@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/tests/cases/unit/apiKey/verifyAndProlongIdle.test.ts

@@ -0,0 +1,197 @@
+import { expect, test } from 'bun:test'
+import {
+	ApiKey,
+	ApiKeyManager,
+	ApiKeyService,
+	AuthLogService,
+	AuthPolicyResolver,
+	computeTokenHash,
+	DatabaseContext,
+	Providers,
+} from '../../../../src/index.js'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import PostgresInterval from 'postgres-interval'
+
+const TOKEN = '0000000000000000000000000000000000000000'
+const TOKEN_HASH = computeTokenHash(TOKEN)
+// verifyAndProlong now reads providers.now() (single injectable clock), so fixtures
+// are anchored relative to that fixed clock rather than the real wall clock.
+const NOW = new Date('2026-05-21T12:00:00Z')
+const minutesAgo = (m: number) => new Date(NOW.getTime() - m * 60_000)
+const minutesAhead = (m: number) => new Date(NOW.getTime() + m * 60_000)
+
+const baseProviders: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+type Row = {
+	id: string
+	type: string
+	identity_id: string
+	disabled_at: Date | null
+	expires_at: Date | null
+	roles: string[]
+	expiration: number | null
+	person_id: string | null
+	last_ip: string | null
+	last_user_agent: string | null
+	last_used_at: Date | null
+	trust_forwarded_info: boolean
+	issued_at: Date | null
+	idle_timeout: ReturnType<typeof PostgresInterval> | null
+	max_expires_at: Date | null
+}
+
+const defaultRow = (overrides: Partial<Row>): Row => ({
+	id: 'api-key-id',
+	type: ApiKey.Type.SESSION,
+	identity_id: 'identity-id',
+	disabled_at: null,
+	expires_at: minutesAhead(30),
+	roles: ['editor'],
+	expiration: 30,
+	person_id: 'person-id',
+	last_ip: null,
+	last_user_agent: null,
+	last_used_at: null,
+	trust_forwarded_info: false,
+	issued_at: null,
+	idle_timeout: null,
+	max_expires_at: null,
+	...overrides,
+})
+
+const selectByToken = (row: Row | null): ExpectedQuery => ({
+	sql:
+		`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?`,
+	parameters: [TOKEN_HASH],
+	response: { rows: row ? [row] : [] },
+})
+
+const disableUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "disabled_at" = ? where "id" = ?`,
+	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+// The background prolong UPDATE fires in setImmediate on the allowed path
+// (no requestInfo → only expires_at is touched). We allow but don't assert it.
+const prolongUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
+	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+// Captures the `type` of the session_expired_idle person_auth_log insert.
+// The idle key carries a person_id, so the InsertBuilder emits it → columns are
+// id, invoked_by_id, person_id, type, success, metadata, event_data.
+const authLogInsert = (capture: { type?: string }): ExpectedQuery => ({
+	sql:
+		`insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "person_id", "type", "success", "metadata", "event_data") values  (?, ?, ?, ?, ?, ?, ?)`,
+	parameters: [
+		() => true,
+		() => true,
+		() => true,
+		(value: any) => {
+			capture.type = value
+			return true
+		},
+		() => true,
+		() => true,
+		() => true,
+	],
+	response: { rowCount: 1 },
+})
+
+const run = async (row: Row | null, expectedQueries: ExpectedQuery[], allowProlong = false) => {
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService())
+	const queries = [selectByToken(row), ...expectedQueries, ...(allowProlong ? [prolongUpdate] : [])]
+	const connection = createConnectionMock(queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, baseProviders)
+	const response = await manager.verifyAndProlong(db, db, TOKEN)
+	// Let the setImmediate-scheduled prolong run before the connection mock is torn down.
+	await new Promise(resolve => setImmediate(resolve))
+	return response
+}
+
+test('A19: idle-expired key (last_used_at older than idle_timeout) is rejected and disabled', async () => {
+	const row = defaultRow({
+		idle_timeout: PostgresInterval('00:15:00'),
+		last_used_at: minutesAgo(20), // 20 min ago > 15 min idle timeout
+	})
+	const authLog: { type?: string } = {}
+	const response = await run(row, [disableUpdate, authLogInsert(authLog)])
+	expect(response.ok).toBe(false)
+	// A19: idle rejection emits a session_expired_idle audit entry.
+	expect(authLog.type).toBe('session_expired_idle')
+})
+
+test('A19: idle within the prolong-throttle slack is NOT expired (small idle_timeout)', async () => {
+	// last_used_at is written at most once per 60s, so a continuously-active session
+	// can legitimately lag by up to that window. With idle_timeout=1min, a key last
+	// seen 90s ago (< 1min + 60s slack) must stay alive rather than be disabled.
+	const row = defaultRow({
+		idle_timeout: PostgresInterval('00:01:00'),
+		last_used_at: new Date(NOW.getTime() - 90_000),
+	})
+	const response = await run(row, [], true)
+	expect(response.ok).toBe(true)
+})
+
+test('A19: idle beyond idle_timeout + slack is still expired (small idle_timeout)', async () => {
+	const row = defaultRow({
+		idle_timeout: PostgresInterval('00:01:00'),
+		last_used_at: new Date(NOW.getTime() - 150_000), // 150s > 60s + 60s slack
+	})
+	const response = await run(row, [disableUpdate, authLogInsert({})])
+	expect(response.ok).toBe(false)
+})
+
+test('A19: fresh key within idle_timeout is allowed', async () => {
+	const row = defaultRow({
+		idle_timeout: PostgresInterval('00:15:00'),
+		last_used_at: minutesAgo(5), // 5 min ago < 15 min
+	})
+	// Prolong runs in setImmediate (async); only the synchronous verify is asserted.
+	const response = await run(row, [], true)
+	expect(response.ok).toBe(true)
+})
+
+test('A19: key with idle_timeout but never used (last_used_at null) is allowed', async () => {
+	const row = defaultRow({
+		idle_timeout: PostgresInterval('00:15:00'),
+		last_used_at: null,
+	})
+	const response = await run(row, [], true)
+	expect(response.ok).toBe(true)
+})
+
+test('A19: no idle_timeout behaves as today (allowed regardless of last_used_at)', async () => {
+	const row = defaultRow({
+		idle_timeout: null,
+		last_used_at: minutesAgo(60 * 24 * 365), // ancient, but no idle policy
+	})
+	const response = await run(row, [], true)
+	expect(response.ok).toBe(true)
+})
+
+test('A19: absolute cap (now >= max_expires_at) rejects and disables', async () => {
+	const row = defaultRow({
+		max_expires_at: minutesAgo(60), // already past
+	})
+	const response = await run(row, [disableUpdate])
+	expect(response.ok).toBe(false)
+})

package/tests/cases/unit/authLogBaselineWrite.test.ts

@@ -0,0 +1,119 @@
+import { expect, test } from 'bun:test'
+import crypto from 'node:crypto'
+import { AuthLogService, DatabaseContext, LoginRiskAnalyzer, TenantResolverContextFactory } from '../../../src/index.js'
+import { ResponseOk } from '../../../src/model/utils/Response.js'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { createLogger, JsonStreamLoggerHandler } from '@contember/logger'
+
+// A03: the whole feature is self-sustaining only because every successful sign-in
+// stamps `geo_country` + `device_fingerprint` onto its person_auth_log row, which
+// becomes the next sign-in's baseline (LoginRiskAnalyzer.analyze reads exactly
+// those columns + ip_address). The integration suite mocks `logAuthAction`, so it
+// never exercises this INSERT — these tests cover the real write end-to-end. A
+// regression dropping the columns, or stamping the raw UA instead of its hash,
+// would otherwise score every later login as "new device"/"new country" forever
+// with no failing test.
+
+const hash = (value: crypto.BinaryLike, algo: string) => crypto.createHash(algo).update(value).digest()
+const UA = 'Mozilla/5.0 (Macintosh)'
+const FINGERPRINT = crypto.createHash('sha256').update(UA).digest('hex')
+
+const providers = {
+	uuid: () => '11111111-1111-1111-1111-111111111111',
+	hash,
+} as any
+
+const logger = createLogger(new JsonStreamLoggerHandler(process.stderr))
+
+const runWithQuery = async (query: ExpectedQuery, run: (db: DatabaseContext) => Promise<void>) => {
+	const queries = [query]
+	const connection = createConnectionMock(queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+	await run(db)
+	// The connection mock consumes a query per executed statement; an unconsumed
+	// query means the INSERT never ran.
+	expect(queries).toHaveLength(0)
+}
+
+// Captures the geo_country / device_fingerprint bound to the INSERT.
+const insertCapturing = (captured: { geo?: unknown; fp?: unknown }): ExpectedQuery => ({
+	sql:
+		`insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "error_code", "ip_address", "user_agent", "metadata", "geo_country", "device_fingerprint") values  (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+	parameters: [
+		() => true, // id (uuid)
+		'identity-1', // invoked_by_id
+		'login',
+		true,
+		null, // error_code (ok response → null, not omitted)
+		'203.0.113.5', // ip_address
+		UA, // user_agent
+		() => true, // metadata {}
+		(value: unknown) => {
+			captured.geo = value
+			return true
+		},
+		(value: unknown) => {
+			captured.fp = value
+			return true
+		},
+	],
+	response: { rowCount: 1 },
+})
+
+test('AuthLogService.logAuthAction persists geo_country and device_fingerprint on the row', async () => {
+	const captured: { geo?: unknown; fp?: unknown } = {}
+	await runWithQuery(insertCapturing(captured), async db => {
+		await new AuthLogService().logAuthAction(db, {
+			identityId: 'identity-1',
+			clientIp: '203.0.113.5',
+			userAgent: UA,
+			geoCountry: 'US',
+			deviceFingerprint: FINGERPRINT,
+		}, { type: 'login', response: new ResponseOk({}) })
+	})
+	expect(captured.geo).toBe('US')
+	expect(captured.fp).toBe(FINGERPRINT)
+})
+
+test('an absent country / user-agent stamps NULL (column omitted), never an empty string', async () => {
+	// No geoCountry, no deviceFingerprint, no ip/UA → those columns are omitted from
+	// the INSERT entirely, so the DB stores NULL. Empty strings would corrupt the
+	// next sign-in's history comparison (an empty fingerprint would match nothing).
+	await runWithQuery({
+		sql: `insert into  "tenant"."person_auth_log" ("id", "invoked_by_id", "type", "success", "error_code", "metadata") values  (?, ?, ?, ?, ?, ?)`,
+		parameters: [() => true, 'identity-1', 'login', true, null, () => true],
+		response: { rowCount: 1 },
+	}, async db => {
+		await new AuthLogService().logAuthAction(db, { identityId: 'identity-1' }, { type: 'login', response: new ResponseOk({}) })
+	})
+})
+
+test('TenantResolverContextFactory stamps device_fingerprint = analyzer.fingerprint(UA) and the geo country', async () => {
+	// The end-to-end stamping: the factory computes the fingerprint via the SAME
+	// LoginRiskAnalyzer.fingerprint that score() later compares history against, so a
+	// "same browser" sign-in is recognised. This is the link a regression would break.
+	const analyzer = new LoginRiskAnalyzer(hash)
+	const permissionContextFactory = {
+		create: () => ({
+			identity: { id: 'identity-1', roles: [] },
+			isAllowed: () => Promise.resolve(true),
+			requireAccess: () => Promise.resolve(),
+		}),
+	} as any
+	const factory = new TenantResolverContextFactory(permissionContextFactory, new AuthLogService(), analyzer)
+
+	const captured: { geo?: unknown; fp?: unknown } = {}
+	await runWithQuery(insertCapturing(captured), async db => {
+		const context = factory.create(
+			{ apiKeyId: 'api-key-1', identityId: 'identity-1', roles: [] },
+			{ ip: '203.0.113.5', userAgent: UA, geoCountry: 'US' },
+			db,
+			logger,
+		)
+		await context.logAuthAction({ type: 'login', response: new ResponseOk({}) })
+	})
+	expect(captured.fp).toBe(analyzer.fingerprint(UA))
+	expect(captured.fp).toBe(FINGERPRINT)
+	expect(captured.geo).toBe('US')
+})

package/tests/cases/unit/authPolicyResolver.test.ts

@@ -0,0 +1,162 @@
+import { describe, expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { AuthPolicyResolver, DatabaseContext, Providers } from '../../../src/index.js'
+import PostgresInterval from 'postgres-interval'
+
+const NOW = new Date('2026-05-21T12:00:00.000Z')
+const IDENTITY_ID = '123e4567-e89b-12d3-a456-000000000001'
+const PROJECT_ID = '123e4567-e89b-12d3-a456-0000000000aa'
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: (len: number) => Promise.resolve(Buffer.alloc(len)),
+	uuid: () => 'uuid',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const makeDb = (queries: ExpectedQuery[]) => {
+	const connection = createConnectionMock(queries)
+	return new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+}
+
+const POLICIES_SQL = `select *  from "tenant"."auth_policy"`
+const PROJECT_ROLES_SQL = `select "project_id", "role" from "tenant"."project_membership" where "identity_id" = ?`
+
+const policyRow = (overrides: Record<string, unknown>) => ({
+	id: 'p',
+	scope: 'global',
+	project_id: null,
+	roles: [],
+	mfa_required: null,
+	token_expiration: null,
+	idle_timeout: null,
+	grace_duration: null,
+	remember_me_allowed: null,
+	created_at: NOW,
+	updated_at: NOW,
+	...overrides,
+})
+
+describe('AuthPolicyResolver', () => {
+	test('no policies → inert baseline, skips the project-roles query', async () => {
+		const queries: ExpectedQuery[] = [
+			{ sql: POLICIES_SQL, parameters: [], response: { rows: [] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, ['someRole'])
+		expect(result).toEqual({ mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null })
+		expect(queries).toHaveLength(0)
+	})
+
+	test('global match: policy roles intersect global roles → mfaRequired', async () => {
+		const queries: ExpectedQuery[] = [
+			{ sql: POLICIES_SQL, parameters: [], response: { rows: [policyRow({ scope: 'global', roles: ['admin'], mfa_required: true })] } },
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, ['admin'])
+		expect(result.mfaRequired).toBe(true)
+		expect(queries).toHaveLength(0)
+	})
+
+	test('global no-match: disjoint roles → mfaRequired false', async () => {
+		const queries: ExpectedQuery[] = [
+			{ sql: POLICIES_SQL, parameters: [], response: { rows: [policyRow({ scope: 'global', roles: ['admin'], mfa_required: true })] } },
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, ['editor'])
+		expect(result.mfaRequired).toBe(false)
+	})
+
+	test('project match: policy project_id + role intersects a membership', async () => {
+		const queries: ExpectedQuery[] = [
+			{
+				sql: POLICIES_SQL,
+				parameters: [],
+				response: { rows: [policyRow({ scope: 'project', project_id: PROJECT_ID, roles: ['editor'], mfa_required: true })] },
+			},
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [{ project_id: PROJECT_ID, role: 'editor' }] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, [])
+		expect(result.mfaRequired).toBe(true)
+	})
+
+	test('project no-match: same role but a different project does not match', async () => {
+		const queries: ExpectedQuery[] = [
+			{
+				sql: POLICIES_SQL,
+				parameters: [],
+				response: { rows: [policyRow({ scope: 'project', project_id: PROJECT_ID, roles: ['editor'], mfa_required: true })] },
+			},
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [{ project_id: 'other-project', role: 'editor' }] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, [])
+		expect(result.mfaRequired).toBe(false)
+	})
+
+	test('OR aggregation: one matched row with mfa_required wins over a non-requiring one', async () => {
+		const queries: ExpectedQuery[] = [
+			{
+				sql: POLICIES_SQL,
+				parameters: [],
+				response: {
+					rows: [
+						policyRow({ scope: 'global', roles: ['a'], mfa_required: false }),
+						policyRow({ scope: 'global', roles: ['b'], mfa_required: true }),
+					],
+				},
+			},
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, ['a', 'b'])
+		expect(result.mfaRequired).toBe(true)
+	})
+
+	test('strictest session aggregation: min interval, AND remember-me', async () => {
+		const queries: ExpectedQuery[] = [
+			{
+				sql: POLICIES_SQL,
+				parameters: [],
+				response: {
+					rows: [
+						policyRow({
+							scope: 'global',
+							roles: ['a'],
+							token_expiration: PostgresInterval('02:00:00'),
+							idle_timeout: PostgresInterval('00:30:00'),
+							remember_me_allowed: true,
+						}),
+						policyRow({
+							scope: 'global',
+							roles: ['b'],
+							token_expiration: PostgresInterval('01:00:00'),
+							idle_timeout: PostgresInterval('00:45:00'),
+							remember_me_allowed: false,
+						}),
+					],
+				},
+			},
+			{ sql: PROJECT_ROLES_SQL, parameters: [IDENTITY_ID], response: { rows: [] } },
+		]
+		const db = makeDb(queries)
+		const result = await new AuthPolicyResolver().resolveForIdentity(db, IDENTITY_ID, ['a', 'b'])
+		// shortest token_expiration (1h) and idle_timeout (30m), remember-me ANDed to false
+		expect(result.tokenExpiration && PostgresInterval(result.tokenExpiration as unknown as string)).toBeDefined()
+		expect((result.tokenExpiration as any).hours).toBe(1)
+		expect((result.idleTimeout as any).minutes).toBe(30)
+		expect(result.rememberMeAllowed).toBe(false)
+	})
+})

package/tests/cases/unit/authorization/membershipAwareAccessNode.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from 'bun:test'
-import { testUuid } from '../../../src/testUuid'
-import { AclSchemaAccessNodeFactory, PermissionActions } from '../../../../src'
+import { testUuid } from '../../../src/testUuid.js'
+import { AclSchemaAccessNodeFactory, PermissionActions } from '../../../../src/index.js'
 import { Acl } from '@contember/schema'
 
 const siteIdA = testUuid(666)

package/tests/cases/unit/authorization/membershipMatcher.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from 'bun:test'
-import { testUuid } from '../../../src/testUuid'
-import { MembershipMatcher } from '../../../../src'
+import { testUuid } from '../../../src/testUuid.js'
+import { MembershipMatcher } from '../../../../src/index.js'
 
 const siteIdA = testUuid(666)
 const siteIdB = testUuid(667)