswordlessResult: InitSignInPasswordlessResult
 	Int: Scalars['Int']['output']
+	Interval: Scalars['Interval']['output']
 	InviteError: InviteError
 	InviteOptions: InviteOptions
 	InviteResponse: InviteResponse
@@ -1934,6 +2008,7 @@ export type ApiKeyWithTokenResolvers<ContextType = any, ParentType extends Resol
 export type ChangeMyPasswordErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['ChangeMyPasswordError'] = ResolversParentTypes['ChangeMyPasswordError']> = {
 	code?: Resolver<ResolversTypes['ChangeMyPasswordErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
+	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
@@ -1959,6 +2034,7 @@ export type ChangePasswordErrorResolvers<ContextType = any, ParentType extends R
 	code?: Resolver<ResolversTypes['ChangePasswordErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
@@ -1993,13 +2069,36 @@ export type CommonSignInResultResolvers<ContextType = any, ParentType extends Re
 }
 
 export type ConfigResolvers<ContextType = any, ParentType extends ResolversParentTypes['Config'] = ResolversParentTypes['Config']> = {
+	login?: Resolver<ResolversTypes['ConfigLogin'], ParentType, ContextType>
+	password?: Resolver<ResolversTypes['ConfigPassword'], ParentType, ContextType>
 	passwordless?: Resolver<ResolversTypes['ConfigPasswordless'], ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
+export type ConfigLoginResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigLogin'] = ResolversParentTypes['ConfigLogin']> = {
+	attemptWindow?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+	baseBackoff?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+	defaultTokenExpiration?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+	maxBackoff?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
+	maxTokenExpiration?: Resolver<Maybe<ResolversTypes['Interval']>, ParentType, ContextType>
+	revealUserExists?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
+export type ConfigPasswordResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPassword'] = ResolversParentTypes['ConfigPassword']> = {
+	checkBlacklist?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	minLength?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	pattern?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	requireDigit?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	requireLowercase?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	requireSpecial?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	requireUppercase?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
+}
+
 export type ConfigPasswordlessResolvers<ContextType = any, ParentType extends ResolversParentTypes['ConfigPasswordless'] = ResolversParentTypes['ConfigPasswordless']> = {
 	enabled?: Resolver<ResolversTypes['ConfigPolicy'], ParentType, ContextType>
-	expirationMinutes?: Resolver<ResolversTypes['Int'], ParentType, ContextType>
+	expiration?: Resolver<ResolversTypes['Interval'], ParentType, ContextType>
 	url?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
@@ -2250,6 +2349,10 @@ export type InitSignInPasswordlessResultResolvers<ContextType = any, ParentType
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
+export interface IntervalScalarConfig extends GraphQLScalarTypeConfig<ResolversTypes['Interval'], any> {
+	name: 'Interval'
+}
+
 export type InviteErrorResolvers<ContextType = any, ParentType extends ResolversParentTypes['InviteError'] = ResolversParentTypes['InviteError']> = {
 	code?: Resolver<ResolversTypes['InviteErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
@@ -2446,6 +2549,7 @@ export type ResetPasswordErrorResolvers<ContextType = any, ParentType extends Re
 	code?: Resolver<ResolversTypes['ResetPasswordErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
@@ -2500,6 +2604,7 @@ export type SignInErrorResolvers<ContextType = any, ParentType extends Resolvers
 	code?: Resolver<ResolversTypes['SignInErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endUserMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	retryAfter?: Resolver<Maybe<ResolversTypes['Int']>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
@@ -2576,6 +2681,7 @@ export type SignUpErrorResolvers<ContextType = any, ParentType extends Resolvers
 	code?: Resolver<ResolversTypes['SignUpErrorCode'], ParentType, ContextType>
 	developerMessage?: Resolver<ResolversTypes['String'], ParentType, ContextType>
 	endPersonMessage?: Resolver<Maybe<ResolversTypes['String']>, ParentType, ContextType>
+	weakPasswordReasons?: Resolver<Maybe<ReadonlyArray<ResolversTypes['WeakPasswordReason']>>, ParentType, ContextType>
 	__isTypeOf?: IsTypeOfResolverFn<ParentType, ContextType>
 }
 
@@ -2674,6 +2780,8 @@ export type Resolvers<ContextType = any> = {
 	CheckResetPasswordTokenResult?: CheckResetPasswordTokenResultResolvers<ContextType>
 	CommonSignInResult?: CommonSignInResultResolvers<ContextType>
 	Config?: ConfigResolvers<ContextType>
+	ConfigLogin?: ConfigLoginResolvers<ContextType>
+	ConfigPassword?: ConfigPasswordResolvers<ContextType>
 	ConfigPasswordless?: ConfigPasswordlessResolvers<ContextType>
 	ConfigureError?: ConfigureErrorResolvers<ContextType>
 	ConfigureResponse?: ConfigureResponseResolvers<ContextType>
@@ -2712,6 +2820,7 @@ export type Resolvers<ContextType = any> = {
 	InitSignInPasswordlessError?: InitSignInPasswordlessErrorResolvers<ContextType>
 	InitSignInPasswordlessResponse?: InitSignInPasswordlessResponseResolvers<ContextType>
 	InitSignInPasswordlessResult?: InitSignInPasswordlessResultResolvers<ContextType>
+	Interval?: GraphQLScalarType
 	InviteError?: InviteErrorResolvers<ContextType>
 	InviteResponse?: InviteResponseResolvers<ContextType>
 	InviteResult?: InviteResultResolvers<ContextType>

package/src/schema/tenant.graphql.ts

@@ -4,6 +4,9 @@ import { DocumentNode } from 'graphql'
 const schema: DocumentNode = gql`
 	scalar Json
 	scalar DateTime
+	
+	""" Interval is a string in the format ISO 8601, e.g. "PT1H" for 1 hour """
+	scalar Interval
 
 	schema {
 		query: Query
@@ -120,16 +123,39 @@ const schema: DocumentNode = gql`
 	
 	type Config {
 		passwordless: ConfigPasswordless!
+		password: ConfigPassword!
+		login: ConfigLogin!
 	}
 	
 	type ConfigPasswordless {
 		enabled: ConfigPolicy!
 		url: String
-		expirationMinutes: Int!
+		expiration: Interval!
 	}
 	
+	type ConfigPassword {
+		minLength: Int!
+		requireUppercase: Int!
+		requireLowercase: Int!
+		requireDigit: Int!
+		requireSpecial: Int!
+		pattern: String
+		checkBlacklist: Boolean!
+    }
+	
+	type ConfigLogin {
+		baseBackoff: Interval!
+		maxBackoff: Interval!
+		attemptWindow: Interval!
+		revealUserExists: Boolean!
+		defaultTokenExpiration: Interval!
+		maxTokenExpiration: Interval
+    }
+	
 	input ConfigInput {
 		passwordless: ConfigPasswordlessInput
+		password: ConfigPasswordInput
+		login: ConfigLoginInput
 	}
 	
 	enum ConfigPolicy {
@@ -142,9 +168,28 @@ const schema: DocumentNode = gql`
 	input ConfigPasswordlessInput {
 		enabled: ConfigPolicy
 		url: String
-		expirationMinutes: Int
+		expiration: Interval
 	}
 	
+	input ConfigPasswordInput {
+		minLength: Int
+		requireUppercase: Int
+		requireLowercase: Int
+		requireDigit: Int
+		requireSpecial: Int
+		pattern: String
+		checkBlacklist: Boolean
+    }
+	
+	input ConfigLoginInput {
+		baseBackoff: Interval
+		maxBackoff: Interval
+		attemptWindow: Interval
+		revealUserExists: Boolean
+		defaultTokenExpiration: Interval
+		maxTokenExpiration: Interval
+    }
+	
 	type ConfigureResponse {
 		ok: Boolean!
 		error: ConfigureError
@@ -169,6 +214,7 @@ const schema: DocumentNode = gql`
 
 	type SignUpError {
 		code: SignUpErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endPersonMessage: String @deprecated
 	}
@@ -202,15 +248,18 @@ const schema: DocumentNode = gql`
 		code: SignInErrorCode!
 		developerMessage: String!
 		endUserMessage: String @deprecated
+		retryAfter: Int
 	}
 
 	enum SignInErrorCode {
+		INVALID_CREDENTIALS
 		UNKNOWN_EMAIL
 		INVALID_PASSWORD
 		PERSON_DISABLED
 		NO_PASSWORD_SET
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
+		RATE_LIMIT_EXCEEDED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -307,6 +356,7 @@ const schema: DocumentNode = gql`
 
 	type ChangePasswordError {
 		code: ChangePasswordErrorCode!
+		weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}
@@ -315,6 +365,16 @@ const schema: DocumentNode = gql`
 		PERSON_NOT_FOUND
 		TOO_WEAK
 	}
+	
+	enum WeakPasswordReason {
+		TOO_SHORT
+		MISSING_UPPERCASE
+		MISSING_LOWERCASE
+		MISSING_DIGIT
+		MISSING_SPECIAL
+		INVALID_PATTERN
+		BLACKLISTED
+    }
 
 
 	# === changeMyPassword ===
@@ -326,6 +386,7 @@ const schema: DocumentNode = gql`
 
 	type ChangeMyPasswordError {
 		code: ChangeMyPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 	}
 
@@ -1086,6 +1147,7 @@ const schema: DocumentNode = gql`
 	}
 	type ResetPasswordError {
 		code: ResetPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}

package/src/schema/types.ts

@@ -0,0 +1,4 @@
+import { IPostgresInterval } from 'postgres-interval'
+
+export type Interval = string & { __kind: 'Interval' }
+export type OutputInterval = string & { __kind: 'Interval' } | IPostgresInterval

package/tests/cases/integration/mocked/changeMyPasswordMutation.test.ts

@@ -5,12 +5,13 @@ import { test } from 'bun:test'
 import { changeMyPasswordMutation } from './gql/changeMyPassword'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { authenticatedIdentityId } from '../../../src/testTenant'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('changes my password', async () => {
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const currentPassword = '123456'
-	const newPassword = 'abcd123'
+	const newPassword = 'ABcc123456'
 	await executeTenantTest({
 		query: changeMyPasswordMutation({ currentPassword, newPassword }),
 		executes: [
@@ -18,6 +19,7 @@ test('changes my password', async () => {
 				identityId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
 			}),
+			getConfigSql(),
 			updatePersonPasswordSql({ personId, password: newPassword }),
 		],
 		return: {
@@ -28,6 +30,42 @@ test('changes my password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: { 'type': 'password_change', 'response': { 'result': null, 'ok': true }, 'personId': testUuid(1) },
+	})
+})
+
+test('changes my password - weak', async () => {
+	const personId = testUuid(1)
+	const identityId = authenticatedIdentityId
+	const currentPassword = '123456'
+	const newPassword = 'abcd123'
+	await executeTenantTest({
+		query: changeMyPasswordMutation({ currentPassword, newPassword }),
+		executes: [
+			getPersonByIdentity({
+				identityId,
+				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
+			}),
+			getConfigSql(),
+		],
+		return: {
+			data: {
+				changeMyPassword: {
+					ok: false,
+					error: {
+						code: 'TOO_WEAK',
+					},
+				},
+			},
+		},
+		expectedAuthLog: { 'type': 'password_change', 'response': { ok: false, error: 'TOO_WEAK',
+			errorMessage: 'Password must contain at least 1 uppercase letter. Password is blacklisted.',
+			metadata: {
+		 weakPasswordReasons: [
+			 'MISSING_UPPERCASE',
+			 'BLACKLISTED',
+		 ],
+	 } }, 'personId': testUuid(1) },
 	})
 })
 
@@ -36,7 +74,7 @@ test('changes my password - invalid current password', async () => {
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const currentPassword = 'xxxxxx'
-	const newPassword = 'abcd123'
+	const newPassword = 'ABcc123456'
 	await executeTenantTest({
 		query: changeMyPasswordMutation({ currentPassword, newPassword }),
 		executes: [
@@ -44,6 +82,7 @@ test('changes my password - invalid current password', async () => {
 				identityId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
 			}),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -55,6 +94,7 @@ test('changes my password - invalid current password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: { 'type': 'password_change', 'response': { 'ok': false, 'error': 'INVALID_PASSWORD', 'errorMessage': 'Password does not match' }, 'personId': testUuid(1) },
 	})
 })
 

package/tests/cases/integration/mocked/changeMyProfileMutation.test.ts

@@ -1,7 +1,7 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
 import { updatePersonProfileNameSql, updatePersonProfileEmailSql, updatePersonProfileNameAndEmailSql } from './sql/updatePesonNameSql'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { changeMyProfileMutation } from './gql/changeMyProfile'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { authenticatedIdentityId } from '../../../src/testTenant'
@@ -78,6 +78,12 @@ test('changes my email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 
@@ -92,7 +98,6 @@ test('changes my email - invalid', async () => {
 				identityId,
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -118,7 +123,6 @@ test('changes my email - invalid #2', async () => {
 				identityId,
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -130,6 +134,12 @@ test('changes my email - invalid #2', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
 
@@ -145,7 +155,6 @@ test('changes my email - exists', async () => {
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
 			getPersonByEmailSql({ email, response: { personId: testUuid(4), identityId: testUuid(5), roles: [], password: '' } }),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -157,6 +166,12 @@ test('changes my email - exists', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
 
@@ -183,5 +198,11 @@ test('changes my name and email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })

package/tests/cases/integration/mocked/changePasswordMutation.test.ts

@@ -3,12 +3,13 @@ import { testUuid } from '../../../src/testUuid'
 import { changePasswordMutation } from './gql/changePassword'
 import { getPersonByIdSql } from './sql/getPersonByIdSql'
 import { updatePersonPasswordSql } from './sql/updatePesonPasswordSql'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('changes a password', async () => {
 	const personId = testUuid(1)
 	const identityId = testUuid(2)
-	const password = '123456'
+	const password = 'AbcDeg123'
 	await executeTenantTest({
 		query: changePasswordMutation({ personId, password }),
 		executes: [
@@ -16,6 +17,7 @@ test('changes a password', async () => {
 				personId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123', identityId },
 			}),
+			getConfigSql(),
 			updatePersonPasswordSql({ personId, password }),
 		],
 		return: {
@@ -25,6 +27,12 @@ test('changes a password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'password_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 

package/tests/cases/integration/mocked/changeProfileMutation.test.ts

@@ -1,6 +1,6 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { changeProfileMutation } from './gql/changeProfile'
 import { updatePersonProfileNameAndEmailSql } from './sql/updatePesonNameSql'
 import { authenticatedIdentityId } from '../../../src/testTenant'
@@ -32,6 +32,12 @@ test('changes my name and email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })