@contember/engine-tenant-api 2.1.0-alpha.8 → 2.1.0-beta.1

package/src/migrations/2020-06-08-134000-tenant-credentials.ts

@@ -2,6 +2,6 @@ import { MigrationBuilder } from '@contember/database-migrations'
 import { TenantMigrationArgs } from './types'
 import { createCredentials } from './tenantCredentials'
 
-export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
+export default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {
 	await createCredentials(builder, args)
 }

package/src/migrations/2020-08-07-110000-person-otp.ts

@@ -6,7 +6,6 @@ ALTER TABLE "person"
 	ADD COLUMN otp_activated_at TIMESTAMP DEFAULT NULL
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2020-08-17-162200-mail-templates.ts

@@ -17,6 +17,6 @@ CREATE INDEX mail_template_project_index
 	ON mail_template(project_id);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2020-08-21-143400-person-password-reset.ts

@@ -17,7 +17,6 @@ CREATE UNIQUE INDEX person_password_reset_token
 	ON person_password_reset(token_hash);
 `
 
-
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2020-09-07-094200-identity-provider.ts

@@ -11,6 +11,6 @@ CREATE TABLE identity_provider (
 );
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2021-03-28-134000-timestamp.ts

@@ -21,8 +21,6 @@ ALTER TABLE person_password_reset
 	ALTER used_at TYPE TIMESTAMPTZ;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-
-

package/src/migrations/2021-07-26-105000-project-config.ts

@@ -6,7 +6,6 @@ ALTER TABLE project
     add column updated_at timestamptz not null DEFAULT now();
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2021-07-26-132000-project-secrets.ts

@@ -18,6 +18,6 @@ CREATE INDEX project_secret_project_index
 	ON project_secret (project_id);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2021-07-27-174000-project-alias-index.ts

@@ -4,7 +4,6 @@ const sql = `
 CREATE INDEX project_alias ON project USING gin ((config -> 'alias'));
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2021-11-24-130000-person-password-null.ts

@@ -4,7 +4,6 @@ const sql = `
 ALTER TABLE person ALTER COLUMN password_hash DROP NOT NULL;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2021-11-24-161500-mail-template-project-null.ts

@@ -12,6 +12,6 @@ CREATE UNIQUE INDEX mail_template_identifier_global
 	ON mail_template (mail_type, variant) WHERE project_id IS NULL;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-01-04-144000-person-unique-identity.ts

@@ -5,6 +5,6 @@ ALTER TABLE person
 	ADD UNIQUE (identity_id);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-02-09-111800-fix-crypted.ts

@@ -16,6 +16,6 @@ ALTER TABLE project_secret
     DROP iv;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-02-11-153000-idp-auto-sign-up.ts

@@ -5,6 +5,6 @@ ALTER TABLE identity_provider
 	ADD COLUMN auto_sign_up BOOLEAN NOT NULL DEFAULT FALSE;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-06-29-105000-person-idp.ts

@@ -17,6 +17,6 @@ CREATE UNIQUE INDEX person_identity_provider_identifier
 	ON person_identity_provider (identity_provider_id, external_identifier);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-07-07-135000-person-email-opt-uniq.ts

@@ -6,6 +6,6 @@ ALTER TABLE person
 	ADD CONSTRAINT email_unique UNIQUE (email);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2022-07-07-141000-person-display-name.ts

@@ -7,7 +7,6 @@ UPDATE person
 SET name = SPLIT_PART(email, '@', 1);
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2022-07-14-145000-person-login-options.ts

@@ -9,7 +9,6 @@ ALTER TABLE identity_provider
 	ADD exclusive BOOLEAN DEFAULT FALSE;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2022-11-08-project-update-notification.ts

@@ -58,7 +58,6 @@ $$
 $$;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2023-01-20-135500-person-email-normalize.ts

@@ -22,7 +22,6 @@ FROM uniq
 WHERE person.id = uniq.id;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }
-

package/src/migrations/2023-06-03-104000-person-disabled.ts

@@ -5,6 +5,6 @@ ALTER TABLE person
 	ADD disabled_at TIMESTAMP WITH TIME ZONE;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2023-09-01-165000-idp-return-config.ts

@@ -5,6 +5,6 @@ ALTER TABLE identity_provider
 	ADD COLUMN init_returns_config BOOLEAN NOT NULL DEFAULT FALSE;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2024-06-20-140000-mail-reply.ts

@@ -5,6 +5,6 @@ ALTER TABLE mail_template
 	ADD COLUMN reply_to TEXT;
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2024-08-26-120000-passwordless.ts

@@ -26,6 +26,6 @@ ALTER TABLE person
 
 `
 
-export default async function (builder: MigrationBuilder) {
+export default async function(builder: MigrationBuilder) {
 	builder.sql(sql)
 }

package/src/migrations/2025-04-16-180000-config-up.ts

@@ -0,0 +1,39 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+    ALTER TABLE "config"
+        ADD COLUMN "password_min_length"            INTEGER  NOT NULL DEFAULT 8,
+        ADD COLUMN "password_require_uppercase"     INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_lowercase"     INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_digit"         INTEGER  NOT NULL DEFAULT 1,
+        ADD COLUMN "password_require_special"       INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "password_pattern"               TEXT     DEFAULT NULL,
+        ADD COLUMN "password_check_blacklist"       BOOLEAN  NOT NULL DEFAULT TRUE,
+        ADD COLUMN "login_base_backoff"             INTERVAL NOT NULL DEFAULT '1 second',
+        ADD COLUMN "login_max_backoff"              INTERVAL NOT NULL DEFAULT '60 second',
+        ADD COLUMN "login_attempt_window"           INTERVAL NOT NULL DEFAULT '5 minute',
+        ADD COLUMN "login_reveal_user_exits"        BOOLEAN  NOT NULL DEFAULT TRUE,
+        ADD COLUMN "login_default_token_expiration" INTERVAL NOT NULL DEFAULT '30 minute',
+        ADD COLUMN "login_max_token_expiration"     INTERVAL DEFAULT '6 month';
+    ALTER TABLE "config"
+        RENAME passwordless_expiration_minutes TO passwordless_expiration;
+
+    ALTER TABLE "config"
+        ALTER COLUMN passwordless_expiration DROP DEFAULT,
+        ALTER COLUMN passwordless_expiration TYPE INTERVAL USING passwordless_expiration * INTERVAL '1 minute',
+        ALTER COLUMN passwordless_expiration SET DEFAULT INTERVAL '5 minute';
+
+-- revert defaults for existing projects
+    UPDATE "config"
+    SET password_min_length        = 6,
+        password_require_uppercase = 0,
+        password_require_lowercase = 0,
+        password_require_digit     = 0,
+        password_check_blacklist   = FALSE,
+        login_max_token_expiration = NULL;
+
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2025-04-17-160000-auth-log.ts

@@ -0,0 +1,45 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+CREATE TYPE auth_log_type AS ENUM (
+  'login',
+  'create_session_token',
+  'idp_login',
+  'password_reset_init',
+  'password_reset',
+  'password_change',
+  'email_change',
+  '2fa_disable',
+  '2fa_enable',
+  'passwordless_login_init',
+  'passwordless_login_exchange',
+  'passwordless_login',
+  'person_disable'
+);
+
+CREATE TABLE person_auth_log (
+  id UUID PRIMARY KEY,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  invoked_by_id UUID REFERENCES identity(id) ON DELETE SET NULL,
+  person_id UUID REFERENCES person(id) ON DELETE SET NULL,
+  person_token_id UUID REFERENCES person_token(id) ON DELETE SET NULL,
+  person_input_identifier TEXT DEFAULT NULL,
+  type auth_log_type NOT NULL,
+  success BOOLEAN NOT NULL,
+  error_code TEXT,
+  error_message TEXT,
+  ip_address INET,
+  user_agent TEXT,
+  identity_provider_id UUID REFERENCES identity_provider(id) ON DELETE SET NULL,
+  metadata JSONB
+);
+CREATE INDEX ON person_auth_log (person_input_identifier, created_at DESC)
+	WHERE type = 'login' AND success = FALSE;
+
+CREATE INDEX ON person_auth_log (person_id, created_at DESC);
+                                                     
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -38,7 +38,8 @@ import _20230603104000persondisabled from './2023-06-03-104000-person-disabled'
 import _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config'
 import _20240620140000mailreply from './2024-06-20-140000-mail-reply'
 import _20240826120000passwordless from './2024-08-26-120000-passwordless'
-
+import _20250416180000configup from './2025-04-16-180000-config-up'
+import _20250417160000authlog from './2025-04-17-160000-auth-log'
 import snapshot from './snapshot'
 import { computeTokenHash, Providers } from '../model'
 import { Logger } from '@contember/logger'
@@ -89,6 +90,8 @@ const migrations = {
 	'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,
 	'2024-06-20-140000-mail-reply': _20240620140000mailreply,
 	'2024-08-26-120000-passwordless': _20240826120000passwordless,
+	'2025-04-16-180000-config-up': _20250416180000configup,
+	'2025-04-17-160000-auth-log': _20250417160000authlog,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot-factory.ts

@@ -4,7 +4,6 @@ import { createCredentials } from './tenantCredentials'
 
 export default async (sqlFactory: () => string) => {
 	return async (builder: MigrationBuilder, args: MigrationArgs<TenantMigrationArgs>) => {
-
 		const sql = sqlFactory()
 		builder.sql(sql)
 

package/src/migrations/snapshot.ts

@@ -2,8 +2,23 @@ import { MigrationBuilder } from '@contember/database-migrations'
 import { TenantMigrationArgs } from './types'
 import { createCredentials } from './tenantCredentials'
 
-export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
+export default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {
 	builder.sql(`
+CREATE TYPE "auth_log_type" AS ENUM (
+    'login',
+    'create_session_token',
+    'idp_login',
+    'password_reset_init',
+    'password_reset',
+    'password_change',
+    'email_change',
+    '2fa_disable',
+    '2fa_enable',
+    'passwordless_login_init',
+    'passwordless_login_exchange',
+    'passwordless_login',
+    'person_disable'
+);
 CREATE TYPE "config_policy" AS ENUM (
     'always',
     'never',
@@ -57,7 +72,20 @@ CREATE TABLE "config" (
     "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
     "passwordless_enabled" "config_policy" DEFAULT 'never'::"config_policy" NOT NULL,
     "passwordless_url" "text",
-    "passwordless_expiration_minutes" integer DEFAULT 5 NOT NULL
+    "passwordless_expiration" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "password_min_length" integer DEFAULT 8 NOT NULL,
+    "password_require_uppercase" integer DEFAULT 1 NOT NULL,
+    "password_require_lowercase" integer DEFAULT 1 NOT NULL,
+    "password_require_digit" integer DEFAULT 1 NOT NULL,
+    "password_require_special" integer DEFAULT 0 NOT NULL,
+    "password_pattern" "text",
+    "password_check_blacklist" boolean DEFAULT true NOT NULL,
+    "login_base_backoff" interval DEFAULT '00:00:01'::interval NOT NULL,
+    "login_max_backoff" interval DEFAULT '00:01:00'::interval NOT NULL,
+    "login_attempt_window" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "login_reveal_user_exits" boolean DEFAULT true NOT NULL,
+    "login_default_token_expiration" interval DEFAULT '00:30:00'::interval NOT NULL,
+    "login_max_token_expiration" interval DEFAULT '6 mons'::interval
 );
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
@@ -99,6 +127,22 @@ CREATE TABLE "person" (
     "passwordless_enabled" boolean,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
+CREATE TABLE "person_auth_log" (
+    "id" "uuid" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "invoked_by_id" "uuid",
+    "person_id" "uuid",
+    "person_token_id" "uuid",
+    "person_input_identifier" "text",
+    "type" "auth_log_type" NOT NULL,
+    "success" boolean NOT NULL,
+    "error_code" "text",
+    "error_message" "text",
+    "ip_address" "inet",
+    "user_agent" "text",
+    "identity_provider_id" "uuid",
+    "metadata" "jsonb"
+);
 CREATE TABLE "person_identity_provider" (
     "id" "uuid" NOT NULL,
     "person_id" "uuid" NOT NULL,
@@ -159,6 +203,8 @@ ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
@@ -183,6 +229,7 @@ CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
 CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
 CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
 CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
+CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC);
 CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
 CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
@@ -202,6 +249,14 @@ ALTER TABLE ONLY "identity"
     ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_identity_provider_id_fkey" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_invoked_by_id_fkey" FOREIGN KEY ("invoked_by_id") REFERENCES "identity"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_token_id_fkey" FOREIGN KEY ("person_token_id") REFERENCES "person_token"("id") ON DELETE SET NULL;
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "person_identity_provider"

package/src/migrations/types.ts

@@ -1,7 +1,7 @@
 import { Providers } from '../model'
 
 export interface TenantMigrationArgs {
-	getCredentials: () =>  Promise<{
+	getCredentials: () => Promise<{
 		loginTokenHash?: string
 		rootEmail?: string
 		rootTokenHash?: string

package/src/model/authorization/AclSchemaAccessNodeFactory.ts

@@ -6,7 +6,6 @@ import { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'
 
 export class AclSchemaAccessNodeFactory {
 	create(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {
-
 		const createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {
 			const membershipMatcher = new MembershipMatcher(memberships.map(it => ({
 				...it,

package/src/model/authorization/IdentityScope.ts

@@ -1,4 +1,4 @@
-import { AuthorizationScope, AccessNode } from '@contember/authorization'
+import { AccessNode, AuthorizationScope } from '@contember/authorization'
 import { TenantRole } from './Roles'
 import { Identity } from './Identity'
 

package/src/model/authorization/MembershipMatcher.ts

@@ -12,6 +12,12 @@ export class MembershipMatcher {
 
 	matches(membership: Acl.Membership): boolean {
 		return this.memberships.some(invokerMembership => {
+			if (invokerMembership.matchRule === true) {
+				return true
+			}
+			if (!invokerMembership.matchRule) {
+				return false
+			}
 			const matchRule = invokerMembership.matchRule[membership.role]
 			if (!matchRule) {
 				return false

package/src/model/authorization/PermissionActions.ts

@@ -13,13 +13,13 @@ namespace PermissionActions {
 		idp = 'idp',
 	}
 
-
 	export const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')
 	export const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')
 
 	export const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')
 	export const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })
-	export const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
+	export const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>
+		Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
 
 	export const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })
 
@@ -41,7 +41,8 @@ namespace PermissionActions {
 	export const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })
 
 	export const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })
-	export const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })
+	export const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>
+		Authorizator.createAction(Resources.person, 'invite_unmanaged', { memberships })
 
 	export const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')
 	export const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')
@@ -50,11 +51,14 @@ namespace PermissionActions {
 	export const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')
 	export const ENTRYPOINT_DEPLOY = Authorizator.createAction(Resources.entrypoint, 'deployEntrypoint')
 
-	export const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'viewMembers', { memberships })
-	export const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'addMember', { memberships })
-	export const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'removeMember', { memberships })
-	export const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.project, 'updateMember', { memberships })
-
+	export const PROJECT_VIEW_MEMBER = (memberships: readonly Acl.Membership[]) =>
+		Authorizator.createAction(Resources.project, 'viewMembers', { memberships })
+	export const PROJECT_ADD_MEMBER = (memberships: readonly Acl.Membership[]) =>
+		Authorizator.createAction(Resources.project, 'addMember', { memberships })
+	export const PROJECT_REMOVE_MEMBER = (memberships: readonly Acl.Membership[]) =>
+		Authorizator.createAction(Resources.project, 'removeMember', { memberships })
+	export const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>
+		Authorizator.createAction(Resources.project, 'updateMember', { memberships })
 
 	export const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')
 	export const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })

package/src/model/authorization/PermissionsFactory.ts

@@ -4,7 +4,7 @@ import { TenantRole } from './Roles'
 
 const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])
 
-const projectAdminAllowedInputRoles = ({ roles }: {roles?: readonly string[]}) => {
+const projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {
 	return roles === undefined || roles.every(it => allowedRoles.has(it))
 }
 
@@ -37,6 +37,8 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)

package/src/model/commands/Command.ts

@@ -13,4 +13,4 @@ namespace Command {
 		bus: CommandBus
 	}
 }
-export { type Command }
+export type { Command }

package/src/model/commands/CommandBus.ts

@@ -12,8 +12,6 @@ export class CommandBus<ConnectionType extends Connection.ConnectionLike = Conne
 	async transaction<T>(
 		transactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,
 	): Promise<T> {
-		return await this.client.transaction(client =>
-			transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)),
-		)
+		return await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))
 	}
 }

package/src/model/commands/apiKey/CreateApiKeyCommand.ts

@@ -27,7 +27,7 @@ export class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {
 
 	async execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {
 		const apiKeyId = providers.uuid()
-		let token = undefined
+		let token
 		let tokenHash = this.args.tokenHash
 		if (!tokenHash) {
 			token = await generateToken(providers)

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -0,0 +1,49 @@
+import { Command } from '../Command'
+import { AuthActionType } from '../../type/AuthLog'
+import { InsertBuilder } from '@contember/database'
+import { JSONValue } from '@contember/schema'
+
+export class CreateAuthLogEntryCommand implements Command<void> {
+	constructor(
+		private readonly data: CreateAuthLogEntryCommand.Entry,
+	) {
+	}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await InsertBuilder.create()
+			.into('person_auth_log')
+			.values({
+				id: providers.uuid(),
+				invoked_by_id: this.data.invokedById,
+				person_id: this.data.personId,
+				person_input_identifier: this.data.personInputIdentifier,
+				person_token_id: this.data.personTokenId,
+				type: this.data.type,
+				success: this.data.success,
+				error_code: this.data.errorCode,
+				error_message: this.data.errorMessage,
+				ip_address: this.data.ipAddress,
+				user_agent: this.data.userAgent,
+				identity_provider_id: this.data.identityProviderId,
+				metadata: this.data.metadata ?? {},
+			})
+			.execute(db)
+	}
+}
+
+namespace CreateAuthLogEntryCommand {
+	export type Entry = {
+		type: AuthActionType
+		invokedById: string
+		personInputIdentifier?: string
+		personId?: string
+		personTokenId?: string
+		success: boolean
+		errorCode?: string
+		errorMessage?: string
+		ipAddress?: string
+		userAgent?: string
+		identityProviderId?: string
+		metadata?: JSONValue
+	}
+}