@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/src/model/commands/apiKey/CreateApiKeyCommand.ts

@@ -1,14 +1,24 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
-import { ApiKeyHelper } from './ApiKeyHelper'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
+import { ApiKeyHelper } from './ApiKeyHelper.js'
 import { InsertBuilder } from '@contember/database'
-import { computeTokenHash, generateToken, TokenHash } from '../../utils'
+import { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'
+import { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'
 
 interface CreateSessionApiKeyArgs {
 	type: ApiKey.Type.SESSION
 	identityId: string
 	expiration?: number
 	tokenHash?: string
+	requestInfo?: ApiKeyRequestInfo
+	trustForwardedInfo?: boolean
+	/**
+	 * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's
+	 * behavior (no idle timeout, no absolute cap on the sliding window).
+	 * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).
+	 */
+	idleTimeout?: string | null
+	maxExpiresAt?: Date | null
 }
 
 interface CreatePermanentApiKeyArgs {
@@ -16,6 +26,8 @@ interface CreatePermanentApiKeyArgs {
 	identityId: string
 	tokenHash?: TokenHash
 	expiration?: undefined
+	requestInfo?: ApiKeyRequestInfo
+	trustForwardedInfo?: boolean
 }
 
 export type CreateApiKeyArgs =
@@ -34,6 +46,16 @@ export class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {
 			tokenHash = computeTokenHash(token)
 		}
 
+		// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off
+		// keys have no session policy → NULL (preserving today's behavior).
+		const args = this.args
+		const sessionPolicy = args.type === ApiKey.Type.SESSION
+			? {
+				issued_at: providers.now(),
+				idle_timeout: args.idleTimeout ?? null,
+				max_expires_at: args.maxExpiresAt ?? null,
+			}
+			: { issued_at: null, idle_timeout: null, max_expires_at: null }
 		await InsertBuilder.create()
 			.into('api_key')
 			.values({
@@ -45,6 +67,12 @@ export class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {
 				expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
 				expiration: this.args.expiration || null,
 				created_at: providers.now(),
+				created_ip: this.args.requestInfo?.ip || null,
+				created_user_agent: this.args.requestInfo?.userAgent || null,
+				trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+				issued_at: sessionPolicy.issued_at,
+				idle_timeout: sessionPolicy.idle_timeout,
+				max_expires_at: sessionPolicy.max_expires_at,
 			})
 			.execute(db)
 

package/src/model/commands/apiKey/DisableApiKeyCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableApiKeyCommand implements Command<boolean> {

package/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableIdentityApiKeysCommand implements Command<void> {

package/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts

@@ -1,5 +1,5 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableOneOffApiKeyCommand implements Command<void> {

package/src/model/commands/apiKey/ProlongApiKeyCommand.ts

@@ -1,9 +1,25 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
-import { ApiKeyHelper } from './ApiKeyHelper'
-import { UpdateBuilder } from '@contember/database'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
+import { ApiKeyHelper } from './ApiKeyHelper.js'
+import { QueryBuilder, UpdateBuilder } from '@contember/database'
 
-const PROLONG_THROTTLE_MS = 60_000
+/**
+ * Tracking writes (`last_used_at`) are throttled to at most once per this window, so
+ * an idle check must add this slack to avoid prematurely expiring an active session
+ * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
+ */
+export const PROLONG_THROTTLE_MS = 60_000
+
+export interface ApiKeyRequestInfo {
+	ip?: string
+	userAgent?: string
+}
+
+export interface ApiKeyTrackingState {
+	lastIp: string | null
+	lastUserAgent: string | null
+	lastUsedAt: Date | null
+}
 
 export class ProlongApiKeyCommand implements Command<void> {
 	constructor(
@@ -11,27 +27,64 @@ export class ProlongApiKeyCommand implements Command<void> {
 		private readonly type: ApiKey.Type,
 		private readonly expiration: number | null,
 		private readonly currentExpiration: Date | null,
+		private readonly requestInfo?: ApiKeyRequestInfo,
+		private readonly tracking?: ApiKeyTrackingState,
+		private readonly maxExpiresAt?: Date | null,
 	) {}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)
-		if (newExpiration === null) {
-			return
+		let newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)
+		// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.
+		// NULL maxExpiresAt = today's uncapped sliding window.
+		if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+			newExpiration = this.maxExpiresAt
 		}
+		const now = providers.now()
 
-		if (this.currentExpiration) {
+		let updateExpiration = newExpiration !== null
+		if (updateExpiration && this.currentExpiration && newExpiration !== null) {
 			const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()
 			if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-				return
+				updateExpiration = false
 			}
 		}
 
+		const requestIp = this.requestInfo?.ip || null
+		const requestUserAgent = this.requestInfo?.userAgent || null
+		const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)
+
+		if (!updateExpiration && !updateTracking) {
+			return
+		}
+
+		const values: QueryBuilder.Values = {}
+		if (updateExpiration && newExpiration !== null) {
+			values.expires_at = newExpiration
+		}
+		if (updateTracking) {
+			values.last_ip = requestIp
+			values.last_user_agent = requestUserAgent
+			values.last_used_at = now
+		}
+
 		const qb = UpdateBuilder.create()
 			.table('api_key')
 			.where({ id: this.id })
-			.values({
-				expires_at: newExpiration,
-			})
+			.values(values)
 		await qb.execute(db)
 	}
+
+	private shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {
+		if (!this.requestInfo) {
+			return false
+		}
+		const last = this.tracking
+		if (!last || last.lastUsedAt === null) {
+			return true
+		}
+		if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
+			return true
+		}
+		return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
+	}
 }

package/src/model/commands/apiKey/index.ts

@@ -1,5 +1,5 @@
-export * from './CreateApiKeyCommand'
-export * from './DisableApiKeyCommand'
-export * from './DisableIdentityApiKeysCommand'
-export * from './DisableOneOffApiKeyCommand'
-export * from './ProlongApiKeyCommand'
+export * from './CreateApiKeyCommand.js'
+export * from './DisableApiKeyCommand.js'
+export * from './DisableIdentityApiKeysCommand.js'
+export * from './DisableOneOffApiKeyCommand.js'
+export * from './ProlongApiKeyCommand.js'

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -1,5 +1,5 @@
-import { Command } from '../Command'
-import { AuthActionType } from '../../type/AuthLog'
+import { Command } from '../Command.js'
+import { AuthActionType } from '../../type/AuthLog.js'
 import { InsertBuilder } from '@contember/database'
 import { JSONValue } from '@contember/schema'
 
@@ -26,6 +26,10 @@ export class CreateAuthLogEntryCommand implements Command<void> {
 				user_agent: this.data.userAgent,
 				identity_provider_id: this.data.identityProviderId,
 				metadata: this.data.metadata ?? {},
+				target_person_id: this.data.targetPersonId,
+				event_data: this.data.eventData,
+				geo_country: this.data.geoCountry,
+				device_fingerprint: this.data.deviceFingerprint,
 			})
 			.execute(db)
 	}
@@ -34,7 +38,8 @@ export class CreateAuthLogEntryCommand implements Command<void> {
 namespace CreateAuthLogEntryCommand {
 	export type Entry = {
 		type: AuthActionType
-		invokedById: string
+		/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */
+		invokedById?: string
 		personInputIdentifier?: string
 		personId?: string
 		personTokenId?: string
@@ -45,5 +50,11 @@ namespace CreateAuthLogEntryCommand {
 		userAgent?: string
 		identityProviderId?: string
 		metadata?: JSONValue
+		targetPersonId?: string
+		eventData?: JSONValue
+		/** A03: country derived from the trusted reverse-proxy geo header, when present. */
+		geoCountry?: string
+		/** A03: hash of the client user-agent (never the raw UA). */
+		deviceFingerprint?: string
 	}
 }

package/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts

@@ -0,0 +1,41 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+import { AuthPolicyScope } from '../../type/index.js'
+
+export type AuthPolicyWriteValues = {
+	scope: AuthPolicyScope
+	projectId: string | null
+	roles: string[]
+	mfaRequired: boolean | null
+	tokenExpiration: string | null
+	idleTimeout: string | null
+	graceDuration: string | null
+	rememberMeAllowed: boolean | null
+}
+
+/** Inserts a new `auth_policy` row. Returns the generated id. */
+export class CreateAuthPolicyCommand implements Command<string> {
+	constructor(private readonly values: AuthPolicyWriteValues) {}
+
+	async execute({ db, providers }: Command.Args): Promise<string> {
+		const id = providers.uuid()
+		const now = providers.now()
+		await InsertBuilder.create()
+			.into('auth_policy')
+			.values({
+				id,
+				scope: this.values.scope,
+				project_id: this.values.projectId,
+				roles: this.values.roles,
+				mfa_required: this.values.mfaRequired,
+				token_expiration: this.values.tokenExpiration,
+				idle_timeout: this.values.idleTimeout,
+				grace_duration: this.values.graceDuration,
+				remember_me_allowed: this.values.rememberMeAllowed,
+				created_at: now,
+				updated_at: now,
+			})
+			.execute(db)
+		return id
+	}
+}

package/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts

@@ -0,0 +1,15 @@
+import { Command } from '../Command.js'
+import { DeleteBuilder } from '@contember/database'
+
+/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */
+export class DeleteAuthPolicyCommand implements Command<boolean> {
+	constructor(private readonly id: string) {}
+
+	async execute({ db }: Command.Args): Promise<boolean> {
+		const result = await DeleteBuilder.create()
+			.from('auth_policy')
+			.where({ id: this.id })
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts

@@ -0,0 +1,43 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+import { AuthPolicyScope } from '../../type/index.js'
+
+/**
+ * Updates an existing `auth_policy` row. Only the supplied fields are written
+ * (an `undefined` field is left untouched; an explicit `null` clears it).
+ * `updated_at` is always bumped. Returns whether a row was affected.
+ */
+export class UpdateAuthPolicyCommand implements Command<boolean> {
+	constructor(
+		private readonly id: string,
+		private readonly values: {
+			scope?: AuthPolicyScope
+			projectId?: string | null
+			roles?: string[]
+			mfaRequired?: boolean | null
+			tokenExpiration?: string | null
+			idleTimeout?: string | null
+			graceDuration?: string | null
+			rememberMeAllowed?: boolean | null
+		},
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const result = await UpdateBuilder.create()
+			.table('auth_policy')
+			.where({ id: this.id })
+			.values({
+				scope: this.values.scope,
+				project_id: this.values.projectId,
+				roles: this.values.roles,
+				mfa_required: this.values.mfaRequired,
+				token_expiration: this.values.tokenExpiration,
+				idle_timeout: this.values.idleTimeout,
+				grace_duration: this.values.graceDuration,
+				remember_me_allowed: this.values.rememberMeAllowed,
+				updated_at: providers.now(),
+			})
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/authPolicy/index.ts

@@ -0,0 +1,3 @@
+export * from './CreateAuthPolicyCommand.js'
+export * from './UpdateAuthPolicyCommand.js'
+export * from './DeleteAuthPolicyCommand.js'

package/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts

@@ -0,0 +1,32 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+/**
+ * Atomically consumes an unused backup code matching the given hash.
+ * Returns true if a code was consumed. Safe against double-spend: the
+ * UPDATE only touches a row that is still unused, and we rely on the
+ * affected-row count, so two concurrent attempts with the same code can
+ * succeed at most once.
+ */
+export class ConsumeBackupCodeCommand implements Command<boolean> {
+	constructor(
+		private readonly personId: string,
+		private readonly codeHash: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const affected = await UpdateBuilder.create()
+			.table('person_backup_code')
+			.values({
+				used_at: providers.now(),
+			})
+			.where({
+				person_id: this.personId,
+				code_hash: this.codeHash,
+			})
+			.where(expr => expr.isNull('used_at'))
+			.execute(db)
+
+		return affected > 0
+	}
+}

package/src/model/commands/backupCode/CreateBackupCodeCommand.ts

@@ -0,0 +1,24 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+
+/**
+ * Inserts a single backup code (stored as a hash) for a person.
+ */
+export class CreateBackupCodeCommand implements Command<void> {
+	constructor(
+		private readonly personId: string,
+		private readonly codeHash: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await InsertBuilder.create()
+			.into('person_backup_code')
+			.values({
+				id: providers.uuid(),
+				person_id: this.personId,
+				code_hash: this.codeHash,
+				created_at: providers.now(),
+			})
+			.execute(db)
+	}
+}

package/src/model/commands/backupCode/DeleteBackupCodesCommand.ts

@@ -0,0 +1,16 @@
+import { Command } from '../Command.js'
+import { DeleteBuilder } from '@contember/database'
+
+/**
+ * Deletes all backup codes (used and unused) for a person.
+ */
+export class DeleteBackupCodesCommand implements Command<void> {
+	constructor(private readonly personId: string) {}
+
+	async execute({ db }: Command.Args): Promise<void> {
+		await DeleteBuilder.create()
+			.from('person_backup_code')
+			.where({ person_id: this.personId })
+			.execute(db)
+	}
+}

package/src/model/commands/backupCode/index.ts

@@ -0,0 +1,3 @@
+export * from './ConsumeBackupCodeCommand.js'
+export * from './CreateBackupCodeCommand.js'
+export * from './DeleteBackupCodesCommand.js'

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -1,7 +1,7 @@
-import { Command } from '../Command'
-import { ConfigInput } from '../../../schema'
+import { Command } from '../Command.js'
+import { ConfigInput } from '../../../schema/index.js'
 import { UpdateBuilder } from '@contember/database'
-import { ConfigRow } from '../../type/Config'
+import { ConfigRow } from '../../type/Config.js'
 import { IPostgresInterval } from 'postgres-interval'
 
 export class UpdateConfigurationCommand implements Command<void> {
@@ -10,13 +10,33 @@ export class UpdateConfigurationCommand implements Command<void> {
 	) {
 	}
 
-	async execute({ db }: Command.Args): Promise<void> {
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const captcha = this.configuration.captcha
+		const rl = this.configuration.rateLimits
+
+		// Encrypt captcha secret at rest. Empty string clears the value;
+		// non-empty re-encrypts so we always rotate to the latest key version.
+		let captchaSecretCol: Buffer | null | undefined
+		let captchaSecretVersionCol: number | null | undefined
+		if (captcha?.secret !== undefined) {
+			if (captcha.secret === '' || captcha.secret === null) {
+				captchaSecretCol = null
+				captchaSecretVersionCol = null
+			} else {
+				const encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))
+				captchaSecretCol = encrypted.value
+				captchaSecretVersionCol = encrypted.version
+			}
+		}
+
 		const result = await UpdateBuilder.create()
 			.table('config')
 			.where({ id: 'singleton' })
 			.values(
 				{
 					passwordless_enabled: this.configuration.passwordless?.enabled ?? undefined,
+					signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,
+					require_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,
 					passwordless_url: this.configuration.passwordless?.url,
 					passwordless_expiration: this.configuration.passwordless?.expiration ?? undefined,
 					password_min_length: this.configuration.password?.minLength ?? undefined,
@@ -26,12 +46,39 @@ export class UpdateConfigurationCommand implements Command<void> {
 					password_require_special: this.configuration.password?.requireSpecial ?? undefined,
 					password_pattern: this.configuration.password?.pattern,
 					password_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,
+					password_check_hibp: this.configuration.password?.checkHibp ?? undefined,
 					login_base_backoff: this.configuration.login?.baseBackoff ?? undefined,
 					login_max_backoff: this.configuration.login?.maxBackoff ?? undefined,
 					login_attempt_window: this.configuration.login?.attemptWindow ?? undefined,
 					login_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,
+					login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,
 					login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,
 					login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+					login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,
+					login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,
+					login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,
+					login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,
+					login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,
+					captcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,
+					captcha_secret: captchaSecretCol,
+					captcha_secret_version: captchaSecretVersionCol,
+					captcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,
+					captcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,
+					captcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,
+					captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,
+					captcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,
+					rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,
+					rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,
+					rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,
+					rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,
+					rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,
+					rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,
+					rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,
+					rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,
+					rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,
+					rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,
+					rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,
+					rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,
 				} satisfies {
 					[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined
 				},

package/src/model/commands/configuration/index.ts

@@ -1 +1 @@
-export * from './UpdateConfigurationCommand'
+export * from './UpdateConfigurationCommand.js'

package/src/model/commands/identity/CreateIdentityCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { InsertBuilder } from '@contember/database'
 
 export class CreateIdentityCommand implements Command<string> {

package/src/model/commands/identity/PatchIdentityGlobalRoles.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class PatchIdentityGlobalRoles implements Command<boolean> {

package/src/model/commands/identity/index.ts

@@ -1,2 +1,2 @@
-export * from './CreateIdentityCommand'
-export * from './PatchIdentityGlobalRoles'
+export * from './CreateIdentityCommand.js'
+export * from './PatchIdentityGlobalRoles.js'

package/src/model/commands/idp/ClaimIdpRevalidationCommand.ts

@@ -0,0 +1,28 @@
+import { Command } from '../Command.js'
+
+/**
+ * Atomically claim the right to re-validate a federated session: bump `last_validated_at`
+ * to now() iff the throttle window has elapsed. Returns true only to the single request
+ * that wins the claim, false to everyone else (still inside the window, or lost the race).
+ *
+ * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,
+ * where two concurrent revalidations would rotate the refresh token and invalidate each
+ * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.
+ */
+export class ClaimIdpRevalidationCommand implements Command<boolean> {
+	constructor(
+		private readonly id: string,
+		private readonly interval: string,
+	) {
+	}
+
+	async execute({ db }: Command.Args): Promise<boolean> {
+		const result = await db.query(
+			`UPDATE "idp_session"
+			 SET "last_validated_at" = now()
+			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
+			[this.id, this.interval],
+		)
+		return (result.rowCount ?? 0) > 0
+	}
+}

package/src/model/commands/idp/CreateIdpCommand.ts

@@ -1,6 +1,6 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { InsertBuilder } from '@contember/database'
-import { IdentityProviderData } from '../../type'
+import { IdentityProviderData } from '../../type/index.js'
 
 export class CreateIdpCommand implements Command<void> {
 	constructor(
@@ -9,7 +9,7 @@ export class CreateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data
+		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data
 		await InsertBuilder.create()
 			.into('identity_provider')
 			.values({
@@ -20,6 +20,8 @@ export class CreateIdpCommand implements Command<void> {
 				auto_sign_up: autoSignUp,
 				exclusive,
 				init_returns_config: initReturnsConfig,
+				require_verified_email: requireVerifiedEmail,
+				assume_email_verified: assumeEmailVerified,
 			})
 			.execute(db)
 	}

package/src/model/commands/idp/CreateIdpSessionCommand.ts

@@ -0,0 +1,39 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+import type { IDPSessionState } from '../../service/idp/index.js'
+
+/**
+ * Persist the federated-session state for a freshly created session API key, so it can be
+ * re-validated against the IdP later. The `tokens` blob is encrypted at rest via
+ * `providers.encrypt` (same pattern as project secrets).
+ */
+export class CreateIdpSessionCommand implements Command<void> {
+	constructor(
+		private readonly apiKeyId: string,
+		private readonly identityProviderId: string,
+		private readonly session: IDPSessionState,
+	) {
+	}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const id = providers.uuid()
+		const tokens = this.session.tokens
+			? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))
+			: null
+
+		await InsertBuilder.create()
+			.into('idp_session')
+			.values({
+				id,
+				api_key_id: this.apiKeyId,
+				identity_provider_id: this.identityProviderId,
+				idp_session_id: this.session.sessionId ?? null,
+				tokens: tokens?.value ?? null,
+				tokens_version: tokens?.version ?? null,
+				idp_expires_at: this.session.expiresAt ?? null,
+				token_obtained_at: providers.now(),
+				last_validated_at: providers.now(),
+			})
+			.execute(db)
+	}
+}

package/src/model/commands/idp/DisableIdpCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableIdpCommand implements Command<void> {