@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/src/migrations/snapshot.ts

@@ -1,6 +1,6 @@
 import { MigrationBuilder } from '@contember/database-migrations'
-import { TenantMigrationArgs } from './types'
-import { createCredentials } from './tenantCredentials'
+import { TenantMigrationArgs } from './types.js'
+import { createCredentials } from './tenantCredentials.js'
 
 export default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {
 	builder.sql(`
@@ -17,7 +17,46 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'passwordless_login_init',
     'passwordless_login_exchange',
     'passwordless_login',
-    'person_disable'
+    'person_disable',
+    'session_revoked_by_user',
+    'forced_sign_out',
+    'global_role_grant',
+    'global_role_revoke',
+    'project_membership_create',
+    'project_membership_update',
+    'project_membership_remove',
+    'api_key_create',
+    'api_key_disable',
+    'idp_create',
+    'idp_update',
+    'idp_disable',
+    'idp_enable',
+    'project_create',
+    'project_update',
+    'project_secret_change',
+    'mail_template_change',
+    'tenant_config_change',
+    'person_invite',
+    'backup_code_generated',
+    'backup_code_used',
+    'backup_code_regenerated',
+    'email_otp_sent',
+    'mfa_enrollment_required',
+    'mfa_reset',
+    'session_expired_idle',
+    'session_policy_applied',
+    'auth_policy_change',
+    'email_verify_init',
+    'email_verify_complete',
+    'email_change_init',
+    'email_change_complete',
+    'idp_session_revalidated',
+    'idp_session_revoked',
+    'idp_session_revalidation_failed',
+    'unusual_login_detected',
+    'step_up_required',
+    'idp_logout_initiated',
+    'idp_backchannel_logout'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -30,7 +69,10 @@ CREATE TYPE "config_singleton" AS ENUM (
 );
 CREATE TYPE "person_token_type" AS ENUM (
     'password_reset',
-    'passwordless'
+    'passwordless',
+    'mfa_email_otp',
+    'email_verification',
+    'email_change'
 );
 CREATE FUNCTION "project_deleted"() RETURNS "trigger"
     LANGUAGE "plpgsql"
@@ -66,7 +108,29 @@ CREATE TABLE "api_key" (
     "expires_at" timestamp with time zone,
     "created_at" timestamp with time zone NOT NULL,
     "expiration" integer,
-    "disabled_at" timestamp with time zone
+    "disabled_at" timestamp with time zone,
+    "last_ip" "inet",
+    "last_user_agent" "text",
+    "last_used_at" timestamp with time zone,
+    "created_ip" "inet",
+    "created_user_agent" "text",
+    "trust_forwarded_info" boolean DEFAULT false NOT NULL,
+    "issued_at" timestamp with time zone,
+    "idle_timeout" interval,
+    "max_expires_at" timestamp with time zone
+);
+CREATE TABLE "auth_policy" (
+    "id" "uuid" NOT NULL,
+    "scope" "text" NOT NULL,
+    "project_id" "uuid",
+    "roles" "text"[] NOT NULL,
+    "mfa_required" boolean,
+    "token_expiration" interval,
+    "idle_timeout" interval,
+    "remember_me_allowed" boolean,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "grace_duration" interval
 );
 CREATE TABLE "config" (
     "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
@@ -85,7 +149,38 @@ CREATE TABLE "config" (
     "login_attempt_window" interval DEFAULT '00:05:00'::interval NOT NULL,
     "login_reveal_user_exits" boolean DEFAULT true NOT NULL,
     "login_default_token_expiration" interval DEFAULT '00:30:00'::interval NOT NULL,
-    "login_max_token_expiration" interval DEFAULT '6 mons'::interval
+    "login_max_token_expiration" interval DEFAULT '6 mons'::interval,
+    "password_check_hibp" boolean DEFAULT false NOT NULL,
+    "captcha_provider" "text",
+    "captcha_secret" "bytea",
+    "captcha_secret_version" integer,
+    "captcha_threshold" double precision,
+    "rate_limit_sign_up_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_sign_up_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_login_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_login_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_password_reset_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_password_reset_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_passwordless_init_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_passwordless_init_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "login_reveal_login_method" boolean DEFAULT true NOT NULL,
+    "login_mfa_grace_duration" interval DEFAULT '00:00:00'::interval NOT NULL,
+    "rate_limit_email_otp_per_person_limit" integer DEFAULT 10 NOT NULL,
+    "rate_limit_email_otp_per_person_window" interval DEFAULT '00:10:00'::interval NOT NULL,
+    "signup_require_email_verification" boolean DEFAULT false NOT NULL,
+    "require_email_change_verification" boolean DEFAULT false NOT NULL,
+    "rate_limit_email_verification_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_email_verification_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "captcha_protect_sign_up" boolean DEFAULT true NOT NULL,
+    "captcha_protect_password_reset" boolean DEFAULT true NOT NULL,
+    "captcha_protect_passwordless_init" boolean DEFAULT true NOT NULL,
+    "captcha_protect_email_verification" boolean DEFAULT false NOT NULL,
+    "login_anomaly_detection_enabled" boolean DEFAULT false NOT NULL,
+    "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
+    "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
+    "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
+    CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
@@ -102,7 +197,21 @@ CREATE TABLE "identity_provider" (
     "disabled_at" timestamp with time zone,
     "auto_sign_up" boolean DEFAULT false NOT NULL,
     "exclusive" boolean DEFAULT false,
-    "init_returns_config" boolean DEFAULT false NOT NULL
+    "init_returns_config" boolean DEFAULT false NOT NULL,
+    "require_verified_email" boolean DEFAULT false NOT NULL,
+    "assume_email_verified" boolean DEFAULT false NOT NULL
+);
+CREATE TABLE "idp_session" (
+    "id" "uuid" NOT NULL,
+    "api_key_id" "uuid" NOT NULL,
+    "identity_provider_id" "uuid" NOT NULL,
+    "idp_session_id" "text",
+    "tokens" "bytea",
+    "tokens_version" integer,
+    "idp_expires_at" timestamp with time zone,
+    "token_obtained_at" timestamp with time zone,
+    "last_validated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL
 );
 CREATE TABLE "mail_template" (
     "id" "uuid" NOT NULL,
@@ -119,12 +228,13 @@ CREATE TABLE "person" (
     "email" "text",
     "password_hash" "text",
     "identity_id" "uuid" NOT NULL,
-    "otp_uri" "text",
-    "otp_activated_at" timestamp with time zone,
     "name" "text",
     "idp_only" boolean DEFAULT false NOT NULL,
     "disabled_at" timestamp with time zone,
     "passwordless_enabled" boolean,
+    "mfa_grace_until" timestamp with time zone,
+    "email_verified_at" timestamp with time zone,
+    "email_verification_required" boolean DEFAULT false NOT NULL,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
 CREATE TABLE "person_auth_log" (
@@ -141,7 +251,18 @@ CREATE TABLE "person_auth_log" (
     "ip_address" "inet",
     "user_agent" "text",
     "identity_provider_id" "uuid",
-    "metadata" "jsonb"
+    "metadata" "jsonb",
+    "target_person_id" "uuid",
+    "event_data" "jsonb",
+    "geo_country" "text",
+    "device_fingerprint" "text"
+);
+CREATE TABLE "person_backup_code" (
+    "id" "uuid" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "code_hash" "text" NOT NULL,
+    "used_at" timestamp with time zone,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL
 );
 CREATE TABLE "person_identity_provider" (
     "id" "uuid" NOT NULL,
@@ -150,6 +271,16 @@ CREATE TABLE "person_identity_provider" (
     "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
     "external_identifier" "text" NOT NULL
 );
+CREATE TABLE "person_mfa" (
+    "person_id" "uuid" NOT NULL,
+    "totp_secret" "bytea",
+    "totp_secret_version" integer,
+    "totp_activated_at" timestamp with time zone,
+    "totp_pending_secret" "bytea",
+    "totp_pending_version" integer,
+    "totp_pending_created_at" timestamp with time zone,
+    "email_otp_enabled" boolean DEFAULT false NOT NULL
+);
 CREATE TABLE "person_token" (
     "id" "uuid" NOT NULL,
     "token_hash" "text" NOT NULL,
@@ -159,7 +290,8 @@ CREATE TABLE "person_token" (
     "used_at" timestamp with time zone,
     "type" "person_token_type" DEFAULT 'password_reset'::"person_token_type" NOT NULL,
     "otp_hash" "text",
-    "otp_attempts" integer DEFAULT 0 NOT NULL
+    "otp_attempts" integer DEFAULT 0 NOT NULL,
+    "meta" "jsonb"
 );
 CREATE TABLE "project" (
     "id" "uuid" NOT NULL,
@@ -189,8 +321,16 @@ CREATE TABLE "project_secret" (
     "value" "bytea" NOT NULL,
     "version" smallint NOT NULL
 );
+CREATE TABLE "rate_limit_event" (
+    "id" "uuid" NOT NULL,
+    "scope" "text" NOT NULL,
+    "key_hash" "bytea" NOT NULL,
+    "occurred_at" timestamp with time zone DEFAULT "now"() NOT NULL
+);
 ALTER TABLE ONLY "api_key"
     ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "auth_policy"
+    ADD CONSTRAINT "auth_policy_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "config"
     ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
@@ -201,16 +341,22 @@ ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_backup_code"
+    ADD CONSTRAINT "person_backup_code_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_mfa"
+    ADD CONSTRAINT "person_mfa_pkey" PRIMARY KEY ("person_id");
 ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "project"
@@ -223,13 +369,21 @@ ALTER TABLE ONLY "project_membership_variable"
     ADD CONSTRAINT "project_membership_variable_unique" UNIQUE ("membership_id", "variable");
 ALTER TABLE ONLY "project_secret"
     ADD CONSTRAINT "project_secret_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "rate_limit_event"
+    ADD CONSTRAINT "rate_limit_event_pkey" PRIMARY KEY ("id");
 CREATE INDEX "api_key_identity_id" ON "api_key" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "api_key_token_hash" ON "api_key" USING "btree" ("token_hash");
+CREATE INDEX "auth_policy_project_id_idx" ON "auth_policy" USING "btree" ("project_id");
 CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
+CREATE UNIQUE INDEX "idp_session_api_key_id" ON "idp_session" USING "btree" ("api_key_id");
+CREATE INDEX "idp_session_sid" ON "idp_session" USING "btree" ("identity_provider_id", "idp_session_id");
 CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
 CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
 CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
-CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC);
+CREATE INDEX "person_auth_log_person_id_created_at_idx" ON "person_auth_log" USING "btree" ("person_id", "created_at" DESC);
+CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC) WHERE (("type" = 'login'::"auth_log_type") AND ("success" = false));
+CREATE INDEX "person_auth_log_target_person_id_created_at_idx" ON "person_auth_log" USING "btree" ("target_person_id", "created_at" DESC);
+CREATE INDEX "person_backup_code_person_id_idx" ON "person_backup_code" USING "btree" ("person_id");
 CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
 CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
@@ -240,13 +394,21 @@ CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "b
 CREATE INDEX "project_secret_project_index" ON "project_secret" USING "btree" ("project_id");
 CREATE UNIQUE INDEX "project_secret_unique" ON "project_secret" USING "btree" ("project_id", "key");
 CREATE UNIQUE INDEX "project_slug" ON "project" USING "btree" ("slug");
+CREATE INDEX "rate_limit_event_lookup" ON "rate_limit_event" USING "btree" ("scope", "key_hash", "occurred_at" DESC);
+CREATE INDEX "rate_limit_event_occurred_at_brin" ON "rate_limit_event" USING "brin" ("occurred_at");
 CREATE TRIGGER "project_deleted" AFTER DELETE ON "project" FOR EACH ROW EXECUTE FUNCTION "project_deleted"();
 CREATE TRIGGER "project_secret_updated" AFTER INSERT OR DELETE OR UPDATE ON "project_secret" FOR EACH ROW EXECUTE FUNCTION "project_secret_updated"();
 CREATE TRIGGER "project_updated" BEFORE INSERT OR UPDATE OF "name", "slug", "config" ON "project" FOR EACH ROW EXECUTE FUNCTION "project_updated"();
 ALTER TABLE ONLY "api_key"
     ADD CONSTRAINT "api_key_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "auth_policy"
+    ADD CONSTRAINT "auth_policy_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "identity"
     ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_api_key" FOREIGN KEY ("api_key_id") REFERENCES "api_key"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_auth_log"
@@ -257,12 +419,18 @@ ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE SET NULL;
 ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_person_token_id_fkey" FOREIGN KEY ("person_token_id") REFERENCES "person_token"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_target_person_id_fkey" FOREIGN KEY ("target_person_id") REFERENCES "person"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_backup_code"
+    ADD CONSTRAINT "person_backup_code_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_mfa"
+    ADD CONSTRAINT "person_mfa_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "project_membership"

package/src/migrations/tenantCredentials.ts

@@ -1,5 +1,5 @@
 import { escapeValue, MigrationBuilder } from '@contember/database-migrations'
-import { TenantMigrationArgs } from './types'
+import { TenantMigrationArgs } from './types.js'
 
 export const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {
 	const credentials = await args.getCredentials()

package/src/migrations/types.ts

@@ -1,4 +1,4 @@
-import { Providers } from '../model'
+import { Providers } from '../model/index.js'
 
 export interface TenantMigrationArgs {
 	getCredentials: () => Promise<{

package/src/model/authorization/AclSchemaAccessNodeFactory.ts

@@ -1,8 +1,8 @@
 import { AccessNode } from '@contember/authorization'
-import { PermissionActions } from './PermissionActions'
+import { PermissionActions } from './PermissionActions.js'
 import { Acl } from '@contember/schema'
-import { MembershipMatcher } from './MembershipMatcher'
-import { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'
+import { MembershipMatcher } from './MembershipMatcher.js'
+import { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode.js'
 
 export class AclSchemaAccessNodeFactory {
 	create(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {

package/src/model/authorization/Identity.ts

@@ -1,5 +1,5 @@
-import { ProjectMemberManager } from '../service'
-import { DatabaseContext } from '../utils'
+import { ProjectMemberManager } from '../service/index.js'
+import { DatabaseContext } from '../utils/index.js'
 import { Acl } from '@contember/schema'
 
 export interface Identity {

package/src/model/authorization/IdentityFactory.ts

@@ -1,6 +1,6 @@
-import { ProjectMemberManager } from '../service'
-import { Identity, ProjectAwareIdentity } from './Identity'
-import { DatabaseContext } from '../utils'
+import { ProjectMemberManager } from '../service/index.js'
+import { Identity, ProjectAwareIdentity } from './Identity.js'
+import { DatabaseContext } from '../utils/index.js'
 
 export class IdentityFactory {
 	constructor(private readonly projectMemberManager: ProjectMemberManager) {}

package/src/model/authorization/IdentityScope.ts

@@ -1,6 +1,6 @@
 import { AccessNode, AuthorizationScope } from '@contember/authorization'
-import { TenantRole } from './Roles'
-import { Identity } from './Identity'
+import { TenantRole } from './Roles.js'
+import { Identity } from './Identity.js'
 
 class IdentityScope implements AuthorizationScope<Identity> {
 	constructor(private readonly identityId: string) {}

package/src/model/authorization/PermissionActions.ts

@@ -15,6 +15,7 @@ namespace PermissionActions {
 
 	export const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')
 	export const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')
+	export const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')
 
 	export const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')
 	export const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })
@@ -22,8 +23,13 @@ namespace PermissionActions {
 		Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
 
 	export const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })
+	export const PERSON_FORCE_SIGN_OUT = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'forceSignOut', { roles })
+	export const PERSON_RESET_MFA = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'resetMfa', { roles })
+	export const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')
+	export const PERSON_VIEW_SESSIONS = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewSessions', { roles })
 
 	export const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')
+	export const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')
 	export const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')
 	export const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })
 	export const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')
@@ -36,6 +42,8 @@ namespace PermissionActions {
 	export const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')
 	export const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')
 	export const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')
+	export const PERSON_VIEW_IDP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'viewIdp', { roles })
+	export const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')
 	export const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')
 	export const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')
 	export const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })
@@ -46,6 +54,7 @@ namespace PermissionActions {
 
 	export const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')
 	export const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')
+	export const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')
 	export const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')
 
 	export const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')
@@ -63,6 +72,7 @@ namespace PermissionActions {
 	export const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')
 	export const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })
 	export const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')
+	export const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')
 
 	export const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')
 	export const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')

package/src/model/authorization/PermissionContext.ts

@@ -1,8 +1,8 @@
 import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'
 import { ForbiddenError } from '@contember/graphql-utils'
-import { ProjectScopeFactory } from './ProjectScopeFactory'
-import { Project, ProjectSchemaResolver } from '../type'
-import { Identity } from './Identity'
+import { ProjectScopeFactory } from './ProjectScopeFactory.js'
+import { Project, ProjectSchemaResolver } from '../type/index.js'
+import { Identity } from './Identity.js'
 
 export type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>
 

package/src/model/authorization/PermissionContextFactory.ts

@@ -1,9 +1,9 @@
 import { Authorizator } from '@contember/authorization'
-import { IdentityFactory } from './IdentityFactory'
-import { PermissionContext } from './PermissionContext'
-import { ProjectScopeFactory } from './ProjectScopeFactory'
-import { ProjectSchemaResolver } from '../type'
-import { DatabaseContext } from '../utils'
+import { IdentityFactory } from './IdentityFactory.js'
+import { PermissionContext } from './PermissionContext.js'
+import { ProjectScopeFactory } from './ProjectScopeFactory.js'
+import { ProjectSchemaResolver } from '../type/index.js'
+import { DatabaseContext } from '../utils/index.js'
 
 export class PermissionContextFactory {
 	constructor(

package/src/model/authorization/PermissionsFactory.ts

@@ -1,6 +1,6 @@
 import { Permissions } from '@contember/authorization'
-import { PermissionActions } from './PermissionActions'
-import { TenantRole } from './Roles'
+import { PermissionActions } from './PermissionActions.js'
+import { TenantRole } from './Roles.js'
 
 const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])
 
@@ -33,6 +33,8 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)
+		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)
+		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)
 
 		permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)
 
@@ -48,6 +50,10 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(), projectAdminUseRolesVerifier)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)
 
@@ -55,6 +61,7 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))

package/src/model/authorization/ProjectScope.ts

@@ -1,9 +1,9 @@
 import { AccessNode, AuthorizationScope } from '@contember/authorization'
-import { Project } from '../type'
-import { TenantRole } from './Roles'
+import { Project } from '../type/index.js'
+import { TenantRole } from './Roles.js'
 import { Acl, ProjectRole } from '@contember/schema'
-import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'
-import { Identity } from './Identity'
+import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'
+import { Identity } from './Identity.js'
 
 export class ProjectScope implements AuthorizationScope<Identity> {
 	constructor(

package/src/model/authorization/ProjectScopeFactory.ts

@@ -1,8 +1,8 @@
-import { Project, ProjectSchemaResolver } from '../type'
-import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'
+import { Project, ProjectSchemaResolver } from '../type/index.js'
+import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'
 import { AuthorizationScope } from '@contember/authorization'
-import { ProjectScope } from './ProjectScope'
-import { Identity } from './Identity'
+import { ProjectScope } from './ProjectScope.js'
+import { Identity } from './Identity.js'
 
 export class ProjectScopeFactory {
 	constructor(

package/src/model/authorization/index.ts

@@ -1,12 +1,12 @@
-export * from './AclSchemaAccessNodeFactory'
-export * from './Identity'
-export * from './IdentityFactory'
-export * from './IdentityScope'
-export * from './MembershipMatcher'
-export * from './PermissionActions'
-export * from './PermissionContext'
-export * from './PermissionContextFactory'
-export * from './PermissionsFactory'
-export * from './ProjectScope'
-export * from './ProjectScopeFactory'
-export * from './Roles'
+export * from './AclSchemaAccessNodeFactory.js'
+export * from './Identity.js'
+export * from './IdentityFactory.js'
+export * from './IdentityScope.js'
+export * from './MembershipMatcher.js'
+export * from './PermissionActions.js'
+export * from './PermissionContext.js'
+export * from './PermissionContextFactory.js'
+export * from './PermissionsFactory.js'
+export * from './ProjectScope.js'
+export * from './ProjectScopeFactory.js'
+export * from './Roles.js'

package/src/model/commands/Command.ts

@@ -1,6 +1,6 @@
 import { Client } from '@contember/database'
-import { Providers } from '../providers'
-import { CommandBus } from './CommandBus'
+import { Providers } from '../providers.js'
+import { CommandBus } from './CommandBus.js'
 
 interface Command<Result> {
 	execute(args: Command.Args): Promise<Result>

package/src/model/commands/CommandBus.ts

@@ -1,6 +1,6 @@
-import { Command } from './Command'
+import { Command } from './Command.js'
 import { Client, Connection } from '@contember/database'
-import { Providers } from '../providers'
+import { Providers } from '../providers.js'
 
 export class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	constructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}

package/src/model/commands/apiKey/ApiKeyHelper.ts

@@ -1,6 +1,6 @@
-import { ApiKey } from '../../type'
-import { Providers } from '../../providers'
-import { plusMinutes } from '../../utils/time'
+import { ApiKey } from '../../type/index.js'
+import { Providers } from '../../providers.js'
+import { plusMinutes } from '../../utils/time.js'
 
 const DEFAULT_EXPIRATION = 30
 export class ApiKeyHelper {