@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/types/utils/Mailer.d.ts

@@ -3,7 +3,7 @@ import * as SMTPTransport from 'nodemailer/lib/smtp-transport';
 import * as SMTPPool from 'nodemailer/lib/smtp-pool';
 import * as SendmailTransport from 'nodemailer/lib/sendmail-transport';
 import * as SESTransport from 'nodemailer/lib/ses-transport';
-import { MailTemplateIdentifier } from '../model';
+import { MailTemplateIdentifier } from '../model/index.js';
 export interface MailMessage {
     to: string;
     subject: string;

package/dist/types/utils/Mailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAA;AAEjD,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAApD,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW;IAEjF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQtF;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAIzC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgB1D;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,KAAG,MAQrD,CAAA"}
+{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAApD,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW;IAEjF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQtF;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAIzC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgB1D;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,KAAG,MAQrD,CAAA"}

package/dist/types/utils/batchQuery.d.ts

@@ -1,4 +1,4 @@
-import { DatabaseContext } from '../model';
+import { DatabaseContext } from '../model/index.js';
 export type ItemLoader<Arg, Item> = (args: Arg) => Promise<Item>;
 export type BatchLoaderArgs<Arg, Result, Item> = [
     createResult: (args: Arg[], db: DatabaseContext) => Promise<Result>,

package/dist/types/utils/batchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAChD,yBAAyB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAC3D,IAAI,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}
+{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAChD,yBAAyB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAC3D,IAAI,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}

package/dist/types/utils/index.d.ts

@@ -1,3 +1,3 @@
-export * from './Mailer';
-export * from './TemplateRenderer';
+export * from './Mailer.js';
+export * from './TemplateRenderer.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.1.0-beta.1",
+  "version": "2.2.0-alpha.1",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.1.0-beta.1",
-    "@contember/config-loader": "2.1.0-beta.1",
-    "@contember/database": "2.1.0-beta.1",
-    "@contember/database-migrations": "2.1.0-beta.1",
-    "@contember/dic": "2.1.0-beta.1",
-    "@contember/graphql-utils": "2.1.0-beta.1",
-    "@contember/logger": "2.1.0-beta.1",
-    "@contember/schema": "2.1.0-beta.1",
-    "@contember/schema-utils": "2.1.0-beta.1",
-    "@contember/typesafe": "2.1.0-beta.1",
+    "@contember/authorization": "2.1.0-beta.2",
+    "@contember/config-loader": "2.1.0-beta.2",
+    "@contember/database": "2.1.0-beta.2",
+    "@contember/database-migrations": "2.1.0-beta.2",
+    "@contember/dic": "2.1.0-beta.2",
+    "@contember/graphql-utils": "2.1.0-beta.2",
+    "@contember/logger": "2.1.0-beta.2",
+    "@contember/schema": "2.1.0-beta.2",
+    "@contember/schema-utils": "2.1.0-beta.2",
+    "@contember/typesafe": "2.1.0-beta.2",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.1.0-beta.1",
+    "@contember/database-tester": "2.1.0-beta.2",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/TenantContainer.ts

@@ -6,15 +6,26 @@ import {
 	ApiKeyManager,
 	ApiKeyService,
 	AppleProvider,
+	AuthPolicyManager,
+	AuthPolicyResolver,
+	BackchannelLogoutManager,
+	BackupCodeManager,
+	CaptchaValidator,
 	DatabaseContext,
+	EmailChangeManager,
+	EmailOtpManager,
 	EmailValidator,
+	EmailVerificationManager,
 	FacebookProvider,
+	HCaptchaProvider,
 	Identity,
 	IdentityFactory,
 	IDPHandlerRegistry,
 	IDPManager,
+	IdpSessionRevalidator,
 	IDPSignInManager,
 	InviteManager,
+	LoginRiskAnalyzer,
 	MailTemplateManager,
 	MembershipValidator,
 	OIDCProvider,
@@ -25,6 +36,7 @@ import {
 	PermissionContextFactory,
 	PermissionsFactory,
 	PersonAccessManager,
+	PersonIdentityProviderManager,
 	PersonManager,
 	ProjectInitializer,
 	ProjectManager,
@@ -32,12 +44,18 @@ import {
 	ProjectSchemaResolver,
 	ProjectScopeFactory,
 	Providers,
+	RateLimiter,
+	RecaptchaV3Provider,
 	RolesManager,
 	SecretsManager,
 	SignInManager,
+	SignOutManager,
 	SignUpManager,
+	TurnstileProvider,
+	UnpersistedApiKeyManager,
 	UserMailer,
-} from './model'
+} from './model/index.js'
+import { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'
 import {
 	AddIDPMutationResolver,
 	AddProjectMemberMutationResolver,
@@ -47,6 +65,9 @@ import {
 	CreateProjectMutationResolver,
 	DisableApiKeyMutationResolver,
 	DisableIDPMutationResolver,
+	DisconnectMyIdentityProviderMutationResolver,
+	EmailOtpMutationResolver,
+	EmailVerificationMutationResolver,
 	EnableIDPMutationResolver,
 	IdentityGlobalRolesMutationResolver,
 	IdentityTypeResolver,
@@ -56,9 +77,11 @@ import {
 	MeQueryResolver,
 	OtpMutationResolver,
 	PersonQueryResolver,
+	PersonTypeResolver,
 	ProjectMembersQueryResolver,
 	ProjectQueryResolver,
 	ProjectTypeResolver,
+	RegenerateBackupCodesMutationResolver,
 	RemoveProjectMemberMutationResolver,
 	ResetPasswordMutationResolver,
 	ResolverFactory,
@@ -69,28 +92,36 @@ import {
 	TenantResolverContextFactory,
 	UpdateProjectMemberMutationResolver,
 	UpdateProjectMutationResolver,
-} from './resolvers'
-import * as Schema from './schema'
-import { createMailer, MailerOptions, TemplateRenderer } from './utils'
-import { IdentityFetcher } from './bridges/system/IdentityFetcher'
-import { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory'
-import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver'
-import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver'
-import { TenantCredentials, TenantMigrationsRunner } from './migrations'
-import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver'
-import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver'
-import { ConfigurationManager } from './model/service/ConfigurationManager'
-import { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver'
-import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver'
-import { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver'
-import { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager'
-import { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver'
-import { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator'
-import { AuthLogService } from './model/service/AuthLogService'
+} from './resolvers/index.js'
+import * as Schema from './schema/index.js'
+import { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'
+import { IdentityFetcher } from './bridges/system/IdentityFetcher.js'
+import { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'
+import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'
+import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'
+import { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'
+import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'
+import { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'
+import { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'
+import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'
+import { ConfigurationManager } from './model/service/ConfigurationManager.js'
+import { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'
+import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'
+import { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'
+import { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'
+import { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'
+import { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'
+import { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'
+import { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'
+import { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'
+import { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'
+import { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'
+import { AuthLogService } from './model/service/AuthLogService.js'
 
 export interface TenantContainer {
 	projectMemberManager: ProjectMemberManager
 	apiKeyManager: ApiKeyManager
+	backchannelLogoutManager: BackchannelLogoutManager
 	signUpManager: SignUpManager
 	projectManager: ProjectManager
 	resolvers: Schema.Resolvers
@@ -112,12 +143,12 @@ export interface TenantContainerArgs {
 	projectSchemaResolver: ProjectSchemaResolver
 	projectInitializer: ProjectInitializer
 	tenantCredentials: TenantCredentials
-	cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt'>
+	cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>
 }
 
 export class TenantContainerFactory {
 	constructor(
-		private readonly providers: Omit<Providers, 'encrypt' | 'decrypt'>,
+		private readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,
 	) {}
 
 	create(args: TenantContainerArgs): TenantContainer {
@@ -125,6 +156,7 @@ export class TenantContainerFactory {
 			.build()
 			.pick(
 				'apiKeyManager',
+				'backchannelLogoutManager',
 				'projectMemberManager',
 				'projectManager',
 				'signUpManager',
@@ -150,10 +182,44 @@ export class TenantContainerFactory {
 			.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))
 			.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))
 			.addService('apiKeyService', () => new ApiKeyService())
-			.addService('apiKeyManager', ({ apiKeyService }) => new ApiKeyManager(apiKeyService))
+			.addService('authPolicyResolver', () => new AuthPolicyResolver())
+			.addService('authLogService', () => new AuthLogService())
+			.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))
+			.addService('idpRegistry', () => {
+				const idpRegistry = new IDPHandlerRegistry()
+				idpRegistry.registerHandler('oidc', new OIDCProvider())
+				idpRegistry.registerHandler('facebook', new FacebookProvider())
+				idpRegistry.registerHandler('apple', new AppleProvider())
+				return idpRegistry
+			})
+			.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))
+			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
+			.addService('unpersistedApiKeyManager', () =>
+				UnpersistedApiKeyManager.createForRootTokens({
+					tokens: args.tenantCredentials.rootTokens,
+					tokenHashes: args.tenantCredentials.rootTokenHashes,
+				}))
+			.addService(
+				'apiKeyManager',
+				({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>
+					new ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),
+			)
+			.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))
 			.addService('emailValidator', () => new EmailValidator())
-			.addService('passwordStrengthValidator', () => new PasswordStrengthValidator())
-			.addService('signUpManager', ({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator))
+			.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())
+			.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())
+			.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))
+			.addService('captchaValidator', () =>
+				new CaptchaValidator({
+					turnstile: new TurnstileProvider(),
+					hcaptcha: new HCaptchaProvider(),
+					recaptchaV3: new RecaptchaV3Provider(),
+				}))
+			.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))
+			.addService(
+				'signUpManager',
+				({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),
+			)
 			.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))
 			.addService('projectMemberManager', () => new ProjectMemberManager())
 			.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))
@@ -171,27 +237,46 @@ export class TenantContainerFactory {
 				'passwordResetManager',
 				({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),
 			)
-			.addService('idpRegistry', () => {
-				const idpRegistry = new IDPHandlerRegistry()
-				idpRegistry.registerHandler('oidc', new OIDCProvider())
-				idpRegistry.registerHandler('facebook', new FacebookProvider())
-				idpRegistry.registerHandler('apple', new AppleProvider())
-				return idpRegistry
-			})
+			.addService(
+				'emailVerificationManager',
+				({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),
+			)
+			.addService(
+				'emailChangeManager',
+				({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>
+					new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),
+			)
 			.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))
 			.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))
+			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())
 			.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))
-			.addService('signInManager', ({ apiKeyManager, providers, otpAuthenticator }) => new SignInManager(apiKeyManager, providers, otpAuthenticator))
+			.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))
+			.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))
+			.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))
+			.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))
+			.addService(
+				'signInManager',
+				({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>
+					new SignInManager(
+						apiKeyManager,
+						providers,
+						otpManager,
+						backupCodeManager,
+						emailOtpManager,
+						authPolicyResolver,
+						loginRiskAnalyzer,
+						userMailer,
+					),
+			)
 			.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))
 			.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))
-			.addService('otpManager', ({ otpAuthenticator }) => new OtpManager(otpAuthenticator))
 			.addService('mailTemplateManager', () => new MailTemplateManager())
 			.addService('rolesManager', () => new RolesManager())
 			.addService('configurationManager', () => new ConfigurationManager())
 			.addService(
 				'passwordlessSignInManager',
-				({ apiKeyManager, userMailer, projectManager, otpAuthenticator }) =>
-					new PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpAuthenticator),
+				({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>
+					new PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),
 			)
 			.addService(
 				'identityTypeResolver',
@@ -200,14 +285,19 @@ export class TenantContainerFactory {
 			)
 			.addService(
 				'projectTypeResolver',
-				({ projectMemberManager, projectSchemaResolver }) => new ProjectTypeResolver(projectMemberManager, projectSchemaResolver),
+				({ projectMemberManager, projectSchemaResolver, secretManager }) =>
+					new ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),
 			)
+			.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))
 			.addService(
 				'signInResponseFactory',
 				({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),
 			)
 			.addService('meQueryResolver', () => new MeQueryResolver())
-			.addService('personQueryResolver', ({ personManager }) => new PersonQueryResolver(personManager))
+			.addService(
+				'personQueryResolver',
+				({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),
+			)
 			.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))
 			.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))
 			.addService(
@@ -215,17 +305,31 @@ export class TenantContainerFactory {
 				({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),
 			)
 			.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())
-			.addService('signUpMutationResolver', ({ signUpManager, apiKeyManager }) => new SignUpMutationResolver(signUpManager, apiKeyManager))
+			.addService(
+				'signUpMutationResolver',
+				({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>
+					new SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),
+			)
 			.addService(
 				'signInMutationResolver',
-				({ signInManager, signInResponseFactory }) => new SignInMutationResolver(signInManager, signInResponseFactory),
+				({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),
+			)
+			.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))
+			.addService(
+				'changeProfileMutationResolver',
+				({ personManager, emailChangeManager, permissionContextFactory }) =>
+					new ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),
+			)
+			.addService(
+				'emailVerificationMutationResolver',
+				({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>
+					new EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),
 			)
-			.addService('signOutMutationResolver', ({ apiKeyManager }) => new SignOutMutationResolver(apiKeyManager))
-			.addService('changeProfileMutationResolver', ({ personManager }) => new ChangeProfileMutationResolver(personManager))
 			.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))
 			.addService(
 				'resetPasswordMutationResolver',
-				({ passwordResetManager, permissionContextFactory }) => new ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory),
+				({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>
+					new ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),
 			)
 			.addService(
 				'inviteMutationResolver',
@@ -250,7 +354,19 @@ export class TenantContainerFactory {
 				({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),
 			)
 			.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))
-			.addService('otpMutationResolver', ({ otpManager }) => new OtpMutationResolver(otpManager))
+			.addService(
+				'otpMutationResolver',
+				({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),
+			)
+			.addService(
+				'emailOtpMutationResolver',
+				({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>
+					new EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),
+			)
+			.addService(
+				'regenerateBackupCodesMutationResolver',
+				({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),
+			)
 			.addService(
 				'mailTemplateMutationResolver',
 				({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),
@@ -263,11 +379,27 @@ export class TenantContainerFactory {
 			.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))
 			.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))
 			.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))
+			.addService(
+				'disconnectMyIdentityProviderMutationResolver',
+				({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),
+			)
 			.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))
 			.addService(
 				'disablePersonMutationResolver',
 				({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),
 			)
+			.addService(
+				'forceSignOutMutationResolver',
+				({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),
+			)
+			.addService(
+				'resetPersonMfaMutationResolver',
+				({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),
+			)
+			.addService(
+				'revokeSessionMutationResolver',
+				({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),
+			)
 			.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))
 			.addService(
 				'setProjectSecretMutationResolver',
@@ -276,18 +408,23 @@ export class TenantContainerFactory {
 			.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))
 			.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))
 			.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))
+			.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))
+			.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))
+			.addService('authLogQueryResolver', () => new AuthLogQueryResolver())
+			.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())
 			.addService(
 				'passwordlessMutationResolver',
-				({ passwordlessSignInManager, signInResponseFactory }) => new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory),
+				({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>
+					new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),
 			)
 			.addService(
 				'togglePasswordlessMutationResolver',
 				({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),
 			)
-			.addService('authLogService', () => new AuthLogService())
 			.addService(
 				'resolverContextFactory',
-				({ permissionContextFactory, authLogService }) => new TenantResolverContextFactory(permissionContextFactory, authLogService),
+				({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>
+					new TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),
 			)
 			.addService('resolvers', container => new ResolverFactory(container).create())
 			.addService('connection', () => args.connection)

package/src/bin/runMigrations.ts

@@ -1,4 +1,4 @@
-import { TenantMigrationsRunner } from '../migrations'
+import { TenantMigrationsRunner } from '../migrations/index.js'
 import { createLogger, PrettyPrintLoggerHandler } from '@contember/logger'
 
 let uuidNum = 0

package/src/bridges/system/IdentityFetcher.ts

@@ -1,5 +1,5 @@
 import { Client } from '@contember/database'
-import { IdentityQuery, PersonByIdentityBatchQuery } from '../../model'
+import { IdentityQuery, PersonByIdentityBatchQuery } from '../../model/index.js'
 
 export class IdentityFetcher {
 	constructor(

package/src/index.ts

@@ -1,9 +1,10 @@
-import * as Schema from './schema'
+import * as Schema from './schema/index.js'
 
-export * from './model'
-export * from './TenantContainer'
-export * from './resolvers'
-export * from './utils'
-export * from './migrations'
+export * from './model/index.js'
+export * from './TenantContainer.js'
+export * from './resolvers/index.js'
+export * from './utils/index.js'
+export * from './migrations/index.js'
 export { Schema }
+// biome-ignore lint/correctness/useImportExtensions: .graphql files are resolved by the bundler loader, not as JS modules
 export { default as typeDefs } from './schema/tenant.graphql'

package/src/migrations/2020-06-08-134000-tenant-credentials.ts

@@ -1,6 +1,6 @@
 import { MigrationBuilder } from '@contember/database-migrations'
-import { TenantMigrationArgs } from './types'
-import { createCredentials } from './tenantCredentials'
+import { TenantMigrationArgs } from './types.js'
+import { createCredentials } from './tenantCredentials.js'
 
 export default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {
 	await createCredentials(builder, args)

package/src/migrations/2026-05-12-120000-api-key-session-tracking.ts

@@ -0,0 +1,23 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "last_ip" INET,
+	ADD COLUMN "last_user_agent" TEXT,
+	ADD COLUMN "last_used_at" TIMESTAMPTZ,
+	ADD COLUMN "created_ip" INET,
+	ADD COLUMN "created_user_agent" TEXT;
+
+ALTER TYPE "auth_log_type" ADD VALUE 'session_revoked_by_user';
+ALTER TYPE "auth_log_type" ADD VALUE 'forced_sign_out';
+
+ALTER TABLE "person_auth_log"
+	ADD COLUMN "target_person_id" UUID REFERENCES "person"("id") ON DELETE SET NULL;
+
+CREATE INDEX "person_auth_log_target_person_id_created_at_idx"
+	ON "person_auth_log" ("target_person_id", "created_at" DESC);
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.ts

@@ -0,0 +1,10 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "trust_forwarded_info" BOOLEAN NOT NULL DEFAULT false;
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-05-13-120000-auth-log-event-data.ts

@@ -0,0 +1,16 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'global_role_grant';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'global_role_revoke';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'project_membership_create';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'project_membership_update';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'project_membership_remove';
+
+ALTER TABLE person_auth_log
+	ADD COLUMN event_data JSONB;
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-05-13-130000-anti-abuse.ts

@@ -0,0 +1,44 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+    ALTER TABLE "config"
+        ADD COLUMN "password_check_hibp" BOOLEAN NOT NULL DEFAULT FALSE,
+        ADD COLUMN "captcha_provider"        TEXT,
+        ADD COLUMN "captcha_secret"          BYTEA,
+        ADD COLUMN "captcha_secret_version"  INTEGER,
+        ADD COLUMN "captcha_threshold"       DOUBLE PRECISION,
+        -- limit = 0 disables the throttle (see RateLimiter.check). Tenants opt
+        -- in by calling configure() with explicit values; upgrading the engine
+        -- alone must not change behavior for existing deployments.
+        ADD COLUMN "rate_limit_sign_up_per_ip_limit"                     INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "rate_limit_sign_up_per_ip_window"                    INTERVAL NOT NULL DEFAULT '1 hour',
+        ADD COLUMN "rate_limit_login_per_ip_limit"                       INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "rate_limit_login_per_ip_window"                      INTERVAL NOT NULL DEFAULT '1 hour',
+        ADD COLUMN "rate_limit_password_reset_per_ip_limit"              INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "rate_limit_password_reset_per_ip_window"             INTERVAL NOT NULL DEFAULT '1 hour',
+        ADD COLUMN "rate_limit_passwordless_init_per_ip_limit"           INTEGER  NOT NULL DEFAULT 0,
+        ADD COLUMN "rate_limit_passwordless_init_per_ip_window"          INTERVAL NOT NULL DEFAULT '1 hour',
+        ADD CONSTRAINT "config_captcha_provider_check"
+            CHECK ("captcha_provider" IS NULL OR "captcha_provider" IN ('turnstile', 'hcaptcha', 'recaptchaV3')),
+        ADD CONSTRAINT "config_captcha_complete"
+            CHECK ("captcha_provider" IS NULL OR ("captcha_secret" IS NOT NULL AND "captcha_secret_version" IS NOT NULL));
+
+    CREATE TABLE "rate_limit_event" (
+        "id"          UUID PRIMARY KEY,
+        "scope"       TEXT        NOT NULL,
+        "key_hash"    BYTEA       NOT NULL,
+        "occurred_at" TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    );
+    CREATE INDEX "rate_limit_event_lookup"
+        ON "rate_limit_event" ("scope", "key_hash", "occurred_at" DESC);
+    -- BRIN over the monotonically-increasing occurred_at supports retention
+    -- sweeps (DELETE FROM rate_limit_event WHERE occurred_at < ?) driven by an
+    -- external cron. BRIN keeps the index tiny and write overhead negligible
+    -- on the hot INSERT path.
+    CREATE INDEX "rate_limit_event_occurred_at_brin"
+        ON "rate_limit_event" USING BRIN ("occurred_at");
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}