@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.1

package/src/schema/tenant.graphql.ts

@@ -4,6 +4,9 @@ import { DocumentNode } from 'graphql'
 const schema: DocumentNode = gql`
 	scalar Json
 	scalar DateTime
+	
+	""" Interval is a string in the format ISO 8601, e.g. "PT1H" for 1 hour """
+	scalar Interval
 
 	schema {
 		query: Query
@@ -120,16 +123,39 @@ const schema: DocumentNode = gql`
 	
 	type Config {
 		passwordless: ConfigPasswordless!
+		password: ConfigPassword!
+		login: ConfigLogin!
 	}
 	
 	type ConfigPasswordless {
 		enabled: ConfigPolicy!
 		url: String
-		expirationMinutes: Int!
+		expiration: Interval!
 	}
 	
+	type ConfigPassword {
+		minLength: Int!
+		requireUppercase: Int!
+		requireLowercase: Int!
+		requireDigit: Int!
+		requireSpecial: Int!
+		pattern: String
+		checkBlacklist: Boolean!
+    }
+	
+	type ConfigLogin {
+		baseBackoff: Interval!
+		maxBackoff: Interval!
+		attemptWindow: Interval!
+		revealUserExists: Boolean!
+		defaultTokenExpiration: Interval!
+		maxTokenExpiration: Interval
+    }
+	
 	input ConfigInput {
 		passwordless: ConfigPasswordlessInput
+		password: ConfigPasswordInput
+		login: ConfigLoginInput
 	}
 	
 	enum ConfigPolicy {
@@ -142,9 +168,28 @@ const schema: DocumentNode = gql`
 	input ConfigPasswordlessInput {
 		enabled: ConfigPolicy
 		url: String
-		expirationMinutes: Int
+		expiration: Interval
 	}
 	
+	input ConfigPasswordInput {
+		minLength: Int
+		requireUppercase: Int
+		requireLowercase: Int
+		requireDigit: Int
+		requireSpecial: Int
+		pattern: String
+		checkBlacklist: Boolean
+    }
+	
+	input ConfigLoginInput {
+		baseBackoff: Interval
+		maxBackoff: Interval
+		attemptWindow: Interval
+		revealUserExists: Boolean
+		defaultTokenExpiration: Interval
+		maxTokenExpiration: Interval
+    }
+	
 	type ConfigureResponse {
 		ok: Boolean!
 		error: ConfigureError
@@ -169,6 +214,7 @@ const schema: DocumentNode = gql`
 
 	type SignUpError {
 		code: SignUpErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endPersonMessage: String @deprecated
 	}
@@ -202,15 +248,18 @@ const schema: DocumentNode = gql`
 		code: SignInErrorCode!
 		developerMessage: String!
 		endUserMessage: String @deprecated
+		retryAfter: Int
 	}
 
 	enum SignInErrorCode {
+		INVALID_CREDENTIALS
 		UNKNOWN_EMAIL
 		INVALID_PASSWORD
 		PERSON_DISABLED
 		NO_PASSWORD_SET
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
+		RATE_LIMIT_EXCEEDED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -307,6 +356,7 @@ const schema: DocumentNode = gql`
 
 	type ChangePasswordError {
 		code: ChangePasswordErrorCode!
+		weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}
@@ -315,6 +365,16 @@ const schema: DocumentNode = gql`
 		PERSON_NOT_FOUND
 		TOO_WEAK
 	}
+	
+	enum WeakPasswordReason {
+		TOO_SHORT
+		MISSING_UPPERCASE
+		MISSING_LOWERCASE
+		MISSING_DIGIT
+		MISSING_SPECIAL
+		INVALID_PATTERN
+		BLACKLISTED
+    }
 
 
 	# === changeMyPassword ===
@@ -326,6 +386,7 @@ const schema: DocumentNode = gql`
 
 	type ChangeMyPasswordError {
 		code: ChangeMyPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 	}
 
@@ -1086,6 +1147,7 @@ const schema: DocumentNode = gql`
 	}
 	type ResetPasswordError {
 		code: ResetPasswordErrorCode!
+        weakPasswordReasons: [WeakPasswordReason!]
 		developerMessage: String!
 		endUserMessage: String @deprecated
 	}

package/src/schema/types.ts

@@ -0,0 +1,4 @@
+import { IPostgresInterval } from 'postgres-interval'
+
+export type Interval = string & { __kind: 'Interval' }
+export type OutputInterval = string & { __kind: 'Interval' } | IPostgresInterval

package/src/utils/Mailer.ts

@@ -27,8 +27,7 @@ export interface SentInfo {
 
 export type MailerOptions =
 	& (
-		SMTPTransport.Options | SMTPPool.Options | SendmailTransport.Options | SESTransport.Options | TransportOptions
-		| {
+		SMTPTransport.Options | SMTPPool.Options | SendmailTransport.Options | SESTransport.Options | TransportOptions | {
 			webhook: string | {
 				url: string
 				headers?: Record<string, string>
@@ -39,7 +38,6 @@ export type MailerOptions =
 		from?: string
 	}
 
-
 export interface Mailer {
 	send(message: MailMessage): Promise<SentInfo>
 }
@@ -58,7 +56,6 @@ export class NodeMailer implements Mailer {
 }
 
 export class WebhookMailer implements Mailer {
-
 	constructor(
 		private readonly from: string | undefined,
 		private readonly url: string,
@@ -84,7 +81,6 @@ export class WebhookMailer implements Mailer {
 	}
 }
 
-
 export const createMailer = (options: MailerOptions): Mailer => {
 	const { from, ...transportOptions } = options
 	if ('webhook' in transportOptions) {

package/src/utils/batchQuery.ts

@@ -3,7 +3,10 @@ import { DatabaseContext } from '../model'
 
 export type ItemLoader<Arg, Item> = (args: Arg) => Promise<Item>
 
-export type BatchLoaderArgs<Arg, Result, Item> = [createResult: (args: Arg[], db: DatabaseContext) => Promise<Result>, getItem: (arg: Arg, result: Result) => Item]
+export type BatchLoaderArgs<Arg, Result, Item> = [
+	createResult: (args: Arg[], db: DatabaseContext) => Promise<Result>,
+	getItem: (arg: Arg, result: Result) => Item,
+]
 export const batchLoader = <Arg, Result, Item>(...args: BatchLoaderArgs<Arg, Result, Item>) => args
 
 export const initBatchLoader = <Arg, Result, Item>(

package/tests/cases/integration/mocked/addProjectMemberMutation.test.ts

@@ -42,4 +42,3 @@ test('add project member', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/changeMyPasswordMutation.test.ts

@@ -5,12 +5,13 @@ import { test } from 'bun:test'
 import { changeMyPasswordMutation } from './gql/changeMyPassword'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { authenticatedIdentityId } from '../../../src/testTenant'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('changes my password', async () => {
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const currentPassword = '123456'
-	const newPassword = 'abcd123'
+	const newPassword = 'ABcc123456'
 	await executeTenantTest({
 		query: changeMyPasswordMutation({ currentPassword, newPassword }),
 		executes: [
@@ -18,6 +19,7 @@ test('changes my password', async () => {
 				identityId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
 			}),
+			getConfigSql(),
 			updatePersonPasswordSql({ personId, password: newPassword }),
 		],
 		return: {
@@ -28,15 +30,57 @@ test('changes my password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: { 'type': 'password_change', 'response': { 'result': null, 'ok': true }, 'personId': testUuid(1) },
 	})
 })
 
+test('changes my password - weak', async () => {
+	const personId = testUuid(1)
+	const identityId = authenticatedIdentityId
+	const currentPassword = '123456'
+	const newPassword = 'abcd123'
+	await executeTenantTest({
+		query: changeMyPasswordMutation({ currentPassword, newPassword }),
+		executes: [
+			getPersonByIdentity({
+				identityId,
+				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
+			}),
+			getConfigSql(),
+		],
+		return: {
+			data: {
+				changeMyPassword: {
+					ok: false,
+					error: {
+						code: 'TOO_WEAK',
+					},
+				},
+			},
+		},
+		expectedAuthLog: {
+			'type': 'password_change',
+			'response': {
+				ok: false,
+				error: 'TOO_WEAK',
+				errorMessage: 'Password must contain at least 1 uppercase letter. Password is blacklisted.',
+				metadata: {
+					weakPasswordReasons: [
+						'MISSING_UPPERCASE',
+						'BLACKLISTED',
+					],
+				},
+			},
+			'personId': testUuid(1),
+		},
+	})
+})
 
 test('changes my password - invalid current password', async () => {
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const currentPassword = 'xxxxxx'
-	const newPassword = 'abcd123'
+	const newPassword = 'ABcc123456'
 	await executeTenantTest({
 		query: changeMyPasswordMutation({ currentPassword, newPassword }),
 		executes: [
@@ -44,6 +88,7 @@ test('changes my password - invalid current password', async () => {
 				identityId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123456' },
 			}),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -55,6 +100,10 @@ test('changes my password - invalid current password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			'type': 'password_change',
+			'response': { 'ok': false, 'error': 'INVALID_PASSWORD', 'errorMessage': 'Password does not match' },
+			'personId': testUuid(1),
+		},
 	})
 })
-

package/tests/cases/integration/mocked/changeMyProfileMutation.test.ts

@@ -1,7 +1,7 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
-import { updatePersonProfileNameSql, updatePersonProfileEmailSql, updatePersonProfileNameAndEmailSql } from './sql/updatePesonNameSql'
-import { test } from 'bun:test'
+import { updatePersonProfileEmailSql, updatePersonProfileNameAndEmailSql, updatePersonProfileNameSql } from './sql/updatePesonNameSql'
+import { expect, test } from 'bun:test'
 import { changeMyProfileMutation } from './gql/changeMyProfile'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { authenticatedIdentityId } from '../../../src/testTenant'
@@ -31,7 +31,6 @@ test('changes my name', async () => {
 	})
 })
 
-
 test('unset my name', async () => {
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
@@ -78,6 +77,12 @@ test('changes my email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 
@@ -92,7 +97,6 @@ test('changes my email - invalid', async () => {
 				identityId,
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -118,7 +122,6 @@ test('changes my email - invalid #2', async () => {
 				identityId,
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -130,6 +133,12 @@ test('changes my email - invalid #2', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
 
@@ -145,7 +154,6 @@ test('changes my email - exists', async () => {
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456' },
 			}),
 			getPersonByEmailSql({ email, response: { personId: testUuid(4), identityId: testUuid(5), roles: [], password: '' } }),
-			updatePersonProfileEmailSql({ personId, email }),
 		],
 		return: {
 			data: {
@@ -157,6 +165,12 @@ test('changes my email - exists', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
 
@@ -183,5 +197,11 @@ test('changes my name and email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })

package/tests/cases/integration/mocked/changePasswordMutation.test.ts

@@ -3,12 +3,13 @@ import { testUuid } from '../../../src/testUuid'
 import { changePasswordMutation } from './gql/changePassword'
 import { getPersonByIdSql } from './sql/getPersonByIdSql'
 import { updatePersonPasswordSql } from './sql/updatePesonPasswordSql'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('changes a password', async () => {
 	const personId = testUuid(1)
 	const identityId = testUuid(2)
-	const password = '123456'
+	const password = 'AbcDeg123'
 	await executeTenantTest({
 		query: changePasswordMutation({ personId, password }),
 		executes: [
@@ -16,6 +17,7 @@ test('changes a password', async () => {
 				personId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123', identityId },
 			}),
+			getConfigSql(),
 			updatePersonPasswordSql({ personId, password }),
 		],
 		return: {
@@ -25,6 +27,11 @@ test('changes a password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'password_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
-

package/tests/cases/integration/mocked/changeProfileMutation.test.ts

@@ -1,6 +1,6 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { changeProfileMutation } from './gql/changeProfile'
 import { updatePersonProfileNameAndEmailSql } from './sql/updatePesonNameSql'
 import { authenticatedIdentityId } from '../../../src/testTenant'
@@ -9,7 +9,6 @@ import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
 import { getPersonByIdSql } from './sql/getPersonByIdSql'
 
 test('changes my name and email', async () => {
-
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const email = 'jane@doe.com'
@@ -32,6 +31,11 @@ test('changes my name and email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'email_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
-

package/tests/cases/integration/mocked/confirmOtpMutation.test.ts

@@ -3,7 +3,7 @@ import { testUuid } from '../../../src/testUuid'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { confirmOtpMutation } from './gql/confirmOtp'
 import { ConfirmOtpErrorCode } from '../../../../src/schema'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src'
 import { Buffer } from 'buffer'
 
@@ -43,6 +43,12 @@ test('confirm otp mutation with valid code', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: '2fa_enable',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 
@@ -61,13 +67,6 @@ test('confirm otp mutation with invalid code', async () => {
 					email: 'john@doe.com',
 				},
 			}),
-			{
-				sql: `update "tenant"."person" set "otp_activated_at" = ? where "id" = ?`,
-				parameters: [now, personId],
-				response: {
-					rowCount: 1,
-				},
-			},
 		],
 		return: {
 			data: {
@@ -77,6 +76,11 @@ test('confirm otp mutation with invalid code', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: '2fa_enable',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
-

package/tests/cases/integration/mocked/createApiKeyMutation.test.ts

@@ -73,4 +73,3 @@ test('create api key', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/createSessionKeyMutation.test.ts

@@ -3,10 +3,11 @@ import { SQL } from '../../../src/tags'
 import { testUuid } from '../../../src/testUuid'
 import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
 import { createSessionTokenMutation } from './gql/createSessionToken'
 import { createSessionKeySql } from './sql/createSessionKeySql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('create session key', async () => {
 	const email = 'john@doe.com'
@@ -18,6 +19,7 @@ test('create session key', async () => {
 		query: createSessionTokenMutation({ email }, { withData: true }),
 		executes: [
 			getPersonByEmailSql({ email, response: { personId, identityId, password: 'aaa', roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -25,26 +27,6 @@ test('create session key', async () => {
 				projectId,
 				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
 			}),
-			{
-				sql: SQL`SELECT "id",
-						         "email",
-						         "identity_id"
-					         FROM "tenant"."person"
-					         WHERE "id" = ?`,
-				parameters: [personId],
-				response: { rows: [{ id: personId, email: email }] },
-			},
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo' }] },
-			},
 		],
 		return: {
 			data: {
@@ -74,6 +56,11 @@ test('create session key', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'create_session_token',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
-

package/tests/cases/integration/mocked/gql/createSessionToken.ts

@@ -13,7 +13,9 @@ export const createSessionTokenMutation = (
 			error {code}
 			result {
 				token
-				${options.withData ? `person {
+				${
+		options.withData
+			? `person {
 					id
 					identity {
 						projects {
@@ -27,7 +29,8 @@ export const createSessionTokenMutation = (
 					}
 				}
 				`
-		: ''}
+			: ''
+	}
 			}
 		}
 	}`,

package/tests/cases/integration/mocked/gql/signIn.ts

@@ -15,7 +15,9 @@ export const signInMutation = (
 			errors {code}
 			result {
 				token
-				${options.withData ? `person {
+				${
+		options.withData
+			? `person {
 					id
 					identity {
 						projects {
@@ -29,7 +31,8 @@ export const signInMutation = (
 					}
 				}
 				`
-		: ''}
+			: ''
+	}
 			}
 		}
 	}`,

package/tests/cases/integration/mocked/inviteMutations.test.ts

@@ -54,18 +54,6 @@ test('invite a new person', async () => {
 				getMailTemplateSql({ projectId, type: 'newUserInvited' }),
 				getMailTemplateSql({ projectId: null, type: 'newUserInvited' }),
 			),
-			disableOneOffKeySql({ id: authenticatedApiKeyId }),
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: membershipId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		sentMails: [
 			{
@@ -91,8 +79,6 @@ test('invite a new person', async () => {
 	})
 })
 
-
-
 test('invite a new person with password reset', async () => {
 	const languageId = testUuid(555)
 	const email = 'john@doe.com'
@@ -125,7 +111,12 @@ test('invite a new person with password reset', async () => {
 				getPersonByEmailSql({ email, response: null }),
 				createIdentitySql({ roles: ['person'], identityId }),
 				createPersonSql({ identityId, personId, email }),
-				createPersonTokenSql({ personId, tokenHash: '9692e67b8378a6f6753f97782d458aa757e947eab2fbdf6b5c187b74561eb78f', resetId: passwordTokenId, type: 'password_reset' }),
+				createPersonTokenSql({
+					personId,
+					tokenHash: '9692e67b8378a6f6753f97782d458aa757e947eab2fbdf6b5c187b74561eb78f',
+					resetId: passwordTokenId,
+					type: 'password_reset',
+				}),
 				createMembershipSql({ membershipId, projectId, identityId, role: 'editor' }),
 				patchVariablesSql({
 					id: variableId,
@@ -136,18 +127,6 @@ test('invite a new person with password reset', async () => {
 				getMailTemplateSql({ projectId, type: 'newUserInvited' }),
 				getMailTemplateSql({ projectId: null, type: 'newUserInvited' }),
 			),
-			disableOneOffKeySql({ id: authenticatedApiKeyId }),
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: membershipId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		sentMails: [
 			{
@@ -172,4 +151,3 @@ test('invite a new person with password reset', async () => {
 		},
 	})
 })
-

package/tests/cases/integration/mocked/listProjectMembersQuery.test.ts

@@ -59,7 +59,7 @@ query {
 						rows: [
 							{
 								role: 'foo',
-								variables: [{ values: ['x', 'y'],  name: 'xyz' }],
+								variables: [{ values: ['x', 'y'], name: 'xyz' }],
 								identityId: testUuid(2),
 							},
 						],