@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.2

package/src/resolvers/TenantResolverContextFactory.ts

@@ -1,6 +1,7 @@
 import { TenantResolverContext } from './TenantResolverContext'
 import { DatabaseContext, PermissionContext, PermissionContextFactory } from '../model'
 import { Logger } from '@contember/logger'
+import { AuthLogService } from '../model/service/AuthLogService'
 
 export const createResolverContext = (permissionContext: PermissionContext, apiKeyId: string) => {
 	return {
@@ -15,10 +16,12 @@ export const createResolverContext = (permissionContext: PermissionContext, apiK
 export class TenantResolverContextFactory {
 	constructor(
 		private readonly permissionContextFactory: PermissionContextFactory,
+		private readonly authLogService: AuthLogService,
 	) {}
 
 	public create(
 		authContext: { apiKeyId: string; identityId: string; roles: string[] },
+		httpInfo: { ip: string; userAgent?: string },
 		db: DatabaseContext,
 		logger: Logger,
 	): TenantResolverContext {
@@ -28,6 +31,13 @@ export class TenantResolverContextFactory {
 		})
 		return {
 			...createResolverContext(permissionContext, authContext.apiKeyId),
+			logAuthAction: async data => {
+				await this.authLogService.logAuthAction(db, {
+					identityId: authContext.identityId,
+					userAgent: httpInfo.userAgent,
+					clientIp: httpInfo.ip,
+				}, data)
+			},
 			db,
 			logger,
 		}

package/src/resolvers/errorUtils.ts

@@ -1,8 +1,27 @@
+import { ResponseError } from '../model/utils/Response'
+
 type Error<T> = { code: T; developerMessage: string }
-type ErrorResponse<T> = { ok: false; error: Error<T>; errors: [Error<T>] }
-export const createErrorResponse = <T>(code: T, developerMessage: string): ErrorResponse<T> => {
-	const error = { code, developerMessage }
-	return { ok: false, error, errors: [error] }
+type ErrorResponse<T, Meta = {}> = { ok: false; error: Error<T> & Meta; errors: [Error<T> & Meta] }
+
+export function createErrorResponse<const T extends string, Meta extends {} | undefined>(
+	responseError: ResponseError<T, Meta>,
+): ErrorResponse<T, Meta>
+export function createErrorResponse<const T extends string>(code: T, developerMessage: string): ErrorResponse<T>
+export function createErrorResponse(codeOrErrorResponse: string | ResponseError<any>, developerMessage?: string): ErrorResponse<any> {
+	if (typeof codeOrErrorResponse === 'string') {
+		if (!developerMessage) {
+			throw new Error('Developer message is required when passing a string as code.')
+		}
+		const error = { code: codeOrErrorResponse, developerMessage }
+		return { ok: false, error, errors: [error] }
+	}
+	const error = { code: codeOrErrorResponse.error, developerMessage: codeOrErrorResponse.errorMessage, ...(codeOrErrorResponse.metadata ?? {}) }
+	return {
+		ok: false,
+		error,
+		errors: [error],
+	}
 }
-export const createProjectNotFoundResponse = <const T>(code: T, projectSlug: string): ErrorResponse<T> =>
+
+export const createProjectNotFoundResponse = <const T extends string>(code: T, projectSlug: string): ErrorResponse<T> =>
 	createErrorResponse(code, `Project ${projectSlug} was not found or you are not allowed to access it.`)

package/src/resolvers/membershipUtils.ts

@@ -7,7 +7,6 @@ export type MembershipErrorCode =
 	| 'VARIABLE_EMPTY'
 	| 'VARIABLE_NOT_FOUND'
 
-
 export interface MembershipErrorVariable {
 	code: MembershipErrorCode
 	membershipValidation?: MembershipValidationErrorSchema[]
@@ -57,10 +56,9 @@ export const createMembershipValidationErrorResult = (
 	return [
 		{
 			code: 'INVALID_MEMBERSHIP',
-			developerMessage:
-				'Provided membership is invalid: ' +
-				result.map(it => formatDeveloperError(it)).join('. ') +
-				'. You can also check membershipValidation field for structured details.',
+			developerMessage: 'Provided membership is invalid: '
+				+ result.map(it => formatDeveloperError(it)).join('. ')
+				+ '. You can also check membershipValidation field for structured details.',
 			membershipValidation: result.map((it): MembershipValidationErrorSchema => {
 				switch (it.error) {
 					case MembershipValidationErrorType.ROLE_NOT_FOUND:

package/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts

@@ -1,7 +1,8 @@
 import {
 	CreateApiKeyErrorCode,
 	CreateApiKeyResponse,
-	MutationCreateApiKeyArgs, MutationCreateGlobalApiKeyArgs,
+	MutationCreateApiKeyArgs,
+	MutationCreateGlobalApiKeyArgs,
 	MutationResolvers,
 } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'

package/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts

@@ -1,12 +1,7 @@
-import {
-	DisableApiKeyErrorCode,
-	DisableApiKeyResponse,
-	MutationDisableApiKeyArgs,
-	MutationResolvers,
-} from '../../../schema'
+import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, ApiKeyManager } from '../../../model'
+import { ApiKeyManager, PermissionActions } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 
 export class DisableApiKeyMutationResolver implements MutationResolvers {

package/src/resolvers/mutation/idp/AddIDPMutationResolver.ts

@@ -14,7 +14,7 @@ export class AddIDPMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to add IDP',
 		})
 		const result = await this.idpManager.addIDP(context.db, {
-			configuration: args.configuration,
+			configuration: args.configuration as any,
 			slug: args.identityProvider,
 			type: args.type,
 			options: {

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -14,7 +14,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to update IDP',
 		})
 		const result = await this.idpManager.updateIDP(context.db, args.identityProvider, {
-			configuration: args.configuration,
+			configuration: args.configuration as any,
 			type: args.type ?? undefined,
 			options: {
 				autoSignUp: args.options?.autoSignUp ?? undefined,

package/src/resolvers/mutation/person/ChangePasswordMutationResolver.ts

@@ -1,7 +1,5 @@
 import {
-	ChangeMyPasswordErrorCode,
 	ChangeMyPasswordResponse,
-	ChangePasswordErrorCode,
 	ChangePasswordResponse,
 	MutationChangeMyPasswordArgs,
 	MutationChangePasswordArgs,
@@ -33,10 +31,15 @@ export class ChangePasswordMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CHANGE_PASSWORD(person.roles),
 			message: 'You are not allowed to change password',
 		})
-		const result = await this.passwordChangeManager.changePassword(context.db, args.personId, args.password)
+		const response = await this.passwordChangeManager.changePassword(context.db, person, args.password)
+		await context.logAuthAction({
+			type: 'password_change',
+			response,
+			personId: person.id,
+		})
 
-		if (!result.ok) {
-			return createErrorResponse(result.error, result.errorMessage)
+		if (!response.ok) {
+			return createErrorResponse(response)
 		}
 
 		return { ok: true, errors: [] }
@@ -56,10 +59,15 @@ export class ChangePasswordMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CHANGE_MY_PASSWORD,
 			message: 'You are not allowed to change password',
 		})
-		const result = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)
+		const response = await this.passwordChangeManager.changeMyPassword(context.db, person, args.currentPassword, args.newPassword)
+		await context.logAuthAction({
+			type: 'password_change',
+			response: response,
+			personId: person.id,
+		})
 
-		if (!result.ok) {
-			return createErrorResponse(result.error, result.errorMessage)
+		if (!response.ok) {
+			return createErrorResponse(response)
 		}
 
 		return { ok: true }

package/src/resolvers/mutation/person/ChangeProfileMutationResolver.ts

@@ -13,7 +13,7 @@ import { createErrorResponse } from '../../errorUtils'
 export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'changeMyProfile' | 'changeProfile'> {
 	constructor(
 		private readonly personManager: PersonManager,
-	) { }
+	) {}
 
 	async changeProfile(
 		parent: unknown,
@@ -38,6 +38,12 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 			email: args.email,
 			name: args.name === '' ? null : args.name,
 		})
+		if (args.email) {
+			await context.logAuthAction({
+				type: 'email_change',
+				response: result,
+			})
+		}
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
@@ -46,7 +52,6 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 		return { ok: true }
 	}
 
-
 	async changeMyProfile(
 		parent: unknown,
 		args: MutationChangeMyProfileArgs,
@@ -70,6 +75,13 @@ export class ChangeProfileMutationResolver implements Pick<MutationResolvers, 'c
 			email: args.email,
 			name: args.name === '' ? null : args.name,
 		})
+		if (args.email) {
+			await context.logAuthAction({
+				type: 'email_change',
+				response: result,
+				personId: person.id,
+			})
+		}
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)

package/src/resolvers/mutation/person/DisablePersonMutationResolver.ts

@@ -1,22 +1,19 @@
-import {
-	DisablePersonResponse,
-	MutationDisablePersonArgs,
-	MutationResolvers,
-} from '../../../schema'
+import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
 import { PermissionActions, PersonAccessManager } from '../../../model'
 import { PersonManager } from '../../../model/service/PersonManager'
 import { createErrorResponse } from '../../errorUtils'
 
 export class DisablePersonMutationResolver implements MutationResolvers {
-
 	constructor(
 		private readonly personAccessManager: PersonAccessManager,
 		private readonly personManager: PersonManager,
 	) {}
 
 	async disablePerson(
-		parent: any, args: MutationDisablePersonArgs, context: TenantResolverContext,
+		parent: any,
+		args: MutationDisablePersonArgs,
+		context: TenantResolverContext,
 	): Promise<DisablePersonResponse> {
 		const targetPerson = await this.personManager.findPersonById(context.db, args.personId)
 
@@ -35,8 +32,12 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to disable person account',
 		})
 
-		const result = await this.personAccessManager.disablePerson(context.db, args.personId)
-
+		const result = await this.personAccessManager.disablePerson(context.db, targetPerson)
+		await context.logAuthAction({
+			type: 'person_disable',
+			response: result,
+			personId: targetPerson.id,
+		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -1,10 +1,4 @@
-import {
-	InitSignInIdpResponse,
-	MutationInitSignInIdpArgs,
-	MutationResolvers,
-	MutationSignInIdpArgs,
-	SignInIdpResponse,
-} from '../../../schema'
+import { InitSignInIdpResponse, MutationInitSignInIdpArgs, MutationResolvers, MutationSignInIdpArgs, SignInIdpResponse } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
 import { IDPSignInManager, PermissionActions } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
@@ -25,9 +19,13 @@ export class IDPMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_CREATE_IDP_URL,
 			message: 'You are not allowed to create a redirect URL for IDP',
 		})
-		const result = await this.idpSignInManager.initSignInIDP(context.db, args.identityProvider, args.data ?? {
-			redirectUrl: args.redirectUrl,
-		})
+		const result = await this.idpSignInManager.initSignInIDP(
+			context.db,
+			args.identityProvider,
+			args.data ?? {
+				redirectUrl: args.redirectUrl,
+			},
+		)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
@@ -49,6 +47,10 @@ export class IDPMutationResolver implements MutationResolvers {
 			},
 			args.expiration ?? undefined,
 		)
+		await context.logAuthAction({
+			type: 'idp_login',
+			response: signIn,
+		})
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}

package/src/resolvers/mutation/person/InviteMutationResolver.ts

@@ -1,14 +1,6 @@
 import { InviteErrorCode, InviteResponse, MutationInviteArgs, MutationResolvers, MutationUnmanagedInviteArgs } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import {
-	DatabaseContext,
-	InviteData,
-	InviteManager,
-	isTokenHash,
-	MembershipValidator,
-	PermissionActions,
-	ProjectManager,
-} from '../../../model'
+import { DatabaseContext, InviteData, InviteManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model'
 import { createMembershipValidationErrorResult } from '../../membershipUtils'
 import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'
 import { UserInputError } from '@contember/graphql-utils'

package/src/resolvers/mutation/person/OtpMutationResolver.ts

@@ -10,6 +10,7 @@ import { TenantResolverContext } from '../../TenantResolverContext'
 import { OtpManager, PermissionActions, PersonQuery, PersonRow } from '../../../model'
 import { ImplementationException } from '../../../exceptions'
 import { createErrorResponse } from '../../errorUtils'
+import { ResponseError, ResponseOk } from '../../../model/utils/Response'
 
 export class OtpMutationResolver implements MutationResolvers {
 	constructor(private readonly otpManager: OtpManager) {}
@@ -17,6 +18,13 @@ export class OtpMutationResolver implements MutationResolvers {
 	async prepareOtp(parent: any, args: MutationPrepareOtpArgs, context: TenantResolverContext): Promise<PrepareOtpResponse> {
 		const person = await this.getPersonFromContext(context)
 		const otp = await this.otpManager.prepareOtp(context.db, person, args.label || 'Contember')
+		if (person.otp_activated_at) {
+			await context.logAuthAction({
+				type: '2fa_disable',
+				response: new ResponseOk(null),
+				personId: person.id,
+			})
+		}
 		return {
 			ok: true,
 			result: {
@@ -35,9 +43,20 @@ export class OtpMutationResolver implements MutationResolvers {
 			)
 		}
 		if (!this.otpManager.verifyOtp(person, args.otpToken)) {
-			return createErrorResponse('INVALID_OTP_TOKEN', 'Provided token is not correct.')
+			const responseError = new ResponseError('INVALID_OTP_TOKEN', 'Provided token is not correct.')
+			await context.logAuthAction({
+				type: '2fa_enable',
+				response: responseError,
+				personId: person.id,
+			})
+			return createErrorResponse(responseError)
 		}
 		await this.otpManager.confirmOtp(context.db, person)
+		await context.logAuthAction({
+			type: '2fa_enable',
+			response: new ResponseOk(null),
+			personId: person.id,
+		})
 		return {
 			ok: true,
 			errors: [],
@@ -50,6 +69,11 @@ export class OtpMutationResolver implements MutationResolvers {
 			return createErrorResponse('OTP_NOT_ACTIVE', 'OTP is not active, you cannot disable it.')
 		}
 		await this.otpManager.disableOtp(context.db, person)
+		await context.logAuthAction({
+			type: '2fa_disable',
+			response: new ResponseOk(null),
+			personId: person.id,
+		})
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -1,18 +1,21 @@
 import {
 	ActivatePasswordlessOtpResponse,
-	InitSignInPasswordlessResponse, MutationActivatePasswordlessOtpArgs,
+	InitSignInPasswordlessResponse,
+	MutationActivatePasswordlessOtpArgs,
 	MutationInitSignInPasswordlessArgs,
 	MutationResolvers,
 	MutationSignInPasswordlessArgs,
 	SignInPasswordlessResponse,
 } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
+import { ConfigurationQuery, PermissionActions } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
 import { PasswordlessSignInManager } from '../../../model/service/PasswordlessSignInManager'
 
-export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'> {
+export class PasswordlessMutationResolver
+	implements Pick<MutationResolvers, 'initSignInPasswordless' | 'signInPasswordless' | 'activatePasswordlessOtp'>
+{
 	constructor(
 		private readonly passwordlessSignInManager: PasswordlessSignInManager,
 		private readonly signInResponseFactory: SignInResponseFactory,
@@ -34,7 +37,19 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			mailVariant: args.options?.mailVariant ?? undefined,
 			mailProject: args.options?.mailProject ?? undefined,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login_init',
+			response: result,
+		})
 		if (!result.ok) {
+			if (result.error === 'PERSON_NOT_FOUND') {
+				const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+				if (!configuration.login.revealUserExists) {
+					// If the user does not exist, we don't want to reveal that
+					return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+				}
+			}
+
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 		return { ok: true, result: result.result }
@@ -53,6 +68,10 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			validationType: args.validationType,
 			expiration: args.expiration ?? undefined,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login',
+			response: signIn,
+		})
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}
@@ -62,7 +81,11 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 		}
 	}
 
-	async activatePasswordlessOtp(parent: any, args: MutationActivatePasswordlessOtpArgs, context: TenantResolverContext): Promise<ActivatePasswordlessOtpResponse> {
+	async activatePasswordlessOtp(
+		parent: any,
+		args: MutationActivatePasswordlessOtpArgs,
+		context: TenantResolverContext,
+	): Promise<ActivatePasswordlessOtpResponse> {
 		await context.requireAccess({
 			action: PermissionActions.PERSON_PASSWORDLESS_SIGN_IN,
 			message: 'You are not allowed to activate passwordless OTP',
@@ -73,6 +96,10 @@ export class PasswordlessMutationResolver implements Pick<MutationResolvers, 'in
 			token: args.token,
 			otpHash: args.otpHash,
 		})
+		await context.logAuthAction({
+			type: 'passwordless_login_exchange',
+			response: result,
+		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts

@@ -7,8 +7,9 @@ import {
 } from '../../../schema'
 import { GraphQLResolveInfo } from 'graphql'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
+import { ConfigurationQuery, PasswordResetManager, PermissionActions, PermissionContextFactory, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
+import { ResponseError, ResponseOk } from '../../../model/utils/Response'
 
 export class ResetPasswordMutationResolver implements MutationResolvers {
 	constructor(
@@ -28,7 +29,20 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 		})
 		const person = await context.db.queryHandler.fetch(PersonQuery.byEmail(args.email))
 		if (!person) {
-			return createErrorResponse('PERSON_NOT_FOUND', 'Person was not found.')
+			const responseError = new ResponseError('PERSON_NOT_FOUND', `Person with email ${args.email} was not found.`)
+			await context.logAuthAction({
+				type: 'password_reset_init',
+				response: responseError,
+				personInput: args.email,
+			})
+
+			const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+			if (!configuration.login.revealUserExists) {
+				// If the user does not exist, we do not want to leak this information
+				return { ok: true, errors: [] }
+			}
+
+			return createErrorResponse(responseError)
 		}
 
 		const permissionContext = await this.permissionContextFactory.create(context.db, {
@@ -39,6 +53,12 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 			mailVariant: args.options?.mailVariant || undefined,
 			project: args.options?.mailProject || undefined,
 		})
+		await context.logAuthAction({
+			type: 'password_reset_init',
+			response: new ResponseOk(null),
+			personInput: args.email,
+			personId: person.id,
+		})
 		return { ok: true, errors: [] }
 	}
 
@@ -54,9 +74,13 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 		})
 
 		const result = await this.passwordResetManager.resetPassword(context.db, args.token, args.password)
+		await context.logAuthAction({
+			type: 'password_reset',
+			response: result,
+		})
 		if (result.ok) {
 			return { ok: true, errors: [] }
 		}
-		return createErrorResponse(result.error, result.errorMessage)
+		return createErrorResponse(result)
 	}
 }

package/src/resolvers/mutation/person/SignInMutationResolver.ts

@@ -1,15 +1,11 @@
-import {
-	CreateSessionTokenResponse,
-	MutationCreateSessionTokenArgs,
-	MutationResolvers,
-	MutationSignInArgs,
-	SignInResponse,
-} from '../../../schema'
+import { CreateSessionTokenResponse, MutationCreateSessionTokenArgs, MutationResolvers, MutationSignInArgs, SignInResponse } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'
+import { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, SignInManager } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory'
 import { UserInputError } from '@contember/graphql-utils'
+import { NextLoginAttemptQuery } from '../../../model/queries/authLog/NextLoginAttemptQuery'
+import { ResponseError } from '../../../model/utils/Response'
 
 export class SignInMutationResolver implements MutationResolvers {
 	constructor(
@@ -23,6 +19,15 @@ export class SignInMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to sign in',
 		})
 
+		const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))
+		if (nextAllowedSignIn > new Date()) {
+			return createErrorResponse(
+				new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {
+					retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),
+				}),
+			)
+		}
+
 		const response = await this.signInManager.signIn(
 			context.db,
 			args.email,
@@ -30,8 +35,20 @@ export class SignInMutationResolver implements MutationResolvers {
 			args.expiration || undefined,
 			args.otpToken || undefined,
 		)
+		await context.logAuthAction({
+			type: 'login',
+			response,
+		})
 
 		if (!response.ok) {
+			const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery())
+			if (
+				!configuration.login.revealUserExists
+				&& ['NO_PASSWORD_SET', 'NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)
+			) {
+				// if the user does not exist, we don't want to reveal that, so we return a generic error
+				return createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')
+			}
 			return createErrorResponse(response.error, response.errorMessage)
 		}
 
@@ -60,15 +77,21 @@ export class SignInMutationResolver implements MutationResolvers {
 			context.db,
 			identifier,
 			args.expiration || undefined,
-			async person => await context.requireAccess({
-				action: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
-				message: 'You are not allowed to create a session key for this person.',
-			}),
+			async person =>
+				await context.requireAccess({
+					action: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+					message: 'You are not allowed to create a session key for this person.',
+				}),
 		)
+		await context.logAuthAction({
+			type: 'create_session_token',
+			response: response,
+		})
 
 		if (!response.ok) {
 			return createErrorResponse(response.error, response.errorMessage)
 		}
+
 		return {
 			ok: true,
 			result: await this.signInResponseFactory.createResponse(response.result, context),

package/src/resolvers/mutation/person/SignOutMutationResolver.ts

@@ -17,7 +17,8 @@ export class SignOutMutationResolver implements MutationResolvers {
 
 		if (personApiKeyId?.type === ApiKey.Type.PERMANENT) {
 			return createErrorResponse(
-				'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY', 'Only session API keys can be used for person sign out.',
+				'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',
+				'Only session API keys can be used for person sign out.',
 			)
 		}
 

package/src/resolvers/mutation/person/SignUpMutationResolver.ts

@@ -1,13 +1,6 @@
 import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import {
-	ApiKeyManager,
-	NoPassword,
-	PasswordHash,
-	PasswordPlain,
-	PermissionActions,
-	SignUpManager,
-} from '../../../model'
+import { ApiKeyManager, NoPassword, PasswordHash, PasswordPlain, PermissionActions, SignUpManager } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 import { UserInputError } from '@contember/graphql-utils'
 import { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'
@@ -42,7 +35,7 @@ export class SignUpMutationResolver implements MutationResolvers {
 		})
 
 		if (!response.ok) {
-			return createErrorResponse(response.error, response.errorMessage)
+			return createErrorResponse(response)
 		}
 		const result = response.result
 		await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)

package/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts

@@ -1,7 +1,7 @@
 import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'
 import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
 import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, PersonManager, PersonQuery } from '../../../model'
+import { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'
 import { createErrorResponse } from '../../errorUtils'
 
 export class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {
@@ -31,7 +31,7 @@ export class TogglePasswordlessMutationResolver implements Pick<MutationResolver
 			action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
 			message: 'You are not allowed to enable passwordless',
 		})
-		const config = await this.configurationManager.fetchConfiguration(context.db)
+		const config = await await context.db.queryHandler.fetch(new ConfigurationQuery())
 		if (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {
 			return createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')
 		}
@@ -40,5 +40,4 @@ export class TogglePasswordlessMutationResolver implements Pick<MutationResolver
 
 		return { ok: true }
 	}
-
 }