@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.1

package/src/model/service/PasswordlessSignInManager.ts

@@ -1,5 +1,5 @@
 import { ApiKeyManager } from './apiKey'
-import { PersonQuery, PersonRow } from '../queries'
+import { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import {
 	ActivatePasswordlessOtpErrorCode,
@@ -9,26 +9,24 @@ import {
 	SignInPasswordlessErrorCode,
 } from '../../schema'
 import { DatabaseContext, validateToken } from '../utils'
-import { ConfigurationManager } from './ConfigurationManager'
 import { UserMailer } from '../mailing'
-import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'
+import { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'
 import { getPreferredProject } from './helpers/getPreferredProject'
 import { ProjectManager } from './ProjectManager'
 import { PermissionContext } from '../authorization'
 import { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'
 import { ImplementationException } from '../../exceptions'
 import { OtpAuthenticator } from './OtpAuthenticator'
-import { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'
 import { PersonToken } from '../type'
+import { AuthLogService } from './AuthLogService'
+import { intervalToSeconds } from '../utils/interval'
 
 class PasswordlessSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
-		private readonly configurationManager: ConfigurationManager,
 		private readonly mailer: UserMailer,
 		private readonly projectManager: ProjectManager,
 		private readonly otpAuthenticator: OtpAuthenticator,
-
 	) {}
 
 	async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {
@@ -39,23 +37,36 @@ class PasswordlessSignInManager {
 		mailProject?: string
 	}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {
 		return db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {
-			const configuration = await this.configurationManager.fetchConfiguration(db)
+			const configuration = await db.queryHandler.fetch(new ConfigurationQuery())
 			if (configuration.passwordless.enabled === 'never') {
-				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {
+					[AuthLogService.Key]: new AuthLogService.Bag({}),
+				})
 			}
 
 			const person = await db.queryHandler.fetch(PersonQuery.byEmail(email))
 			if (!person) {
-				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)
+				return new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+					}),
+				})
 			}
 			if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
-				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+						personId: person.id,
+					}),
+				})
 			}
 
-			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)
+			const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(
+				person.id,
+				intervalToSeconds(configuration.passwordless.expiration) / 60,
+			)
 			const result = await db.commandBus.execute(createTokenCommand)
 
-
 			const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined
 
 			const projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)
@@ -67,12 +78,22 @@ class PasswordlessSignInManager {
 				url,
 				project: project?.name,
 				projectSlug: project?.slug,
+				requestId: result.id,
 			}, {
 				variant: mailVariant || '',
 				projectId: project?.id ?? null,
 			})
 
-			return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })
+			return new ResponseOk({
+				requestId: result.id,
+				expiresAt: result.expiresAt,
+				person,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personInput: email,
+					personId: person.id,
+					tokenId: result.id,
+				}),
+			})
 		})
 	}
 
@@ -96,7 +117,6 @@ class PasswordlessSignInManager {
 		expiration?: number
 	}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {
 		return db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {
-
 			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
 			const tokenValidationResult = validateToken({
 				entry: tokenResult,
@@ -108,30 +128,61 @@ class PasswordlessSignInManager {
 				if (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {
 					await db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))
 				}
-				return tokenValidationResult
+				return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+					...tokenValidationResult.metadata ?? {},
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: tokenResult?.person_id,
+						tokenId: tokenResult?.id,
+					}),
+				})
+			}
+			if (!tokenResult) {
+				throw new ImplementationException()
 			}
 			const personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))
 			if (!personRow) {
 				throw new ImplementationException()
 			}
 			if (personRow.disabled_at !== null) {
-				return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+				return new ResponseError('PERSON_DISABLED', `Person is disabled`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: personRow.id,
+						tokenId: tokenResult?.id,
+					}),
+				})
 			}
 
 			if (personRow.otp_uri && personRow.otp_activated_at) {
 				if (!mfaOtp) {
-					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+					return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: personRow.id,
+							tokenId: tokenResult?.id,
+						}),
+					})
 				}
 
 				if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
-					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+					return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {
+						[AuthLogService.Key]: new AuthLogService.Bag({
+							personId: personRow.id,
+							tokenId: tokenResult?.id,
+						}),
+					})
 				}
 			}
 
 			await db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))
 			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
 
-			return new ResponseOk({ person: personRow, token: sessionToken })
+			return new ResponseOk({
+				person: personRow,
+				token: sessionToken,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: personRow.id,
+					tokenId: tokenResult?.id,
+				}),
+			})
 		})
 	}
 
@@ -142,7 +193,6 @@ class PasswordlessSignInManager {
 		otpHash: string
 	}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {
 		return db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {
-
 			const tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))
 			const tokenValidationResult = validateToken({
 				entry: tokenResult,
@@ -151,12 +201,24 @@ class PasswordlessSignInManager {
 				validationType: 'token',
 			})
 			if (!tokenValidationResult.ok) {
-				return tokenValidationResult
+				return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+					...tokenValidationResult.metadata ?? {},
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: tokenResult?.person_id,
+						tokenId: tokenResult?.id,
+					}),
+				})
 			}
 
 			await db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))
 
-			return new ResponseOk(null)
+			return new ResponseOk({
+				person: tokenResult?.person_id,
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: tokenResult?.person_id,
+					tokenId: tokenResult?.id,
+				}),
+			})
 		})
 	}
 
@@ -175,16 +237,34 @@ class PasswordlessSignInManager {
 }
 
 namespace PasswordlessSignInManager {
-	export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>
-
+	export type InitSignInPasswordlessResponse = Response<
+		InitSignInPasswordlessResult & {
+			[AuthLogService.Key]: AuthLogService.Bag
+		},
+		InitSignInPasswordlessErrorCode,
+		{
+			[AuthLogService.Key]: AuthLogService.Bag
+		}
+	>
 
 	interface SignInPasswordlessResult {
 		readonly person: PersonRow
 		readonly token: string
+		[AuthLogService.Key]: AuthLogService.Bag
 	}
-	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>
+	export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {
+		[AuthLogService.Key]: AuthLogService.Bag
+	}>
 
-	export type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>
+	export type ActivatePasswordlessOtpResponse = Response<
+		{
+			[AuthLogService.Key]: AuthLogService.Bag
+		},
+		ActivatePasswordlessOtpErrorCode,
+		{
+			[AuthLogService.Key]: AuthLogService.Bag
+		}
+	>
 }
 
 export { PasswordlessSignInManager }

package/src/model/service/PersonAccessManager.ts

@@ -1,4 +1,4 @@
-import { PersonQuery } from '../queries'
+import { PersonQuery, PersonRow } from '../queries'
 import { DatabaseContext } from '../utils'
 import { DisablePersonCommand } from '../commands/person/DisablePersonCommand'
 import { ApiKeyManager } from './apiKey'
@@ -6,40 +6,20 @@ import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { DisablePersonErrorCode } from '../../schema'
 
 class PersonAccessManager {
-
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
 
-	async disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {
-		const result = await dbContext.transaction(async trx => {
-			const personRow = await trx.queryHandler.fetch(
-				PersonQuery.byId(personId),
-			)
-
-			if (personRow === null) {
-				return 'PERSON_NOT_FOUND'
-			}
-
-			if (personRow.disabled_at !== null) {
-				return 'PERSON_ALREADY_DISABLED'
+	async disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {
+		return await dbContext.transaction(async trx => {
+			if (person.disabled_at !== null) {
+				return new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')
 			}
 
 			// Deactivate person & invalidate all api keys associated with person identity
-			await this.disablePersonAccount(trx, personRow.id)
-			await this.disableIdentityApiKeys(trx, personRow.identity_id)
+			await this.disablePersonAccount(trx, person.id)
+			await this.disableIdentityApiKeys(trx, person.identity_id)
 
-			return null
+			return new ResponseOk(null)
 		})
-
-		switch (result) {
-			case null:
-				return new ResponseOk(null)
-
-			case 'PERSON_ALREADY_DISABLED':
-				return new ResponseError(result, 'Person is already disable')
-
-			case 'PERSON_NOT_FOUND':
-				return new ResponseError(result, 'Person not found')
-		}
 	}
 
 	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {

package/src/model/service/PersonManager.ts

@@ -32,7 +32,6 @@ class PersonManager {
 		await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))
 		return new ResponseOk(null)
 	}
-
 }
 
 namespace PersonManager {

package/src/model/service/ProjectManager.ts

@@ -1,9 +1,4 @@
-import {
-	AddProjectMemberCommand,
-	CreateProjectCommand,
-	SetProjectSecretCommand,
-	UpdateProjectCommand,
-} from '../commands'
+import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands'
 import { PermissionContext } from '../authorization'
 import { Project, ProjectInitializer, ProjectWithSecrets } from '../type'
 import { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries'
@@ -115,7 +110,6 @@ export class ProjectManager {
 
 export class ProjectInitError extends Error {}
 
-
 export type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>
 
 export class CreateProjectResult {

package/src/model/service/ProjectMemberManager.ts

@@ -92,8 +92,12 @@ export class ProjectMemberManager {
 		return []
 	}
 
-
-	async getProjectMembers(dbContext: DatabaseContext, projectId: string, accessVerifier: AccessVerifier, input: ProjectMembersInput): Promise<GetProjectMembersResponse> {
+	async getProjectMembers(
+		dbContext: DatabaseContext,
+		projectId: string,
+		accessVerifier: AccessVerifier,
+		input: ProjectMembersInput,
+	): Promise<GetProjectMembersResponse> {
 		return dbContext.transaction(async db => {
 			const members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))
 			const memberships = await db.queryHandler.fetch(

package/src/model/service/RolesManager.ts

@@ -12,7 +12,12 @@ export class RolesManager {
 		return this.patchGlobalRoles(dbContext, identityId, [], roles)
 	}
 
-	private async patchGlobalRoles(dbContext: DatabaseContext, identityId: string, addRoles: readonly string[], removeRoles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+	private async patchGlobalRoles(
+		dbContext: DatabaseContext,
+		identityId: string,
+		addRoles: readonly string[],
+		removeRoles: readonly string[],
+	): Promise<Response<null, GlobalRolesErrorCode>> {
 		const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])
 		if (rolesValidationError) {
 			return rolesValidationError
@@ -24,7 +29,6 @@ export class RolesManager {
 		return new ResponseOk(null)
 	}
 
-
 	private validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {
 		for (const role of roles) {
 			if (!Object.values(TenantRole).includes(role as TenantRole)) {

package/src/model/service/SecretsManager.ts

@@ -17,7 +17,7 @@ export class SecretsManager {
 		return Object.fromEntries(result.map(it => [it.key, it.value.toString()]))
 	}
 
-	private async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: {key: string; value: Buffer}[]): Promise<void> {
+	private async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {
 		if (secrets.length === 0) {
 			return
 		}

package/src/model/service/SignInManager.ts

@@ -5,6 +5,7 @@ import { Providers } from '../providers'
 import { DatabaseContext } from '../utils'
 import { Response, ResponseError, ResponseOk } from '../utils/Response'
 import { ImplementationException } from '../../exceptions'
+import { AuthLogService } from './AuthLogService'
 
 class SignInManager {
 	constructor(
@@ -14,39 +15,49 @@ class SignInManager {
 	) {}
 
 	async signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {
-		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))
-
-		if (personRow === null) {
-			return new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`)
+		const person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))
+
+		if (person === null) {
+			return new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personInput: email,
+				}),
+			})
 		}
 
-		if (!personRow.password_hash) {
-			return new ResponseError('NO_PASSWORD_SET', `No password set`)
+		const authLogData = {
+			[AuthLogService.Key]: new AuthLogService.Bag({
+				personInput: email,
+				personId: person.id,
+			}),
+		}
+		if (!person.password_hash) {
+			return new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)
 		}
 
-		if (personRow.disabled_at !== null) {
-			return new ResponseError('PERSON_DISABLED', `Person is disabled`)
+		if (person.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)
 		}
 
-		const passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash)
+		const passwordValid = await this.providers.bcryptCompare(password, person.password_hash)
 
 		if (!passwordValid) {
-			return new ResponseError('INVALID_PASSWORD', `Password does not match`)
+			return new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)
 		}
 
-		if (personRow.otp_uri && personRow.otp_activated_at) {
+		if (person.otp_uri && person.otp_activated_at) {
 			if (!otpCode) {
-				return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)
+				return new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)
 			}
 
-			if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {
-				return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')
+			if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+				return new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)
 			}
 		}
 
-		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)
+		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)
 
-		return new ResponseOk(new SignInResult(personRow, sessionToken))
+		return new ResponseOk({ person, token: sessionToken, ...authLogData })
 	}
 
 	async createSessionToken(
@@ -55,38 +66,61 @@ class SignInManager {
 		expiration?: number,
 		verifier?: (person: PersonRow) => Promise<void>,
 	): Promise<CreateSessionTokenResponse> {
-		const personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))
+		const person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))
 
-		if (personRow === null) {
+		if (person === null) {
 			if (personIdentifier.type === 'email') {
-				return new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`)
-
+				return new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: personIdentifier.email,
+					}),
+				})
 			} else if (personIdentifier.type === 'id') {
-				return new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`)
+				return new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: personIdentifier.id,
+					}),
+				})
 			}
 
 			throw new ImplementationException()
 		}
 
-		if (personRow.disabled_at !== null) {
-			return new ResponseError('PERSON_DISABLED', `Person with id ${personRow.id} is disabled`)
+		const inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id
+		if (person.disabled_at !== null) {
+			return new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {
+				[AuthLogService.Key]: new AuthLogService.Bag({
+					personId: person.id,
+					personInput: inputValue,
+				}),
+			})
 		}
 
-		await verifier?.(personRow)
-
-		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)
-		return new ResponseOk(new SignInResult(personRow, sessionToken))
+		await verifier?.(person)
+
+		const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)
+		return new ResponseOk({
+			person,
+			token: sessionToken,
+			[AuthLogService.Key]: new AuthLogService.Bag({
+				personId: person.id,
+				personInput: inputValue,
+			}),
+		})
 	}
 }
 
-export class SignInResult {
-	constructor(
-		public readonly person: PersonRow,
-		public readonly token: string,
-	) {}
+export interface SignInResult {
+	readonly person: PersonRow
+	readonly token: string
+	[AuthLogService.Key]: AuthLogService.Bag
 }
 
-export type SignInResponse = Response<SignInResult, SignInErrorCode>
-export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode>
+export type SignInResponse = Response<SignInResult, SignInErrorCode, {
+	[AuthLogService.Key]: AuthLogService.Bag
+}>
+export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {
+	[AuthLogService.Key]: AuthLogService.Bag
+}>
 
 export { SignInManager }

package/src/model/service/SignUpManager.ts

@@ -1,12 +1,12 @@
 import { CreateIdentityCommand, CreatePersonCommand } from '../commands'
-import { PersonQuery, PersonRow } from '../queries'
-import { SignUpErrorCode } from '../../schema'
+import { ConfigurationQuery, PersonRow } from '../queries'
+import { SignUpErrorCode, WeakPasswordReason } from '../../schema'
 import { TenantRole } from '../authorization'
-import { getPasswordWeaknessMessage } from '../utils/password'
-import { Response, ResponseError, ResponseOk } from '../utils/Response'
+import { Response, ResponseOk } from '../utils/Response'
 import { DatabaseContext } from '../utils'
 import { MaybePassword } from '../dtos'
 import { EmailValidator } from './EmailValidator'
+import { PasswordStrengthValidator } from './PasswordStrengthValidator'
 
 type SignUpUser = {
 	email: string
@@ -18,6 +18,7 @@ type SignUpUser = {
 export class SignUpManager {
 	constructor(
 		private readonly emailValidator: EmailValidator,
+		private readonly passwordStrengthValidator: PasswordStrengthValidator,
 	) {
 	}
 
@@ -27,10 +28,15 @@ export class SignUpManager {
 			return validationError
 		}
 		const plainPassword = password.getPlain()
-		const weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null
-		if (weakPassword) {
-			return new ResponseError('TOO_WEAK', weakPassword)
+
+		if (plainPassword) {
+			const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+			const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')
+			if (!passwordVerifyResult.ok) {
+				return passwordVerifyResult
+			}
 		}
+
 		const person = await dbContext.transaction(async db => {
 			const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))
 			return await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))
@@ -42,4 +48,6 @@ export class SignUpManager {
 export class SignUpResult {
 	constructor(public readonly person: Omit<PersonRow, 'roles'>) {}
 }
-export type SignUpResponse = Response<SignUpResult, SignUpErrorCode>
+export type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {
+	weakPasswordReasons?: WeakPasswordReason[]
+}>

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -12,7 +12,10 @@ import { DatabaseContext, TokenHash } from '../../utils'
 import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'
 import assert from 'node:assert'
 import { Acl } from '@contember/schema'
-import { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow } from '../../queries'
+import { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery } from '../../queries'
+import PostgresInterval from 'postgres-interval'
+import { Config } from '../../type/Config'
+import { intervalToSeconds } from '../../utils/interval'
 
 export class ApiKeyManager {
 	constructor(
@@ -56,13 +59,17 @@ export class ApiKeyManager {
 	}
 
 	async createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {
-		const command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration })
+		const config = await dbContext.queryHandler.fetch(new ConfigurationQuery())
+		const expirationResolved = expiration ?? (intervalToSeconds(config.login.defaultTokenExpiration) / 60)
+		const expirationCapped = config.login.maxTokenExpiration
+			? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60)
+			: expirationResolved
+		const command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped })
 		const token = (await dbContext.commandBus.execute(command)).token
 		assert(token !== undefined)
 		return token
 	}
 
-
 	async findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {
 		return await dbContext.queryHandler.fetch(
 			new ApiKeyByIdQuery(apiKeyId),
@@ -103,7 +110,6 @@ export class ApiKeyManager {
 			return await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash)
 		})
 	}
-
 }
 
 export type VerifyResponse = Response<VerifyResult, VerifyErrorCode>
@@ -119,7 +125,7 @@ export class VerifyResult {
 	) {}
 }
 
-export const enum VerifyErrorCode {
+export enum VerifyErrorCode {
 	NOT_FOUND = 'not_found',
 	DISABLED = 'disabled',
 	EXPIRED = 'expired',

package/src/model/service/apiKey/ApiKeyService.ts

@@ -39,11 +39,10 @@ export class ApiKeyService {
 	}
 }
 
-
 export type CreateApiKeyResponse = Response<CreateApiKeyResult, never>
 
 export class CreateApiKeyResult {
-	constructor(public readonly identity: {id: string; description?: string}, public readonly apiKey: { id: string; token?: string }) {
+	constructor(public readonly identity: { id: string; description?: string }, public readonly apiKey: { id: string; token?: string }) {
 	}
 
 	toApiKeyWithToken(): ApiKeyWithToken {