@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts

@@ -4,13 +4,15 @@ import {
 	MutationCreateApiKeyArgs,
 	MutationCreateGlobalApiKeyArgs,
 	MutationResolvers,
-} from '../../../schema'
+} from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model'
-import { createMembershipValidationErrorResult } from '../../membershipUtils'
-import { createProjectNotFoundResponse } from '../../errorUtils'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'
+import { createMembershipValidationErrorResult } from '../../membershipUtils.js'
+import { createProjectNotFoundResponse } from '../../errorUtils.js'
 import { UserInputError } from '@contember/graphql-utils'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { Acl, JSONValue } from '@contember/schema'
 
 export class CreateApiKeyMutationResolver implements MutationResolvers {
 	constructor(
@@ -21,7 +23,7 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 
 	async createApiKey(
 		parent: any,
-		{ projectSlug, memberships, description, tokenHash }: MutationCreateApiKeyArgs,
+		{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
@@ -47,7 +49,27 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 			}
 		}
 
-		const result = await this.apiKeyManager.createProjectPermanentApiKey(context.db, project.id, memberships, description, tokenHash ?? undefined)
+		const result = await this.apiKeyManager.createProjectPermanentApiKey(
+			context.db,
+			project.id,
+			memberships,
+			description,
+			tokenHash ?? undefined,
+			options?.trustForwardedClientInfo === true,
+		)
+
+		await context.logAuthAction({
+			type: 'api_key_create',
+			response: new ResponseOk(null),
+			eventData: {
+				scope: 'project',
+				projectSlug: project.slug,
+				apiKeyId: result.result.apiKey.id,
+				identityId: result.result.identity.id,
+				description,
+				memberships: memberships.map(membershipToJson),
+			},
+		})
 
 		return {
 			ok: true,
@@ -60,7 +82,7 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 
 	async createGlobalApiKey(
 		parent: any,
-		{ roles, description, tokenHash }: MutationCreateGlobalApiKeyArgs,
+		{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
@@ -72,7 +94,26 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 		if (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {
 			throw new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')
 		}
-		const result = await this.apiKeyManager.createGlobalPermanentApiKey(context.db, description, roles, tokenHash ?? undefined)
+		const result = await this.apiKeyManager.createGlobalPermanentApiKey(
+			context.db,
+			description,
+			roles,
+			tokenHash ?? undefined,
+			options?.trustForwardedClientInfo === true,
+		)
+
+		await context.logAuthAction({
+			type: 'api_key_create',
+			response: new ResponseOk(null),
+			eventData: {
+				scope: 'global',
+				apiKeyId: result.result.apiKey.id,
+				identityId: result.result.identity.id,
+				description,
+				roles: [...roles],
+			},
+		})
+
 		return {
 			ok: true,
 			errors: [],
@@ -82,3 +123,8 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 		}
 	}
 }
+
+const membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({
+	role,
+	variables: variables.map(({ name, values }) => ({ name, values: [...values] })),
+})

package/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts

@@ -1,8 +1,9 @@
-import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema'
+import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ApiKeyManager, PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ApiKeyManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class DisableApiKeyMutationResolver implements MutationResolvers {
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
@@ -24,6 +25,12 @@ export class DisableApiKeyMutationResolver implements MutationResolvers {
 			return createErrorResponse('KEY_NOT_FOUND', 'API key not found')
 		}
 
+		await context.logAuthAction({
+			type: 'api_key_disable',
+			response: new ResponseOk(null),
+			eventData: { apiKeyId: id },
+		})
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/apiKey/index.ts

@@ -1,2 +1,2 @@
-export * from './CreateApiKeyMutationResolver'
-export * from './DisableApiKeyMutationResolver'
+export * from './CreateApiKeyMutationResolver.js'
+export * from './DisableApiKeyMutationResolver.js'

package/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts

@@ -0,0 +1,125 @@
+import {
+	AuthPolicyInput,
+	CreateAuthPolicyResponse,
+	DeleteAuthPolicyResponse,
+	MutationCreateAuthPolicyArgs,
+	MutationDeleteAuthPolicyArgs,
+	MutationResolvers,
+	MutationUpdateAuthPolicyArgs,
+	UpdateAuthPolicyResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { AuthPolicyManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { JSONValue } from '@contember/schema'
+
+/**
+ * CRUD over `auth_policy` (per-role MFA / session policy). Gated like
+ * `configure` (a tenant-wide admin action). Every mutation audits
+ * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.
+ */
+export class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {
+	constructor(
+		private readonly authPolicyManager: AuthPolicyManager,
+	) {}
+
+	async createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'create',
+				id: result.result.id,
+				policy: snapshotInput(policy),
+			},
+		})
+
+		return { ok: true, result: { id: result.result.id } }
+	}
+
+	async updateAuthPolicy(
+		parent: any,
+		{ id, policy }: MutationUpdateAuthPolicyArgs,
+		context: TenantResolverContext,
+	): Promise<UpdateAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'update',
+				id,
+				policy: snapshotInput(policy),
+			},
+		})
+
+		return { ok: true }
+	}
+
+	async deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.deletePolicy(context.db, id)
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'delete',
+				id,
+			},
+		})
+
+		return { ok: true }
+	}
+
+	private mapInput(policy: AuthPolicyInput) {
+		return {
+			scope: policy.scope,
+			project: policy.project ?? null,
+			roles: [...policy.roles],
+			mfaRequired: policy.mfaRequired ?? null,
+			tokenExpiration: policy.tokenExpiration ?? null,
+			idleTimeout: policy.idleTimeout ?? null,
+			graceDuration: policy.mfaGraceDuration ?? null,
+			rememberMeAllowed: policy.rememberMeAllowed ?? null,
+		}
+	}
+}
+
+const snapshotInput = (policy: AuthPolicyInput): JSONValue => ({
+	scope: policy.scope,
+	project: policy.project ?? null,
+	roles: [...policy.roles],
+	mfaRequired: policy.mfaRequired ?? null,
+	tokenExpiration: policy.tokenExpiration ?? null,
+	idleTimeout: policy.idleTimeout ?? null,
+	mfaGraceDuration: policy.mfaGraceDuration ?? null,
+	rememberMeAllowed: policy.rememberMeAllowed ?? null,
+})

package/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts

@@ -1,8 +1,10 @@
-import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'
-import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { JSONValue } from '@contember/schema'
 
 export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {
 	constructor(
@@ -22,8 +24,34 @@ export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'c
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await context.logAuthAction({
+			type: 'tenant_config_change',
+			response: new ResponseOk(null),
+			eventData: {
+				input: redactConfigInput(config),
+			},
+		})
+
 		return {
 			ok: true,
 		}
 	}
 }
+
+/**
+ * Strip secret-bearing fields from a ConfigInput before it lands in the
+ * persistent audit trail. The mere fact that captcha.secret was set is
+ * useful forensics; the value never is.
+ */
+const redactConfigInput = (input: ConfigInput): JSONValue => {
+	const out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }
+	if (input.captcha) {
+		out.captcha = {
+			...(input.captcha as unknown as Record<string, JSONValue>),
+			secret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''
+				? '***'
+				: input.captcha.secret ?? null,
+		}
+	}
+	return out as JSONValue
+}

package/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts

@@ -4,12 +4,14 @@ import {
 	MutationRemoveGlobalIdentityRolesArgs,
 	MutationResolvers,
 	RemoveGlobalIdentityRolesResponse,
-} from '../../../schema'
+} from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
-import { RolesManager } from '../../../model'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions, RolesManager } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'
+import { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 	constructor(
@@ -28,16 +30,19 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to add global roles',
 		})
 
+		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
 		const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await this.logRolesChange(context, identityId, 'global_role_grant', before?.roles ?? [])
+
 		return {
 			ok: true,
 			result: {
-				identity: { id: identityId, projects: [] },
+				identity: { id: identityId, projects: [], sessions: [] },
 			},
 		}
 	}
@@ -53,17 +58,39 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to remove global roles',
 		})
 
+		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
 		const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await this.logRolesChange(context, identityId, 'global_role_revoke', before?.roles ?? [])
+
 		return {
 			ok: true,
 			result: {
-				identity: { id: identityId, projects: [] },
+				identity: { id: identityId, projects: [], sessions: [] },
 			},
 		}
 	}
+
+	private async logRolesChange(
+		context: TenantResolverContext,
+		identityId: string,
+		auditType: 'global_role_grant' | 'global_role_revoke',
+		beforeRoles: readonly string[],
+	): Promise<void> {
+		const [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
+		const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))
+		await context.logAuthAction({
+			type: auditType,
+			response: new ResponseOk(null),
+			targetPersonId: targetPerson?.id,
+			eventData: {
+				before: { roles: beforeRoles },
+				after: { roles: after?.roles ?? [] },
+			},
+		})
+	}
 }

package/src/resolvers/mutation/identity/index.ts

@@ -1 +1 @@
-export * from './GlobalRolesMutationResolver'
+export * from './GlobalRolesMutationResolver.js'

package/src/resolvers/mutation/idp/AddIDPMutationResolver.ts

@@ -1,8 +1,11 @@
-import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema'
-import { PermissionActions } from '../../../model'
-import { IDPManager } from '../../../model/service/idp/IDPManager'
-import { createErrorResponse } from '../../errorUtils'
-import { TenantResolverContext } from '../../TenantResolverContext'
+import { AddIdpResponse, MutationAddIdpArgs, MutationResolvers } from '../../../schema/index.js'
+import { PermissionActions } from '../../../model/index.js'
+import { IDPManager } from '../../../model/service/idp/IDPManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'
+import { idpRowToAuditSnapshot } from './audit.js'
 
 export class AddIDPMutationResolver implements MutationResolvers {
 	constructor(private readonly idpManager: IDPManager) {
@@ -21,12 +24,25 @@ export class AddIDPMutationResolver implements MutationResolvers {
 				autoSignUp: args.options?.autoSignUp ?? false,
 				exclusive: args.options?.exclusive ?? false,
 				initReturnsConfig: args.options?.initReturnsConfig ?? false,
+				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
+				assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
 			},
 		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		const after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))
+		await context.logAuthAction({
+			type: 'idp_create',
+			response: new ResponseOk(null),
+			eventData: {
+				slug: args.identityProvider,
+				before: null,
+				after: idpRowToAuditSnapshot(after),
+			},
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/idp/DisableIDPMutationResolver.ts

@@ -1,8 +1,9 @@
-import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema'
-import { PermissionActions } from '../../../model'
-import { IDPManager } from '../../../model/service/idp/IDPManager'
-import { createErrorResponse } from '../../errorUtils'
-import { TenantResolverContext } from '../../TenantResolverContext'
+import { DisableIdpResponse, MutationDisableIdpArgs, MutationResolvers } from '../../../schema/index.js'
+import { PermissionActions } from '../../../model/index.js'
+import { IDPManager } from '../../../model/service/idp/IDPManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class DisableIDPMutationResolver implements MutationResolvers {
 	constructor(private readonly idpManager: IDPManager) {
@@ -18,6 +19,12 @@ export class DisableIDPMutationResolver implements MutationResolvers {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await context.logAuthAction({
+			type: 'idp_disable',
+			response: new ResponseOk(null),
+			eventData: { slug: args.identityProvider },
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.ts

@@ -0,0 +1,42 @@
+import { DisconnectIdpResponse, MutationDisconnectMyIdentityProviderArgs, MutationResolvers } from '../../../schema/index.js'
+import { PermissionActions, PersonIdentityProviderManager, PersonQuery } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+
+export class DisconnectMyIdentityProviderMutationResolver implements Pick<MutationResolvers, 'disconnectMyIdentityProvider'> {
+	constructor(
+		private readonly personIdentityProviderManager: PersonIdentityProviderManager,
+	) {
+	}
+
+	async disconnectMyIdentityProvider(
+		parent: unknown,
+		args: MutationDisconnectMyIdentityProviderArgs,
+		context: TenantResolverContext,
+	): Promise<DisconnectIdpResponse> {
+		await context.requireAccess({
+			action: PermissionActions.PERSON_DISCONNECT_MY_IDP,
+			message: 'You are not allowed to disconnect your identity provider',
+		})
+
+		const person = await context.db.queryHandler.fetch(PersonQuery.byIdentity(context.identity.id))
+		if (!person) {
+			return createErrorResponse('NOT_A_PERSON', 'Only a person can disconnect an identity provider.')
+		}
+
+		const result = await this.personIdentityProviderManager.disconnectIdentityProvider(context.db, person, args.id)
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'idp_disconnect',
+			response: new ResponseOk(null),
+			personId: person.id,
+			eventData: { id: args.id, slug: result.result.slug },
+		})
+
+		return { ok: true }
+	}
+}

package/src/resolvers/mutation/idp/EnableIDPMutationResolver.ts

@@ -1,9 +1,10 @@
-import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema'
+import { EnableIdpResponse, MutationEnableIdpArgs, MutationResolvers } from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { PermissionActions } from '../../../model'
-import { IDPManager } from '../../../model/service/idp/IDPManager'
-import { createErrorResponse } from '../../errorUtils'
-import { TenantResolverContext } from '../../TenantResolverContext'
+import { PermissionActions } from '../../../model/index.js'
+import { IDPManager } from '../../../model/service/idp/IDPManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class EnableIDPMutationResolver implements MutationResolvers {
 	constructor(private readonly idpManager: IDPManager) {
@@ -19,6 +20,12 @@ export class EnableIDPMutationResolver implements MutationResolvers {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await context.logAuthAction({
+			type: 'idp_enable',
+			response: new ResponseOk(null),
+			eventData: { slug: args.identityProvider },
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -1,8 +1,11 @@
-import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema'
-import { PermissionActions } from '../../../model'
-import { IDPManager } from '../../../model/service/idp/IDPManager'
-import { createErrorResponse } from '../../errorUtils'
-import { TenantResolverContext } from '../../TenantResolverContext'
+import { MutationResolvers, MutationUpdateIdpArgs, UpdateIdpResponse } from '../../../schema/index.js'
+import { PermissionActions } from '../../../model/index.js'
+import { IDPManager } from '../../../model/service/idp/IDPManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { IdentityProviderBySlugQuery } from '../../../model/queries/index.js'
+import { idpRowToAuditSnapshot } from './audit.js'
 
 export class UpdateIDPMutationResolver implements MutationResolvers {
 	constructor(private readonly idpManager: IDPManager) {
@@ -13,6 +16,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 			action: PermissionActions.IDP_UPDATE,
 			message: 'You are not allowed to update IDP',
 		})
+		const before = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))
 		const result = await this.idpManager.updateIDP(context.db, args.identityProvider, {
 			configuration: args.configuration as any,
 			type: args.type ?? undefined,
@@ -20,12 +24,25 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 				autoSignUp: args.options?.autoSignUp ?? undefined,
 				exclusive: args.options?.exclusive ?? undefined,
 				initReturnsConfig: args.options?.initReturnsConfig ?? undefined,
+				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,
+				assumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,
 			},
 		}, args.mergeConfiguration ?? false)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		const after = await context.db.queryHandler.fetch(new IdentityProviderBySlugQuery(args.identityProvider))
+		await context.logAuthAction({
+			type: 'idp_update',
+			response: new ResponseOk(null),
+			eventData: {
+				slug: args.identityProvider,
+				before: idpRowToAuditSnapshot(before),
+				after: idpRowToAuditSnapshot(after),
+			},
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/idp/audit.ts

@@ -0,0 +1,19 @@
+import { JSONValue } from '@contember/schema'
+import { IdentityProviderRow } from '../../../model/queries/idp/types.js'
+
+export const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValue => {
+	if (!row) {
+		return null
+	}
+	return {
+		slug: row.slug,
+		type: row.type,
+		disabledAt: row.disabledAt ? row.disabledAt.toISOString() : null,
+		autoSignUp: row.autoSignUp,
+		exclusive: row.exclusive,
+		initReturnsConfig: row.initReturnsConfig,
+		requireVerifiedEmail: row.requireVerifiedEmail,
+		assumeEmailVerified: row.assumeEmailVerified,
+		configurationKeys: Object.keys(row.configuration).sort(),
+	}
+}

package/src/resolvers/mutation/idp/index.ts

@@ -1,3 +1,4 @@
-export * from './DisableIDPMutationResolver'
-export * from './EnableIDPMutationResolver'
-export * from './AddIDPMutationResolver'
+export * from './DisableIDPMutationResolver.js'
+export * from './EnableIDPMutationResolver.js'
+export * from './AddIDPMutationResolver.js'
+export * from './DisconnectMyIdentityProviderMutationResolver.js'

package/src/resolvers/mutation/index.ts

@@ -1,7 +1,7 @@
-export * from './apiKey'
-export * from './identity'
-export * from './idp'
-export * from './mailTemplates'
-export * from './person'
-export * from './project'
-export * from './projectMember'
+export * from './apiKey/index.js'
+export * from './identity/index.js'
+export * from './idp/index.js'
+export * from './mailTemplates/index.js'
+export * from './person/index.js'
+export * from './project/index.js'
+export * from './projectMember/index.js'