@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/src/model/type/AuthLog.ts

@@ -6,9 +6,49 @@ export type AuthActionType =
 	| 'password_reset'
 	| 'password_change'
 	| 'email_change'
+	| 'email_verify_init'
+	| 'email_verify_complete'
+	| 'email_change_init'
+	| 'email_change_complete'
 	| '2fa_disable'
 	| '2fa_enable'
 	| 'passwordless_login_init'
 	| 'passwordless_login_exchange'
 	| 'passwordless_login'
 	| 'person_disable'
+	| 'session_revoked_by_user'
+	| 'forced_sign_out'
+	| 'global_role_grant'
+	| 'global_role_revoke'
+	| 'project_membership_create'
+	| 'project_membership_update'
+	| 'project_membership_remove'
+	| 'api_key_create'
+	| 'api_key_disable'
+	| 'idp_create'
+	| 'idp_update'
+	| 'idp_disable'
+	| 'idp_enable'
+	| 'idp_session_revalidated'
+	| 'idp_session_revoked'
+	| 'idp_session_revalidation_failed'
+	| 'idp_logout_initiated'
+	| 'idp_backchannel_logout'
+	| 'idp_disconnect'
+	| 'project_create'
+	| 'project_update'
+	| 'project_secret_change'
+	| 'mail_template_change'
+	| 'tenant_config_change'
+	| 'person_invite'
+	| 'backup_code_generated'
+	| 'backup_code_used'
+	| 'backup_code_regenerated'
+	| 'email_otp_sent'
+	| 'mfa_enrollment_required'
+	| 'mfa_reset'
+	| 'session_expired_idle'
+	| 'session_policy_applied'
+	| 'auth_policy_change'
+	| 'unusual_login_detected'
+	| 'step_up_required'

package/src/model/type/AuthPolicy.ts

@@ -0,0 +1,32 @@
+import { IPostgresInterval } from 'postgres-interval'
+
+export type AuthPolicyScope = 'global' | 'project'
+
+/** A row of the `auth_policy` table. Intervals come back as {@link IPostgresInterval}, like {@link ConfigRow}. */
+export type AuthPolicyRow = {
+	readonly id: string
+	readonly scope: AuthPolicyScope
+	readonly project_id: string | null
+	readonly roles: string[]
+	readonly mfa_required: boolean | null
+	readonly token_expiration: IPostgresInterval | null
+	readonly idle_timeout: IPostgresInterval | null
+	readonly grace_duration: IPostgresInterval | null
+	readonly remember_me_allowed: boolean | null
+	readonly created_at: Date
+	readonly updated_at: Date
+}
+
+/**
+ * The effective, aggregated policy for an identity. Shared output of
+ * {@link AuthPolicyResolver}: A06 consumes {@link mfaRequired}; A19 will consume
+ * the session fields. Where nothing matches, this is the inert baseline
+ * (`mfaRequired=false`, session fields null).
+ */
+export type EffectivePolicy = {
+	readonly mfaRequired: boolean
+	readonly tokenExpiration: IPostgresInterval | null
+	readonly idleTimeout: IPostgresInterval | null
+	readonly graceDuration: IPostgresInterval | null
+	readonly rememberMeAllowed: boolean | null
+}

package/src/model/type/Config.ts

@@ -1,8 +1,10 @@
-import { ConfigPolicy } from '../../schema'
+import { CaptchaProvider, ConfigPolicy } from '../../schema/index.js'
 import { IPostgresInterval } from 'postgres-interval'
-import { type Config as ConfigSchema } from '../../schema'
-import { Interval } from '../../schema/types'
+import { type Config as ConfigSchema } from '../../schema/index.js'
+import { Interval } from '../../schema/types.js'
 export type ConfigRow = {
+	signup_require_email_verification: boolean
+	require_email_change_verification: boolean
 	passwordless_enabled: ConfigPolicy
 	passwordless_url: string | null
 	passwordless_expiration: IPostgresInterval
@@ -13,19 +15,54 @@ export type ConfigRow = {
 	password_require_special: number
 	password_pattern: string | null
 	password_check_blacklist: boolean
+	password_check_hibp: boolean
 	login_base_backoff: IPostgresInterval
 	login_max_backoff: IPostgresInterval
 	login_attempt_window: IPostgresInterval
 	login_reveal_user_exits: boolean
+	login_reveal_login_method: boolean
 	login_default_token_expiration: IPostgresInterval
 	login_max_token_expiration: IPostgresInterval | null
+	login_mfa_grace_duration: IPostgresInterval
+	login_anomaly_detection_enabled: boolean
+	login_anomaly_history_size: number
+	login_anomaly_email_threshold: number
+	login_anomaly_step_up_threshold: number
+	captcha_provider: CaptchaProvider | null
+	captcha_secret: Buffer | null
+	captcha_secret_version: number | null
+	captcha_threshold: number | null
+	captcha_protect_sign_up: boolean
+	captcha_protect_password_reset: boolean
+	captcha_protect_passwordless_init: boolean
+	captcha_protect_email_verification: boolean
+	rate_limit_sign_up_per_ip_limit: number
+	rate_limit_sign_up_per_ip_window: IPostgresInterval
+	rate_limit_login_per_ip_limit: number
+	rate_limit_login_per_ip_window: IPostgresInterval
+	rate_limit_password_reset_per_ip_limit: number
+	rate_limit_password_reset_per_ip_window: IPostgresInterval
+	rate_limit_passwordless_init_per_ip_limit: number
+	rate_limit_passwordless_init_per_ip_window: IPostgresInterval
+	rate_limit_email_otp_per_person_limit: number
+	rate_limit_email_otp_per_person_window: IPostgresInterval
+	rate_limit_email_verification_per_ip_limit: number
+	rate_limit_email_verification_per_ip_window: IPostgresInterval
 }
 
-export type Config = Omit<
-	{
-		[K in keyof ConfigSchema]: {
-			[K2 in keyof ConfigSchema[K]]: Exclude<ConfigSchema[K][K2], Interval>
-		}
-	},
-	'__typename'
->
+export type Config =
+	& Omit<
+		{
+			[K in keyof ConfigSchema]: {
+				[K2 in keyof ConfigSchema[K]]: Exclude<ConfigSchema[K][K2], Interval>
+			}
+		},
+		'__typename'
+	>
+	& {
+		/**
+		 * Decrypted/plaintext captcha secret. Never exposed through the GraphQL
+		 * schema — only the runtime validator reads it.
+		 */
+		readonly captchaSecret: string | null
+	}

package/src/model/type/IdentityProvider.ts

@@ -9,4 +9,6 @@ export interface IdentityProviderOptions {
 	autoSignUp: boolean
 	exclusive: boolean
 	initReturnsConfig: boolean
+	requireVerifiedEmail: boolean
+	assumeEmailVerified: boolean
 }

package/src/model/type/PersonToken.ts

@@ -1,7 +1,16 @@
 export namespace PersonToken {
-	export type Type = 'password_reset' | 'passwordless'
+	export type Type = 'password_reset' | 'passwordless' | 'mfa_email_otp' | 'email_verification' | 'email_change'
 	export type ValidationType = 'token' | 'otp'
 
+	/**
+	 * Payload carried by an e-mail-bearing token: the address the token is bound
+	 * to. For email_change it is the pending NEW address; for email_verification
+	 * it is the address being verified at the time the token was issued.
+	 */
+	export interface TokenMeta {
+		email: string
+	}
+
 	export interface Row {
 		id: string
 		created_at: Date
@@ -11,6 +20,7 @@ export namespace PersonToken {
 		person_id: string
 		otp_hash: string | null
 		otp_attempts: number
+		meta: TokenMeta | null
 	}
 
 	export type TokenValidationError =

package/src/model/type/RateLimit.ts

@@ -0,0 +1,10 @@
+export const RateLimitScopes = {
+	signUpPerIp: 'sign_up_per_ip',
+	loginPerIp: 'login_per_ip',
+	passwordResetPerIp: 'password_reset_per_ip',
+	passwordlessInitPerIp: 'passwordless_init_per_ip',
+	emailOtpPerPerson: 'email_otp_per_person',
+	emailVerificationPerIp: 'email_verification_per_ip',
+} as const
+
+export type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes]

package/src/model/type/index.ts

@@ -1,5 +1,7 @@
-export * from './ApiKey'
-export * from './IdentityProvider'
-export * from './Project'
-export * from './Variables'
-export * from './PersonToken'
+export * from './ApiKey.js'
+export * from './AuthPolicy.js'
+export * from './Config.js'
+export * from './IdentityProvider.js'
+export * from './Project.js'
+export * from './Variables.js'
+export * from './PersonToken.js'

package/src/model/utils/DatabaseContext.ts

@@ -1,7 +1,7 @@
 import { Client, Connection } from '@contember/database'
-import { Providers } from '../providers'
-import { CommandBus } from '../commands'
-import { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery'
+import { Providers } from '../providers.js'
+import { CommandBus } from '../commands/index.js'
+import { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'
 
 export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	private loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()

package/src/model/utils/index.ts

@@ -1,2 +1,2 @@
-export * from './DatabaseContext'
-export * from './token'
+export * from './DatabaseContext.js'
+export * from './token.js'

package/src/model/utils/interval.ts

@@ -1,5 +1,17 @@
 import { IPostgresInterval } from 'postgres-interval'
 
+/**
+ * Serializes an interval into a Postgres-acceptable string literal for use as a
+ * query parameter (e.g. writing into an INTERVAL column). `postgres-interval`
+ * instances expose `toPostgres()`; we fall back to a seconds literal otherwise.
+ */
+export const intervalToPostgres = (interval: IPostgresInterval): string => {
+	if (typeof interval.toPostgres === 'function') {
+		return interval.toPostgres()
+	}
+	return `${intervalToSeconds(interval)} seconds`
+}
+
 export const intervalToSeconds = (interval: IPostgresInterval): number => {
 	const { months, years, days, hours, minutes, seconds, milliseconds } = interval
 	return (

package/src/model/utils/token.ts

@@ -1,8 +1,8 @@
 import crypto from 'node:crypto'
-import { FixedLengthHexString, isFixedLengthHexString } from './hex'
-import { PersonToken } from '../type'
-import { ImplementationException } from '../../exceptions'
-import { Response, ResponseError, ResponseOk } from './Response'
+import { FixedLengthHexString, isFixedLengthHexString } from './hex.js'
+import { PersonToken } from '../type/index.js'
+import { ImplementationException } from '../../exceptions.js'
+import { Response, ResponseError, ResponseOk } from './Response.js'
 
 export const generateToken = async (generator: {
 	randomBytes: (bytes: number) => Promise<Buffer>
@@ -21,7 +21,21 @@ export const computeTokenHash = (token: string): TokenHash => {
 
 export const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)
 
-const MAX_OTP_ATTEMPTS = 3
+export const MAX_OTP_ATTEMPTS = 3
+
+/**
+ * Constant-time comparison of two token hashes. Both inputs are expected to be
+ * 64-character hex strings (sha256). Returns false on any length mismatch
+ * without leaking timing information about the matching prefix.
+ */
+export const timingSafeCompareHash = (a: TokenHash, b: TokenHash): boolean => {
+	const bufferA = Buffer.from(a, 'hex')
+	const bufferB = Buffer.from(b, 'hex')
+	if (bufferA.length !== bufferB.length) {
+		return false
+	}
+	return crypto.timingSafeEqual(bufferA, bufferB)
+}
 
 export const validateToken = ({ entry, validationType, token, now }: {
 	entry: PersonToken.Row | null

package/src/resolvers/Resolver.ts

@@ -1,4 +1,4 @@
-import * as Schema from '../schema'
+import * as Schema from '../schema/index.js'
 import { IResolvers } from '@graphql-tools/utils'
 
 export interface IgnoreIndex {

package/src/resolvers/ResolverFactory.ts

@@ -7,12 +7,14 @@ import {
 	CreateProjectMutationResolver,
 	DisableApiKeyMutationResolver,
 	DisableIDPMutationResolver,
+	EmailOtpMutationResolver,
 	EnableIDPMutationResolver,
 	IdentityGlobalRolesMutationResolver,
 	IDPMutationResolver,
 	InviteMutationResolver,
 	MailTemplateMutationResolver,
 	OtpMutationResolver,
+	RegenerateBackupCodesMutationResolver,
 	RemoveProjectMemberMutationResolver,
 	ResetPasswordMutationResolver,
 	SetProjectSecretMutationResolver,
@@ -21,20 +23,34 @@ import {
 	SignUpMutationResolver,
 	UpdateProjectMemberMutationResolver,
 	UpdateProjectMutationResolver,
-} from './mutation'
+} from './mutation/index.js'
 
-import { Resolvers } from '../schema'
-import { MeQueryResolver, PersonQueryResolver, ProjectMembersQueryResolver, ProjectQueryResolver } from './query'
-import { IdentityTypeResolver, ProjectTypeResolver } from './types'
+import { Resolvers } from '../schema/index.js'
+import {
+	ApiKeyQueryResolver,
+	AuthLogQueryResolver,
+	MeQueryResolver,
+	PersonQueryResolver,
+	ProjectMembersQueryResolver,
+	ProjectQueryResolver,
+} from './query/index.js'
+import { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js'
+import { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js'
 import { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'
-import { IDPQueryResolver } from './query/IDPQueryResolver'
-import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver'
-import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver'
-import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver'
-import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver'
-import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver'
-import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver'
-import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver'
+import { IDPQueryResolver } from './query/IDPQueryResolver.js'
+import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'
+import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'
+import { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'
+import { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'
+import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'
+import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js'
+import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js'
+import { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js'
+import { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js'
+import { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js'
+import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js'
+import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js'
+import { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js'
 
 class ResolverFactory {
 	public constructor(
@@ -52,14 +68,19 @@ class ResolverFactory {
 			changeProfileMutationResolver: ChangeProfileMutationResolver
 			changePasswordMutationResolver: ChangePasswordMutationResolver
 			resetPasswordMutationResolver: ResetPasswordMutationResolver
+			emailVerificationMutationResolver: EmailVerificationMutationResolver
 			idpMutationResolver: IDPMutationResolver
 			registerIdpMutationResolver: AddIDPMutationResolver
 			disableIdpMutationResolver: DisableIDPMutationResolver
 			enableIdpMutationResolver: EnableIDPMutationResolver
 			updateIdpMutationResolver: UpdateIDPMutationResolver
+			disconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver
 			passwordlessMutationResolver: PasswordlessMutationResolver
 
 			disablePersonMutationResolver: DisablePersonMutationResolver
+			forceSignOutMutationResolver: ForceSignOutMutationResolver
+			resetPersonMfaMutationResolver: ResetPersonMfaMutationResolver
+			revokeSessionMutationResolver: RevokeSessionMutationResolver
 
 			inviteMutationResolver: InviteMutationResolver
 			addProjectMemberMutationResolver: AddProjectMemberMutationResolver
@@ -70,6 +91,8 @@ class ResolverFactory {
 			disableApiKeyMutationResolver: DisableApiKeyMutationResolver
 
 			otpMutationResolver: OtpMutationResolver
+			emailOtpMutationResolver: EmailOtpMutationResolver
+			regenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver
 
 			mailTemplateMutationResolver: MailTemplateMutationResolver
 
@@ -78,6 +101,7 @@ class ResolverFactory {
 			updateProjectMutationResolver: UpdateProjectMutationResolver
 
 			identityTypeResolver: IdentityTypeResolver
+			personTypeResolver: PersonTypeResolver
 			projectTypeResolver: ProjectTypeResolver
 
 			identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver
@@ -85,6 +109,12 @@ class ResolverFactory {
 			configurationMutationResolver: ConfigurationMutationResolver
 			configurationQueryResolver: ConfigurationQueryResolver
 
+			authPolicyMutationResolver: AuthPolicyMutationResolver
+			authPolicyQueryResolver: AuthPolicyQueryResolver
+
+			authLogQueryResolver: AuthLogQueryResolver
+			apiKeyQueryResolver: ApiKeyQueryResolver
+
 			togglePasswordlessMutationResolver: TogglePasswordlessMutationResolver
 		},
 	) {}
@@ -99,20 +129,30 @@ class ResolverFactory {
 				person: this.resolvers.identityTypeResolver.person.bind(this.resolvers.identityTypeResolver),
 				roles: this.resolvers.identityTypeResolver.roles.bind(this.resolvers.identityTypeResolver),
 				permissions: this.resolvers.identityTypeResolver.permissions.bind(this.resolvers.identityTypeResolver),
+				sessions: this.resolvers.identityTypeResolver.sessions.bind(this.resolvers.identityTypeResolver),
+			},
+			Person: {
+				identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),
 			},
 			Project: {
 				members: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),
 				roles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),
+				apiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),
+				secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),
 			},
 			Query: {
 				me: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),
 				personById: this.resolvers.personQueryResolver.personById.bind(this.resolvers.personQueryResolver),
+				persons: this.resolvers.personQueryResolver.persons.bind(this.resolvers.personQueryResolver),
+				globalApiKeys: this.resolvers.apiKeyQueryResolver.globalApiKeys.bind(this.resolvers.apiKeyQueryResolver),
 				projectBySlug: this.resolvers.projectQueryResolver.projectBySlug.bind(this.resolvers.projectQueryResolver),
 				projects: this.resolvers.projectQueryResolver.projects.bind(this.resolvers.projectQueryResolver),
 				projectMemberships: this.resolvers.projectMembersQueryResolver.projectMemberships.bind(this.resolvers.projectMembersQueryResolver),
 				identityProviders: this.resolvers.idpQueryResolver.identityProviders.bind(this.resolvers.idpQueryResolver),
 				mailTemplates: this.resolvers.mailTemplateQueryResolver.mailTemplates.bind(this.resolvers.mailTemplateQueryResolver),
 				configuration: this.resolvers.configurationQueryResolver.configuration.bind(this.resolvers.configurationQueryResolver),
+				authPolicies: this.resolvers.authPolicyQueryResolver.authPolicies.bind(this.resolvers.authPolicyQueryResolver),
+				authLog: this.resolvers.authLogQueryResolver.authLog.bind(this.resolvers.authLogQueryResolver),
 				checkResetPasswordToken: () => {
 					throw new Error('not implemented')
 				},
@@ -132,13 +172,25 @@ class ResolverFactory {
 				),
 				resetPassword: this.resolvers.resetPasswordMutationResolver.resetPassword.bind(this.resolvers.resetPasswordMutationResolver),
 
+				requestEmailVerification: this.resolvers.emailVerificationMutationResolver.requestEmailVerification.bind(
+					this.resolvers.emailVerificationMutationResolver,
+				),
+				verifyEmail: this.resolvers.emailVerificationMutationResolver.verifyEmail.bind(this.resolvers.emailVerificationMutationResolver),
+				confirmEmailChange: this.resolvers.changeProfileMutationResolver.confirmEmailChange.bind(this.resolvers.changeProfileMutationResolver),
+
 				initSignInIDP: this.resolvers.idpMutationResolver.initSignInIDP.bind(this.resolvers.idpMutationResolver),
 				signInIDP: this.resolvers.idpMutationResolver.signInIDP.bind(this.resolvers.idpMutationResolver),
 				addIDP: this.resolvers.registerIdpMutationResolver.addIDP.bind(this.resolvers.registerIdpMutationResolver),
 				disableIDP: this.resolvers.disableIdpMutationResolver.disableIDP.bind(this.resolvers.disableIdpMutationResolver),
 				enableIDP: this.resolvers.enableIdpMutationResolver.enableIDP.bind(this.resolvers.enableIdpMutationResolver),
 				updateIDP: this.resolvers.updateIdpMutationResolver.updateIDP.bind(this.resolvers.updateIdpMutationResolver),
+				disconnectMyIdentityProvider: this.resolvers.disconnectMyIdentityProviderMutationResolver.disconnectMyIdentityProvider.bind(
+					this.resolvers.disconnectMyIdentityProviderMutationResolver,
+				),
 				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
+				forceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),
+				resetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),
+				revokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),
 
 				signInPasswordless: this.resolvers.passwordlessMutationResolver.signInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
 				initSignInPasswordless: this.resolvers.passwordlessMutationResolver.initSignInPasswordless.bind(this.resolvers.passwordlessMutationResolver),
@@ -168,6 +220,13 @@ class ResolverFactory {
 				prepareOtp: this.resolvers.otpMutationResolver.prepareOtp.bind(this.resolvers.otpMutationResolver),
 				confirmOtp: this.resolvers.otpMutationResolver.confirmOtp.bind(this.resolvers.otpMutationResolver),
 				disableOtp: this.resolvers.otpMutationResolver.disableOtp.bind(this.resolvers.otpMutationResolver),
+				regenerateBackupCodes: this.resolvers.regenerateBackupCodesMutationResolver.regenerateBackupCodes.bind(
+					this.resolvers.regenerateBackupCodesMutationResolver,
+				),
+
+				initEmailOtp: this.resolvers.emailOtpMutationResolver.initEmailOtp.bind(this.resolvers.emailOtpMutationResolver),
+				confirmEmailOtp: this.resolvers.emailOtpMutationResolver.confirmEmailOtp.bind(this.resolvers.emailOtpMutationResolver),
+				disableEmailOtp: this.resolvers.emailOtpMutationResolver.disableEmailOtp.bind(this.resolvers.emailOtpMutationResolver),
 
 				addMailTemplate: this.resolvers.mailTemplateMutationResolver.addMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),
 				removeMailTemplate: this.resolvers.mailTemplateMutationResolver.removeMailTemplate.bind(this.resolvers.mailTemplateMutationResolver),
@@ -187,6 +246,10 @@ class ResolverFactory {
 				),
 
 				configure: this.resolvers.configurationMutationResolver.configure.bind(this.resolvers.configurationMutationResolver),
+
+				createAuthPolicy: this.resolvers.authPolicyMutationResolver.createAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
+				updateAuthPolicy: this.resolvers.authPolicyMutationResolver.updateAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
+				deleteAuthPolicy: this.resolvers.authPolicyMutationResolver.deleteAuthPolicy.bind(this.resolvers.authPolicyMutationResolver),
 			},
 		}
 	}

package/src/resolvers/TenantResolverContext.ts

@@ -1,9 +1,17 @@
-import { DatabaseContext, Identity, PermissionContext } from '../model'
+import { DatabaseContext, Identity, PermissionContext } from '../model/index.js'
 import { Logger } from '@contember/logger'
-import { AuthLogService } from '../model/service/AuthLogService'
+import { AuthLogService } from '../model/service/AuthLogService.js'
+
+export interface TenantResolverHttpInfo {
+	readonly ip: string
+	readonly userAgent?: string
+	/** A03: country from the trusted reverse-proxy geo header, when present + trusted. */
+	readonly geoCountry?: string
+}
 
 export interface TenantResolverContext {
 	readonly apiKeyId: string
+	readonly trustForwardedInfo: boolean
 	readonly permissionContext: PermissionContext
 	readonly identity: Identity
 	readonly isAllowed: PermissionContext['isAllowed']
@@ -11,4 +19,5 @@ export interface TenantResolverContext {
 	readonly db: DatabaseContext
 	readonly logger: Logger
 	readonly logAuthAction: (entry: AuthLogService.LogArgs) => Promise<void>
+	readonly httpInfo: TenantResolverHttpInfo
 }

package/src/resolvers/TenantResolverContextFactory.ts

@@ -1,15 +1,17 @@
-import { TenantResolverContext } from './TenantResolverContext'
-import { DatabaseContext, PermissionContext, PermissionContextFactory } from '../model'
+import { TenantResolverContext } from './TenantResolverContext.js'
+import { DatabaseContext, LoginRiskAnalyzer, PermissionContext, PermissionContextFactory } from '../model/index.js'
 import { Logger } from '@contember/logger'
-import { AuthLogService } from '../model/service/AuthLogService'
+import { AuthLogService } from '../model/service/AuthLogService.js'
 
-export const createResolverContext = (permissionContext: PermissionContext, apiKeyId: string) => {
+export const createResolverContext = (permissionContext: PermissionContext, apiKeyId: string, trustForwardedInfo = false) => {
 	return {
 		apiKeyId: apiKeyId,
+		trustForwardedInfo,
 		permissionContext,
 		identity: permissionContext.identity,
 		isAllowed: permissionContext.isAllowed.bind(permissionContext),
 		requireAccess: permissionContext.requireAccess.bind(permissionContext),
+		httpInfo: { ip: '' },
 	}
 }
 
@@ -17,11 +19,12 @@ export class TenantResolverContextFactory {
 	constructor(
 		private readonly permissionContextFactory: PermissionContextFactory,
 		private readonly authLogService: AuthLogService,
+		private readonly loginRiskAnalyzer: LoginRiskAnalyzer,
 	) {}
 
 	public create(
-		authContext: { apiKeyId: string; identityId: string; roles: string[] },
-		httpInfo: { ip: string; userAgent?: string },
+		authContext: { apiKeyId: string; identityId: string; roles: string[]; trustForwardedInfo?: boolean },
+		httpInfo: { ip: string; userAgent?: string; forwarderIp?: string; forwarderUserAgent?: string; geoCountry?: string },
 		db: DatabaseContext,
 		logger: Logger,
 	): TenantResolverContext {
@@ -29,15 +32,27 @@ export class TenantResolverContextFactory {
 			id: authContext.identityId,
 			roles: authContext.roles,
 		})
+		// A03: stamp every auth-log row with the trusted geo country (when present)
+		// and a UA fingerprint, so the next sign-in's anomaly check has a baseline.
+		const deviceFingerprint = this.loginRiskAnalyzer.fingerprint(httpInfo.userAgent) ?? undefined
 		return {
-			...createResolverContext(permissionContext, authContext.apiKeyId),
+			...createResolverContext(permissionContext, authContext.apiKeyId, authContext.trustForwardedInfo ?? false),
 			logAuthAction: async data => {
 				await this.authLogService.logAuthAction(db, {
 					identityId: authContext.identityId,
 					userAgent: httpInfo.userAgent,
 					clientIp: httpInfo.ip,
+					forwarderIp: httpInfo.forwarderIp,
+					forwarderUserAgent: httpInfo.forwarderUserAgent,
+					geoCountry: httpInfo.geoCountry,
+					deviceFingerprint,
 				}, data)
 			},
+			httpInfo: {
+				ip: httpInfo.ip,
+				userAgent: httpInfo.userAgent,
+				geoCountry: httpInfo.geoCountry,
+			},
 			db,
 			logger,
 		}

package/src/resolvers/errorUtils.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '../model/utils/Response'
+import { ResponseError } from '../model/utils/Response.js'
 
 type Error<T> = { code: T; developerMessage: string }
 type ErrorResponse<T, Meta = {}> = { ok: false; error: Error<T> & Meta; errors: [Error<T> & Meta] }

package/src/resolvers/index.ts

@@ -1,6 +1,6 @@
-export * from './mutation'
-export * from './query'
-export * from './types'
-export * from './TenantResolverContext'
-export * from './ResolverFactory'
-export * from './TenantResolverContextFactory'
+export * from './mutation/index.js'
+export * from './query/index.js'
+export * from './types/index.js'
+export * from './TenantResolverContext.js'
+export * from './ResolverFactory.js'
+export * from './TenantResolverContextFactory.js'

package/src/resolvers/membershipUtils.ts

@@ -1,5 +1,5 @@
-import { MembershipValidationError, MembershipValidationErrorType } from '../model/service/MembershipValidator'
-import { MembershipValidationError as MembershipValidationErrorSchema, MembershipValidationErrorCode } from '../schema'
+import { MembershipValidationError, MembershipValidationErrorType } from '../model/service/MembershipValidator.js'
+import { MembershipValidationError as MembershipValidationErrorSchema, MembershipValidationErrorCode } from '../schema/index.js'
 
 export type MembershipErrorCode =
 	| 'INVALID_MEMBERSHIP'