@contember/engine-tenant-api 2.1.0-alpha.8 → 2.1.0-beta.1

package/tests/cases/integration/mocked/prepareOtpMutation.test.ts

@@ -2,7 +2,7 @@ import { authenticatedIdentityId, executeTenantTest } from '../../../src/testTen
 import { testUuid } from '../../../src/testUuid'
 import { prepareOtpMutation } from './gql/prepareOtp'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
-import { test, expect } from 'bun:test'
+import { expect, test } from 'bun:test'
 
 test('prepare otp', async () => {
 	const personId = testUuid(1)
@@ -32,4 +32,3 @@ test('prepare otp', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/removeProjectMemberMutation.test.ts

@@ -45,4 +45,3 @@ test('removes a project member', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -1,6 +1,6 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { signInIDP } from './gql/signInIdp'
 import { sqlTransaction } from './sql/sqlTransaction'
 import { getIdpBySlugSql } from './sql/getIdpBySlugSql'
@@ -10,6 +10,7 @@ import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
 import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { createIdentitySql } from './sql/createIdentitySql'
 import { createPersonSql } from './sql/createPersonSql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs in idp with existing identity', async () => {
 	const externalIdentifier = 'abcd'
@@ -57,6 +58,7 @@ test('signs in idp with existing identity', async () => {
 						roles: [],
 					},
 				}),
+				getConfigSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,
@@ -80,10 +82,15 @@ test('signs in idp with existing identity', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
-
 test('signs in exclusive idp', async () => {
 	const externalIdentifier = 'abcd'
 	const email = 'john@doe.com'
@@ -131,6 +138,7 @@ test('signs in exclusive idp', async () => {
 					parameters: [testUuid(3), idpId, personId, externalIdentifier],
 					response: { rowCount: 1 },
 				},
+				getConfigSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,
@@ -154,5 +162,11 @@ test('signs in exclusive idp', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -5,11 +5,13 @@ import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { signInMutation } from './gql/signIn'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
 import { SignInErrorCode } from '../../../../src/schema'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src'
 import { Buffer } from 'buffer'
 import { createSessionKeySql } from './sql/createSessionKeySql'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs in', async () => {
 	const email = 'john@doe.com'
@@ -21,7 +23,9 @@ test('signs in', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }, { withData: true }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -29,26 +33,6 @@ test('signs in', async () => {
 				projectId,
 				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
 			}),
-			{
-				sql: SQL`SELECT "id",
-						         "email",
-						         "identity_id"
-					         FROM "tenant"."person"
-					         WHERE "id" = ?`,
-				parameters: [personId],
-				response: { rows: [{ id: personId, email: email }] },
-			},
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo' }] },
-			},
 		],
 		return: {
 			data: {
@@ -78,6 +62,12 @@ test('signs in', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
@@ -91,8 +81,10 @@ test('signs in - normalize email', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -112,6 +104,12 @@ test('signs in - normalize email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
@@ -122,7 +120,11 @@ test('sign in - invalid password', async () => {
 	const personId = testUuid(7)
 	await executeTenantTest({
 		query: signInMutation({ email, password: 'abcd' }),
-		executes: [getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } })],
+		executes: [
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
+		],
 		return: {
 			data: {
 				signIn: {
@@ -132,6 +134,12 @@ test('sign in - invalid password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -143,7 +151,18 @@ test('otp token not provided', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
-			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember' } }),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({
+				email,
+				response: {
+					personId,
+					identityId,
+					password,
+					roles: [],
+					otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember',
+				},
+			}),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -154,6 +173,12 @@ test('otp token not provided', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -172,7 +197,9 @@ test('sign in - invalid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: '123456' }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -183,6 +210,12 @@ test('sign in - invalid otp token', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -201,7 +234,9 @@ test('sign in - valid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: otpAuth.generate(otp) }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId, identityId }),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({
@@ -221,6 +256,11 @@ test('sign in - valid otp token', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
-

package/tests/cases/integration/mocked/signOutMutation.test.ts

@@ -109,11 +109,6 @@ test('sign out - permanent api key', async () => {
 				apiKeyId: authenticatedApiKeyId,
 				response: { personId: personId, identityId: authenticatedIdentityId, apiKeyType: ApiKey.Type.PERMANENT },
 			}),
-			{
-				sql: SQL`update "tenant"."api_key" set "disabled_at" = ? where "identity_id" = ?`,
-				parameters: [(val: any) => val instanceof Date, identityId],
-				response: { rowCount: 1 },
-			},
 		],
 		return: {
 			data: {
@@ -158,4 +153,3 @@ test('sign out - not a person', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/signUpMutation.test.ts

@@ -8,10 +8,11 @@ import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
 import { sqlTransaction } from './sql/sqlTransaction'
 import { disableOneOffKeySql } from './sql/disableOneOffKeySql'
 import { test } from 'bun:test'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs up a new user', async () => {
 	const email = 'john@doe.com'
-	const password = '123456'
+	const password = 'Ab1Cd23456'
 	const identityId = testUuid(1)
 	const personId = testUuid(2)
 	const projectId = testUuid(3)
@@ -19,6 +20,7 @@ test('signs up a new user', async () => {
 		query: signUpMutation({ email, password }),
 		executes: [
 			getPersonByEmailSql({ email, response: null }),
+			getConfigSql(),
 			...sqlTransaction(
 				createIdentitySql({ identityId, roles: ['person'] }),
 				createPersonSql({ personId, email, password, identityId }),
@@ -29,17 +31,6 @@ test('signs up a new user', async () => {
 				parameters: [testUuid(1)],
 				response: { rows: [{ id: testUuid(1), description: '', roles: ['person'] }] },
 			},
-			{
-				sql: SQL`select
-                       "project"."id",
-                       "project"."name",
-                       "project"."slug"
-                     from "tenant"."project"
-                       inner join "tenant"."project_member" as "project_member" on "project_member"."project_id" = "project"."id"
-                     where "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		return: {
 			data: {
@@ -85,4 +76,3 @@ test('not sign up user with existing email', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/sql/createPersonSql.ts

@@ -11,6 +11,13 @@ export const createPersonSql = (args: {
 }): ExpectedQuery => ({
 	sql: SQL`INSERT INTO "tenant"."person" ("id", "email", "name", "password_hash", "identity_id", "idp_only")
 	         VALUES (?, ?, ?, ?, ?, ?)`,
-	parameters: [args.personId, args.email ?? null, args.name ?? args.email?.split('@')[0], args.password ? `BCRYPTED-${args.password}` : null, args.identityId, args.idpOnly ?? false],
+	parameters: [
+		args.personId,
+		args.email ?? null,
+		args.name ?? args.email?.split('@')[0],
+		args.password ? `BCRYPTED-${args.password}` : null,
+		args.identityId,
+		args.idpOnly ?? false,
+	],
 	response: { rowCount: 1 },
 })

package/tests/cases/integration/mocked/sql/createSessionKeySql.ts

@@ -1,6 +1,6 @@
 import { SQL } from '../../../../src/tags'
 
-export const createSessionKeySql = function ({ apiKeyId, identityId }: { apiKeyId: string; identityId: string }) {
+export const createSessionKeySql = function({ apiKeyId, identityId }: { apiKeyId: string; identityId: string }) {
 	return {
 		sql: SQL`INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at",
 												 "expiration", "created_at")
@@ -12,7 +12,7 @@ export const createSessionKeySql = function ({ apiKeyId, identityId }: { apiKeyI
 			identityId,
 			null,
 			new Date('2019-09-04 12:30'),
-			null,
+			30,
 			new Date('2019-09-04 12:00'),
 		],
 		response: { rowCount: 1 },

package/tests/cases/integration/mocked/sql/getApiKeySql.ts

@@ -6,8 +6,8 @@ export const getApiKeySql = (args: {
 	apiKeyId: string
 	response: { identityId: string; personId: string; apiKeyType: ApiKey.Type }
 }): ExpectedQuery => ({
-	sql: SQL
-	`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id"
+	sql:
+		SQL`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id"
 		from "tenant"."api_key"
     	inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id"
     	left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id"

package/tests/cases/integration/mocked/sql/getConfigSql.ts

@@ -0,0 +1,29 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import PostgresInterval from 'postgres-interval'
+export const getConfigSql = (): ExpectedQuery => ({
+	sql: `select *  from "tenant"."config"`,
+	parameters: [],
+	response: {
+		rows: [
+			{
+				id: 'b65949a6-b481-40b5-a0ed-0acdb5a24cb6',
+				passwordless_enabled: 'never',
+				passwordless_url: null,
+				passwordless_expiration: PostgresInterval('00:10:00'),
+				password_min_length: 6,
+				password_require_uppercase: 1,
+				password_require_lowercase: 1,
+				password_require_digit: 1,
+				password_require_special: 0,
+				password_pattern: null,
+				password_check_blacklist: true,
+				login_base_backoff: PostgresInterval('00:00:01'),
+				login_max_backoff: PostgresInterval('00:01:00'),
+				login_attempt_window: PostgresInterval('00:05:00'),
+				login_reveal_user_exits: true,
+				login_default_token_expiration: PostgresInterval('00:30:00'),
+				login_max_token_expiration: PostgresInterval('12:00:00'),
+			},
+		],
+	},
+})

package/tests/cases/integration/mocked/sql/getIdentityProjectsSql.ts

@@ -1,6 +1,6 @@
 import { SQL } from '../../../../src/tags'
 
-export const getIdentityProjectsSql = function ({ identityId, projectId }: { identityId: string; projectId: string }) {
+export const getIdentityProjectsSql = function({ identityId, projectId }: { identityId: string; projectId: string }) {
 	return {
 		sql: SQL`SELECT "project"."id", "project"."name", "project"."slug", "project"."config"
 				 FROM "tenant"."project"

package/tests/cases/integration/mocked/sql/getIdpBySlugSql.ts

@@ -6,7 +6,8 @@ export const getIdpBySlugSql = (args: {
 	slug: string
 	response: null | IdentityProviderRow
 }): ExpectedQuery => ({
-	sql: SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig"
+	sql:
+		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig"
 		from "tenant"."identity_provider"
 		where "slug" = ?`,
 	parameters: [args.slug],

package/tests/cases/integration/mocked/sql/getMailTemplateSql.ts

@@ -2,25 +2,29 @@ import { ExpectedQuery } from '@contember/database-tester'
 
 export const getMailTemplateSql = (
 	args: { type: string; projectId: string | null },
-): ExpectedQuery => args.projectId ? {
-	sql: `select "mail_template"."id", "subject", "content", "use_layout" as "useLayout", "reply_to" as "replyTo", "project_id" as "projectId", "mail_type" as "type", "variant"
+): ExpectedQuery =>
+	args.projectId
+		? {
+			sql:
+				`select "mail_template"."id", "subject", "content", "use_layout" as "useLayout", "reply_to" as "replyTo", "project_id" as "projectId", "mail_type" as "type", "variant"
 			  FROM "tenant"."mail_template"
 			  WHERE "project_id" = ?
 				AND "mail_type" = ?
 				AND "variant" = ?`,
-	parameters: [args.projectId, args.type, ''],
-	response: {
-		rows: [],
-	},
-} :
-	{
-		sql: `select "mail_template"."id", "subject", "content", "use_layout" as "useLayout", "reply_to" as "replyTo", "project_id" as "projectId", "mail_type" as "type", "variant"
+			parameters: [args.projectId, args.type, ''],
+			response: {
+				rows: [],
+			},
+		}
+		: {
+			sql:
+				`select "mail_template"."id", "subject", "content", "use_layout" as "useLayout", "reply_to" as "replyTo", "project_id" as "projectId", "mail_type" as "type", "variant"
 			  FROM "tenant"."mail_template"
 			  WHERE "project_id" IS NULL
 				AND "mail_type" = ?
 				AND "variant" = ?`,
-		parameters: [args.type, ''],
-		response: {
-			rows: [],
-		},
-	}
+			parameters: [args.type, ''],
+			response: {
+				rows: [],
+			},
+		}

package/tests/cases/integration/mocked/sql/getNextLoginAttemptSql.ts

@@ -0,0 +1,20 @@
+import { ExpectedQuery } from '@contember/database-tester'
+
+export const getNextLoginAttemptSql = (email: string): ExpectedQuery => ({
+	sql:
+		`with "cfg" as (select *  from "tenant"."config"), "last_successful_reset" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select
+                                        GREATEST(
+                                                COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
+                                                NOW() - cfg.login_attempt_window
+                                        ) as "start_time"  from "cfg", "last_successful_reset"), "failed_logins" as (select COUNT(*) as "fails", MAX(person_auth_log.created_at) as "last_fail"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select
+                                CASE WHEN failed_logins.fails = 0
+                                THEN NOW()
+                                ELSE LEAST(
+                                        failed_logins.last_fail + cfg.login_max_backoff,
+                                        failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+                                ) END as "next_allowed_login"  from "failed_logins", "cfg"`,
+	parameters: ['password_reset', true, email, email, 'login', false],
+	response: {
+		rows: [],
+	},
+})

package/tests/cases/integration/mocked/sql/getPersonByEmailSql.ts

@@ -5,7 +5,8 @@ export const getPersonByEmailSql = (args: {
 	email: string
 	response: null | { personId: string; password: string; identityId: string; roles: string[]; otpUri?: string }
 }): ExpectedQuery => ({
-	sql: SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 	         WHERE "person"."email" = ?`,
@@ -24,7 +25,7 @@ export const getPersonByEmailSql = (args: {
 					disabled_at: null,
 					passwordless_enabled: null,
 				},
-			  ]
+			]
 			: [],
 	},
 })

package/tests/cases/integration/mocked/sql/getPersonByIdSql.ts

@@ -5,7 +5,8 @@ export const getPersonByIdSql = (args: {
 	personId: string
 	response: { personId: string; password: string; identityId: string; roles: string[]; email: string; name?: string }
 }): ExpectedQuery => ({
-	sql: SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 	         WHERE "person"."id" = ?`,

package/tests/cases/integration/mocked/sql/getPersonByIdentity.ts

@@ -5,7 +5,8 @@ export const getPersonByIdentity = (args: {
 	identityId: string
 	response: null | { personId: string; password: string; roles: string[]; email: string; name?: string; otpUri?: string }
 }): ExpectedQuery => ({
-	sql: SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 	         WHERE "person"."identity_id" = ?`,

package/tests/cases/integration/mocked/sql/getPersonByIdpSql.ts

@@ -6,7 +6,8 @@ export const getPersonByIdpSql = (args: {
 	externalIdentifier: string
 	response: null | { personId: string; password?: string; identityId: string; email: string; roles: string[]; otpUri?: string }
 }): ExpectedQuery => ({
-	sql: SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
 	         FROM "tenant"."person"
 		        INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 				INNER JOIN  "tenant"."person_identity_provider" as "idp" on  "idp"."person_id" = "person"."id"
@@ -26,7 +27,7 @@ export const getPersonByIdpSql = (args: {
 					otp_activated_at: args.response.otpUri ? new Date() : null,
 					disabled_at: null,
 				},
-			  ]
+			]
 			: [],
 	},
 })

package/tests/cases/integration/mocked/updateProjectMemberMutation.test.ts

@@ -57,4 +57,3 @@ test('update project member', async () => {
 		},
 	})
 })
-

package/tests/cases/migrations/2020-06-08-134000-tenant-credentials.test.ts

@@ -1,6 +1,6 @@
 import migration from '../../../src/migrations/2020-06-08-134000-tenant-credentials'
 import { createMigrationBuilder } from '@contember/database-migrations'
-import { test, expect } from 'bun:test'
+import { expect, test } from 'bun:test'
 
 let uuidNum = 0
 export const testUuid = () => '123e4567-e89b-12d3-a456-' + (uuidNum++).toString().padStart(12, '0')

package/tests/cases/unit/authorization/membershipAwareAccessNode.test.ts

@@ -1,4 +1,4 @@
-import { test, expect } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { testUuid } from '../../../src/testUuid'
 import { AclSchemaAccessNodeFactory, PermissionActions } from '../../../../src'
 import { Acl } from '@contember/schema'
@@ -49,7 +49,6 @@ test('admin can invite editor role with matching variable', async () => {
 	expect(await node.isAllowed(aclEvaluator, PermissionActions.PERSON_INVITE(editorOfSiteA))).toBeTrue()
 })
 
-
 const aclSchemaForInviteOnly: Acl.Schema = {
 	roles: {
 		admin: {
@@ -67,7 +66,6 @@ const aclSchemaForInviteOnly: Acl.Schema = {
 	},
 }
 
-
 test('admin can invite public. cannot manage public, cannot invite lorem', async () => {
 	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForInviteOnly, [{ role: 'admin', variables: [] }])
 
@@ -78,7 +76,6 @@ test('admin can invite public. cannot manage public, cannot invite lorem', async
 	expect(await node.isAllowed(aclEvaluator, PermissionActions.PROJECT_REMOVE_MEMBER([{ role: 'public', variables: [] }]))).toBeFalse()
 })
 
-
 const aclSchemaForViewOnly: Acl.Schema = {
 	roles: {
 		admin: {
@@ -93,7 +90,6 @@ const aclSchemaForViewOnly: Acl.Schema = {
 	},
 }
 
-
 test('admin can view lorem, but cannot manage it', async () => {
 	const node = new AclSchemaAccessNodeFactory().create(aclSchemaForViewOnly, [{ role: 'admin', variables: [] }])
 

package/tests/src/testTenant.ts

@@ -22,12 +22,15 @@ import { dbCredentials } from './dbUtils'
 import { IdPMock } from './IdPMock'
 import { createLogger, JsonStreamLoggerHandler } from '@contember/logger'
 import { emptySchema } from '@contember/schema-utils'
+import { expect } from 'bun:test'
+import { AuthLogService } from '../../src/model/service/AuthLogService'
 
 export interface Test {
 	query: GraphQLTestQuery
 	executes: ExpectedQuery[]
 	return: object
 	sentMails?: ExpectedMessage[]
+	expectedAuthLog?: AuthLogService.LogArgs
 }
 
 export const createUuidGenerator = () => {
@@ -114,6 +117,14 @@ export const executeTenantTest = async (test: Test) => {
 			authenticatedApiKeyId,
 		),
 		logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
+		logAuthAction: async args => {
+			if (!test.expectedAuthLog) {
+				console.log(JSON.stringify(args))
+				throw new Error('No expected auth log')
+			}
+			expect(args).toEqual(test.expectedAuthLog)
+			test.expectedAuthLog = undefined
+		},
 		db: databaseContext,
 	}
 
@@ -135,4 +146,6 @@ export const executeTenantTest = async (test: Test) => {
 		mailer.expectMessage(email)
 	}
 	mailer.expectEmpty()
+	expect(test.executes).toHaveLength(0)
+	expect(test.expectedAuthLog).toBeUndefined()
 }