@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/tests/cases/integration/mocked/sql/generateBackupCodesSql.ts

@@ -0,0 +1,35 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+import { testUuid } from '../../../../src/testUuid.js'
+import { now } from '../../../../src/testTenant.js'
+import { sqlTransaction } from './sqlTransaction.js'
+
+/**
+ * Mocks the SQL emitted by BackupCodeManager.generate: delete the old set, then
+ * insert 10 fresh codes. With the test providers (randomBytes => all zeros) every
+ * generated code is "aaaaa-aaaaa", whose normalized sha256 hash is constant.
+ */
+const CODE_HASH = 'bf2cb58a68f684d95a3b78ef8f661c9a4e5b09e82cc8f9cc88cce90528caeb27'
+
+export const generateBackupCodesSql = (args: {
+	personId: string
+	/** First uuid the manager will consume for the inserts (sequential from here). */
+	firstUuidIndex: number
+}): ExpectedQuery[] => {
+	// generate() replaces the whole set inside a single REPEATABLE READ transaction.
+	const inner: ExpectedQuery[] = [
+		{
+			sql: SQL`DELETE FROM "tenant"."person_backup_code" WHERE "person_id" = ?`,
+			parameters: [args.personId],
+			response: { rowCount: 0 },
+		},
+	]
+	for (let i = 0; i < 10; i++) {
+		inner.push({
+			sql: SQL`INSERT INTO "tenant"."person_backup_code" ("id", "person_id", "code_hash", "created_at") VALUES (?, ?, ?, ?)`,
+			parameters: [testUuid(args.firstUuidIndex + i), args.personId, CODE_HASH, now],
+			response: { rowCount: 1 },
+		})
+	}
+	return sqlTransaction(...inner)
+}

package/tests/cases/integration/mocked/sql/getApiKeySql.ts

@@ -1,13 +1,13 @@
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 import { ExpectedQuery } from '@contember/database-tester'
-import { ApiKey } from '../../../../../src'
+import { ApiKey } from '../../../../../src/index.js'
 
 export const getApiKeySql = (args: {
 	apiKeyId: string
-	response: { identityId: string; personId: string; apiKeyType: ApiKey.Type }
+	response: { identityId: string; personId: string; apiKeyType: ApiKey.Type; trustForwardedInfo?: boolean }
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id"
+		SQL`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at"
 		from "tenant"."api_key"
     	inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id"
     	left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id"
@@ -26,6 +26,13 @@ export const getApiKeySql = (args: {
 					expiration: null,
 					roles: [],
 					person_id: args.response.personId,
+					last_ip: null,
+					last_user_agent: null,
+					last_used_at: null,
+					trust_forwarded_info: args.response.trustForwardedInfo ?? false,
+					issued_at: null,
+					idle_timeout: null,
+					max_expires_at: null,
 				},
 			]
 			: [],

package/tests/cases/integration/mocked/sql/getConfigSql.ts

@@ -1,12 +1,17 @@
 import { ExpectedQuery } from '@contember/database-tester'
 import PostgresInterval from 'postgres-interval'
-export const getConfigSql = (): ExpectedQuery => ({
+export const getConfigSql = (overrides: Record<string, unknown> = {}): ExpectedQuery => ({
 	sql: `select *  from "tenant"."config"`,
 	parameters: [],
 	response: {
 		rows: [
 			{
 				id: 'b65949a6-b481-40b5-a0ed-0acdb5a24cb6',
+				signup_require_email_verification: false,
+				// Both verification flags default to the feature-off state, matching
+				// the real DB column defaults (DEFAULT FALSE). Tests that exercise a
+				// verification flow opt in explicitly via an override.
+				require_email_change_verification: false,
 				passwordless_enabled: 'never',
 				passwordless_url: null,
 				passwordless_expiration: PostgresInterval('00:10:00'),
@@ -17,12 +22,44 @@ export const getConfigSql = (): ExpectedQuery => ({
 				password_require_special: 0,
 				password_pattern: null,
 				password_check_blacklist: true,
+				password_check_hibp: false,
 				login_base_backoff: PostgresInterval('00:00:01'),
 				login_max_backoff: PostgresInterval('00:01:00'),
 				login_attempt_window: PostgresInterval('00:05:00'),
 				login_reveal_user_exits: true,
+				login_reveal_login_method: true,
 				login_default_token_expiration: PostgresInterval('00:30:00'),
 				login_max_token_expiration: PostgresInterval('12:00:00'),
+				login_mfa_grace_duration: PostgresInterval('00:00:00'),
+				// A03 anomaly detection — feature-off defaults (matches column defaults).
+				// Tests that exercise the feature override these explicitly.
+				login_anomaly_detection_enabled: false,
+				login_anomaly_history_size: 10,
+				login_anomaly_email_threshold: 1,
+				login_anomaly_step_up_threshold: 3,
+				captcha_provider: null,
+				captcha_secret: null,
+				captcha_secret_version: null,
+				captcha_threshold: null,
+				rate_limit_sign_up_per_ip_limit: 0,
+				rate_limit_sign_up_per_ip_window: PostgresInterval('01:00:00'),
+				rate_limit_login_per_ip_limit: 0,
+				rate_limit_login_per_ip_window: PostgresInterval('01:00:00'),
+				rate_limit_password_reset_per_ip_limit: 0,
+				rate_limit_password_reset_per_ip_window: PostgresInterval('01:00:00'),
+				rate_limit_passwordless_init_per_ip_limit: 0,
+				rate_limit_passwordless_init_per_ip_window: PostgresInterval('01:00:00'),
+				rate_limit_email_otp_per_person_limit: 10,
+				rate_limit_email_otp_per_person_window: PostgresInterval('00:10:00'),
+				rate_limit_email_verification_per_ip_limit: 0,
+				rate_limit_email_verification_per_ip_window: PostgresInterval('01:00:00'),
+				// Per-flow captcha enforcement. The historically-protected flows
+				// default ON; email verification is opt-in (matches column defaults).
+				captcha_protect_sign_up: true,
+				captcha_protect_password_reset: true,
+				captcha_protect_passwordless_init: true,
+				captcha_protect_email_verification: false,
+				...overrides,
 			},
 		],
 	},

package/tests/cases/integration/mocked/sql/getIdentityByIdSql.ts

@@ -0,0 +1,14 @@
+import { SQL } from '../../../../src/tags.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+/**
+ * IdentityQuery used by ApiKeyManager.createSessionApiKey to fetch the
+ * identity's global roles for A19 session-policy resolution.
+ */
+export const getIdentityByIdSql = (args: { identityId: string; roles?: string[] }): ExpectedQuery => ({
+	sql: SQL`select "id", "description", "roles" from "tenant"."identity" where "id" in (?)`,
+	parameters: [args.identityId],
+	response: {
+		rows: [{ id: args.identityId, description: null, roles: args.roles ?? [] }],
+	},
+})

package/tests/cases/integration/mocked/sql/getIdentityProjectsSql.ts

@@ -1,4 +1,4 @@
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 
 export const getIdentityProjectsSql = function({ identityId, projectId }: { identityId: string; projectId: string }) {
 	return {

package/tests/cases/integration/mocked/sql/getIdpBySlugSql.ts

@@ -1,13 +1,13 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
-import { IdentityProviderRow } from '../../../../../src/model/queries/idp/types'
+import { SQL } from '../../../../src/tags.js'
+import { IdentityProviderRow } from '../../../../../src/model/queries/idp/types.js'
 
 export const getIdpBySlugSql = (args: {
 	slug: string
 	response: null | IdentityProviderRow
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig"
+		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"
 		from "tenant"."identity_provider"
 		where "slug" = ?`,
 	parameters: [args.slug],

package/tests/cases/integration/mocked/sql/getIdpSessionByApiKeySql.ts

@@ -0,0 +1,54 @@
+import { SQL } from '../../../../src/tags.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+/**
+ * Mocks {@link IdpSessionByApiKeyQuery} — the lookup the sign-out flow runs to discover whether a
+ * session was federated (and which IdP) so it can build an RP-initiated logout URL (A10).
+ */
+export const getIdpSessionByApiKeySql = (args: {
+	apiKeyId: string
+	response: null | {
+		id: string
+		identityProviderId: string
+		providerType: string
+		providerConfiguration: Record<string, unknown>
+		providerDisabledAt?: Date | null
+		idpSessionId?: string | null
+		/** Encrypted token blob; pair with a `decrypt` provider override to surface tokens. */
+		tokens?: Buffer | null
+		tokensVersion?: number | null
+	}
+}): ExpectedQuery => ({
+	sql: SQL`
+		select "idp_session"."id", "idp_session"."identity_provider_id", "idp_session"."idp_session_id",
+			"idp_session"."tokens", "idp_session"."tokens_version", "idp_session"."idp_expires_at",
+			"idp_session"."token_obtained_at", "idp_session"."last_validated_at", "idp_session"."created_at",
+			"identity_provider"."type" as "provider_type", "identity_provider"."configuration" as "provider_configuration",
+			"identity_provider"."disabled_at" as "provider_disabled_at"
+		from "tenant"."idp_session"
+		inner join "tenant"."identity_provider" as "identity_provider"
+			on "idp_session"."identity_provider_id" = "identity_provider"."id"
+		where "api_key_id" = ?
+	`,
+	parameters: [args.apiKeyId],
+	response: {
+		rows: args.response
+			? [
+				{
+					id: args.response.id,
+					identity_provider_id: args.response.identityProviderId,
+					idp_session_id: args.response.idpSessionId ?? null,
+					tokens: args.response.tokens ?? null,
+					tokens_version: args.response.tokensVersion ?? null,
+					idp_expires_at: null,
+					token_obtained_at: null,
+					last_validated_at: new Date(),
+					created_at: new Date(),
+					provider_type: args.response.providerType,
+					provider_configuration: args.response.providerConfiguration,
+					provider_disabled_at: args.response.providerDisabledAt ?? null,
+				},
+			]
+			: [],
+	},
+})

package/tests/cases/integration/mocked/sql/getNextMailAttemptSql.ts

@@ -0,0 +1,30 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { now } from '../../../../src/testTenant.js'
+
+export const getNextMailAttemptSql = (args: {
+	email: string
+	initType: string
+	completionType: string
+	response?: ExpectedQuery['response']
+}): ExpectedQuery => ({
+	sql:
+		`with "cfg" as (select *  from "tenant"."config"), "last_completion" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select
+						GREATEST(
+							COALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),
+							NOW() - cfg.login_attempt_window
+						) as "start_time"  from "cfg", "last_completion"), "attempts" as (select COUNT(*) as "attempts", MAX(person_auth_log.created_at) as "last_attempt"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select
+					CASE WHEN attempts.attempts = 0
+					THEN NOW()
+					ELSE LEAST(
+						attempts.last_attempt + cfg.login_max_backoff,
+						attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+					) END as "next_allowed_attempt"  from "attempts", "cfg"`,
+	parameters: [args.completionType, true, args.email, args.email, args.initType, true],
+	// Default = "not rate-limited": a `next_allowed_attempt` at the mocked `now`,
+	// so the manager's `nextAllowed > providers.now()` check is false. (An empty
+	// result set would make the query fall back to a real `new Date()`, which is
+	// in the future relative to the mocked clock and would read as rate-limited.)
+	response: args.response ?? {
+		rows: [{ next_allowed_attempt: now }],
+	},
+})

package/tests/cases/integration/mocked/sql/getPersonByEmailSql.ts

@@ -1,14 +1,29 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
+import { Buffer } from 'buffer'
 
 export const getPersonByEmailSql = (args: {
 	email: string
-	response: null | { personId: string; password: string; identityId: string; roles: string[]; otpUri?: string }
+	response:
+		| null
+		| {
+			personId: string
+			password: string
+			identityId: string
+			roles: string[]
+			otpUri?: string
+			otpPendingUri?: string
+			emailOtpEnabled?: boolean
+			mfaGraceUntil?: Date | null
+			emailVerifiedAt?: Date | null
+			emailVerificationRequired?: boolean
+		}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
 	         WHERE "person"."email" = ?`,
 	parameters: [args.email],
 	response: {
@@ -20,10 +35,17 @@ export const getPersonByEmailSql = (args: {
 					identity_id: args.response.identityId,
 					roles: args.response.roles,
 					email: args.email,
-					otp_uri: args.response.otpUri,
+					otp_secret: args.response.otpUri ? Buffer.from(args.response.otpUri, 'utf8') : null,
+					otp_secret_version: args.response.otpUri ? 0 : null,
 					otp_activated_at: args.response.otpUri ? new Date() : null,
+					otp_pending_secret: args.response.otpPendingUri ? Buffer.from(args.response.otpPendingUri, 'utf8') : null,
+					otp_pending_version: args.response.otpPendingUri ? 0 : null,
+					email_otp_enabled: args.response.emailOtpEnabled ?? false,
 					disabled_at: null,
 					passwordless_enabled: null,
+					mfa_grace_until: args.response.mfaGraceUntil ?? null,
+					email_verified_at: args.response.emailVerifiedAt ?? null,
+					email_verification_required: args.response.emailVerificationRequired ?? false,
 				},
 			]
 			: [],

package/tests/cases/integration/mocked/sql/getPersonByIdSql.ts

@@ -1,14 +1,28 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 
 export const getPersonByIdSql = (args: {
 	personId: string
-	response: { personId: string; password: string; identityId: string; roles: string[]; email: string; name?: string }
+	response: {
+		personId: string
+		password: string
+		identityId: string
+		roles: string[]
+		email: string
+		name?: string
+		otpUri?: string
+		disabledAt?: Date | null
+		passwordlessEnabled?: boolean | null
+		emailVerifiedAt?: Date | null
+		emailVerificationRequired?: boolean
+		emailOtpEnabled?: boolean
+	}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
 	         WHERE "person"."id" = ?`,
 	parameters: [args.personId],
 	response: {
@@ -20,6 +34,13 @@ export const getPersonByIdSql = (args: {
 				roles: args.response.roles,
 				email: args.response.email,
 				name: args.response.name,
+				email_otp_enabled: args.response.emailOtpEnabled ?? false,
+				otp_uri: args.response.otpUri ?? null,
+				otp_activated_at: args.response.otpUri ? new Date() : null,
+				disabled_at: args.response.disabledAt ?? null,
+				passwordless_enabled: args.response.passwordlessEnabled ?? null,
+				email_verified_at: args.response.emailVerifiedAt ?? null,
+				email_verification_required: args.response.emailVerificationRequired ?? false,
 			},
 		],
 	},

package/tests/cases/integration/mocked/sql/getPersonByIdentity.ts

@@ -1,14 +1,29 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
+import { Buffer } from 'buffer'
 
 export const getPersonByIdentity = (args: {
 	identityId: string
-	response: null | { personId: string; password: string; roles: string[]; email: string; name?: string; otpUri?: string }
+	response:
+		| null
+		| {
+			personId: string
+			password: string
+			roles: string[]
+			email: string
+			name?: string
+			otpUri?: string
+			otpPendingUri?: string
+			emailOtpEnabled?: boolean
+			emailVerifiedAt?: Date | null
+			emailVerificationRequired?: boolean
+		}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
 	         WHERE "person"."identity_id" = ?`,
 	parameters: [args.identityId],
 	response: {
@@ -21,7 +36,14 @@ export const getPersonByIdentity = (args: {
 					roles: args.response.roles,
 					email: args.response.email,
 					name: args.response.name,
-					otp_uri: args.response.otpUri,
+					otp_secret: args.response.otpUri ? Buffer.from(args.response.otpUri, 'utf8') : null,
+					otp_secret_version: args.response.otpUri ? 0 : null,
+					otp_activated_at: args.response.otpUri ? new Date() : null,
+					otp_pending_secret: args.response.otpPendingUri ? Buffer.from(args.response.otpPendingUri, 'utf8') : null,
+					otp_pending_version: args.response.otpPendingUri ? 0 : null,
+					email_otp_enabled: args.response.emailOtpEnabled ?? false,
+					email_verified_at: args.response.emailVerifiedAt ?? null,
+					email_verification_required: args.response.emailVerificationRequired ?? false,
 				},
 			]
 			: [],

package/tests/cases/integration/mocked/sql/getPersonByIdpSql.ts

@@ -1,5 +1,6 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
+import { Buffer } from 'buffer'
 
 export const getPersonByIdpSql = (args: {
 	identityProviderId: string
@@ -7,9 +8,10 @@ export const getPersonByIdpSql = (args: {
 	response: null | { personId: string; password?: string; identityId: string; email: string; roles: string[]; otpUri?: string }
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person"."otp_uri", "person"."otp_activated_at", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		        INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		        LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
 				INNER JOIN  "tenant"."person_identity_provider" as "idp" on  "idp"."person_id" = "person"."id"
 	        WHERE "identity_provider_id" = ? and "external_identifier" = ?
 		              `,
@@ -23,8 +25,10 @@ export const getPersonByIdpSql = (args: {
 					identity_id: args.response.identityId,
 					roles: args.response.roles,
 					email: args.response.email,
-					otp_uri: args.response.otpUri,
+					otp_secret: args.response.otpUri ? Buffer.from(args.response.otpUri, 'utf8') : null,
+					otp_secret_version: args.response.otpUri ? 0 : null,
 					otp_activated_at: args.response.otpUri ? new Date() : null,
+					email_otp_enabled: false,
 					disabled_at: null,
 				},
 			]

package/tests/cases/integration/mocked/sql/getPersonsByIdentitySql.ts

@@ -0,0 +1,24 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export const getPersonsByIdentitySql = (args: {
+	identityIds: readonly string[]
+	response: readonly { personId: string; identityId: string; email: string; password?: string; roles?: readonly string[] }[]
+}): ExpectedQuery => ({
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+	         FROM "tenant"."person"
+		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
+	         WHERE "person"."identity_id" IN (${args.identityIds.map(() => '?').join(', ')})`,
+	parameters: [...args.identityIds],
+	response: {
+		rows: args.response.map(it => ({
+			id: it.personId,
+			password_hash: it.password ? `BCRYPTED-${it.password}` : null,
+			identity_id: it.identityId,
+			roles: it.roles ?? [],
+			email: it.email,
+		})),
+	},
+})

package/tests/cases/integration/mocked/sql/getProjectBySlugSql.ts

@@ -1,6 +1,6 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
-import { Project } from '../../../../../src'
+import { SQL } from '../../../../src/tags.js'
+import { Project } from '../../../../../src/index.js'
 
 export const getProjectBySlugSql = (args: { projectSlug: string; response: Project }): ExpectedQuery => ({
 	sql: SQL`select "id", "name", "slug", "config", "updated_at" as "updatedAt"

package/tests/cases/integration/mocked/sql/getProjectMembershipSql.ts

@@ -1,6 +1,6 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
-import { testUuid } from '../../../../src/testUuid'
+import { SQL } from '../../../../src/tags.js'
+import { testUuid } from '../../../../src/testUuid.js'
 
 export const getProjectMembershipSql = (
 	args: { identityId: string; projectId: string },

package/tests/cases/integration/mocked/sql/listApiKeysSql.ts

@@ -0,0 +1,45 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ApiKeyListResponseRow {
+	id: string
+	identityId: string
+	description?: string | null
+	disabledAt?: Date | null
+	createdAt: Date
+	lastUsedAt?: Date | null
+	expiresAt?: Date | null
+}
+
+const baseSelect =
+	`select "api_key"."id", "api_key"."type", "api_key"."disabled_at", "api_key"."created_at", "api_key"."last_used_at", "api_key"."expires_at", "api_key"."identity_id", "identity"."description"
+	 from "tenant"."api_key"
+	 inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id"`
+
+const mapRows = (rows: ApiKeyListResponseRow[]) =>
+	rows.map(row => ({
+		id: row.id,
+		type: 'permanent',
+		disabled_at: row.disabledAt ?? null,
+		created_at: row.createdAt,
+		last_used_at: row.lastUsedAt ?? null,
+		expires_at: row.expiresAt ?? null,
+		identity_id: row.identityId,
+		description: row.description ?? null,
+	}))
+
+export const projectApiKeysSql = (args: { projectId: string; rows: ApiKeyListResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`${baseSelect}
+		where "api_key"."type" = ? and exists (select ?::int from "tenant"."project_membership" where "project_membership"."identity_id" = "api_key"."identity_id" and "project_id" = ?)
+		order by "api_key"."created_at" desc`,
+	parameters: ['permanent', 1, args.projectId],
+	response: { rows: mapRows(args.rows) },
+})
+
+export const globalApiKeysSql = (args: { rows: ApiKeyListResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`${baseSelect}
+		where "api_key"."type" = ? and not(exists (select ?::int from "tenant"."project_membership" where "project_membership"."identity_id" = "api_key"."identity_id"))
+		order by "api_key"."created_at" desc`,
+	parameters: ['permanent', 1],
+	response: { rows: mapRows(args.rows) },
+})

package/tests/cases/integration/mocked/sql/listPersonsSql.ts

@@ -0,0 +1,55 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ListPersonsResponseRow {
+	personId: string
+	identityId: string
+	email: string
+	name?: string
+	emailOtpEnabled?: boolean
+}
+
+const COLUMNS =
+	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at"'
+
+const FROM = `FROM "tenant"."person"
+	LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"`
+
+/**
+ * Slim person listing emitted by `PersonsQuery` — no `password_hash` / TOTP
+ * secrets, capped to `limit 100 offset 0` by default. Supports the `email` and
+ * `identityIds` (scoped) filter variants.
+ */
+export const listPersonsSql = (args: {
+	emailFilter?: string
+	identityIds?: string[]
+	rows: ListPersonsResponseRow[]
+}): ExpectedQuery => {
+	const where: string[] = []
+	const parameters: unknown[] = []
+	if (args.emailFilter) {
+		where.push(`"person"."email" ILIKE '%' || ? || '%'`)
+		parameters.push(args.emailFilter)
+	}
+	if (args.identityIds) {
+		where.push(`"person"."identity_id" IN (${args.identityIds.map(() => '?').join(', ')})`)
+		parameters.push(...args.identityIds)
+	}
+	const whereSql = where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''
+	return {
+		sql: SQL`SELECT ${COLUMNS} ${FROM} ${whereSql} ORDER BY "person"."email" ASC limit 100 offset 0`,
+		parameters,
+		response: {
+			rows: args.rows.map(row => ({
+				id: row.personId,
+				identity_id: row.identityId,
+				email: row.email,
+				name: row.name ?? null,
+				otp_activated_at: null,
+				email_otp_enabled: row.emailOtpEnabled ?? false,
+				passwordless_enabled: null,
+				email_verified_at: null,
+			})),
+		},
+	}
+}

package/tests/cases/integration/mocked/sql/listProjectSecretsSql.ts

@@ -0,0 +1,23 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ProjectSecretResponseRow {
+	key: string
+	createdAt: Date
+	updatedAt: Date
+}
+
+export const listProjectSecretsSql = (args: { projectId: string; rows: ProjectSecretResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`select "key", "created_at", "updated_at"
+		from "tenant"."project_secret"
+		where "project_id" = ?
+		order by "key" asc`,
+	parameters: [args.projectId],
+	response: {
+		rows: args.rows.map(row => ({
+			key: row.key,
+			created_at: row.createdAt,
+			updated_at: row.updatedAt,
+		})),
+	},
+})