@contember/engine-tenant-api 2.1.0-rc.1 → 2.1.0-rc.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.1.0-rc.1",
+  "version": "2.1.0-rc.2",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -50,6 +50,7 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 
 				return qb
 			})
+			.orderBy(['identity', 'id'])
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)
 			.getResult(db)
 	}

package/src/model/service/PersonAccessManager.ts

@@ -1,3 +1,4 @@
+import { Logger } from '@contember/logger'
 import { PersonQuery, PersonRow } from '../queries'
 import { DatabaseContext } from '../utils'
 import { DisablePersonCommand } from '../commands/person/DisablePersonCommand'
@@ -8,7 +9,9 @@ import { DisablePersonErrorCode } from '../../schema'
 class PersonAccessManager {
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
 
-	async disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {
+	async disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse> {
+		// Retried: the api_key update races the target's own background session tracking and loses with a 40001,
+		// which would otherwise leave the person enabled behind an internal error. Nothing here escapes the transaction.
 		return await dbContext.transaction(async trx => {
 			if (person.disabled_at !== null) {
 				return new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')
@@ -19,7 +22,7 @@ class PersonAccessManager {
 			await this.disableIdentityApiKeys(trx, person.identity_id)
 
 			return new ResponseOk(null)
-		})
+		}, { retry: { logger } })
 	}
 
 	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -44,15 +44,17 @@ export class ApiKeyManager {
 			return new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)
 		}
 
-		setImmediate(async () => {
-			await dbContext.commandBus.execute(
+		// Detached (runs after the response), so a rejection here would be an unhandledRejection and can take the
+		// worker down. Tracking is best-effort — the next request writes it again.
+		setImmediate(() => {
+			dbContext.commandBus.execute(
 				new ProlongApiKeyCommand(
 					apiKeyRow.id,
 					apiKeyRow.type,
 					apiKeyRow.expiration,
 					apiKeyRow.expires_at,
 				),
-			)
+			).catch(() => {})
 		})
 
 		return new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id))

package/src/model/service/idp/IDPManager.ts

@@ -22,7 +22,7 @@ export class IDPManager {
 		return await db.transaction(async (db): Promise<RegisterIDPResponse> => {
 			try {
 				const providerService = this.idpRegistry.getHandler(idp.type)
-				providerService.validateConfiguration(idp.configuration)
+				this.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(idp.configuration), idp.configuration)
 			} catch (e) {
 				if (e instanceof IdentityProviderNotFoundError) {
 					return new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)
@@ -99,7 +99,7 @@ export class IDPManager {
 				const type = data.type ?? existing.type
 				const providerService = this.idpRegistry.getHandler(type)
 				if (data.configuration !== undefined || type !== existing.type) {
-					providerService.validateConfiguration(newConfiguration)
+					this.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(newConfiguration), newConfiguration)
 				}
 			} catch (e) {
 				if (e instanceof InvalidIDPConfigurationError) {
@@ -119,6 +119,34 @@ export class IDPManager {
 		})
 	}
 
+	/**
+	 * Reject top-level `configuration` keys the provider does not recognise.
+	 *
+	 * Every provider configuration is parsed with `Typesafe.partial`, which silently DROPS unknown
+	 * properties. Without this check `addIDP` / `updateIDP` answer `ok` to a configuration the
+	 * provider will never act on — a typo like `fetchUserinfo` (lowercase i) reads as a successfully
+	 * applied setting while the option stays off, and an option that a given engine version does not
+	 * support yet looks indistinguishable from one that works.
+	 *
+	 * The parsed result carries exactly the keys the provider understood, so the difference against
+	 * the submitted object is the set of ignored keys. All of them are reported at once (rather than
+	 * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one
+	 * round trip to fix.
+	 *
+	 * Write time only: reading a stored configuration is deliberately left untouched, so a row written
+	 * before this check keeps authenticating instead of locking its users out.
+	 */
+	private assertNoUnknownConfigurationKeys(parsed: {}, submitted: Record<string, unknown>): void {
+		const known = new Set(Object.keys(parsed))
+		const unknown = Object.keys(submitted).filter(key => !known.has(key))
+		if (unknown.length > 0) {
+			throw new InvalidIDPConfigurationError(
+				`unknown configuration ${unknown.length === 1 ? 'property' : 'properties'} ${unknown.join(', ')}; `
+					+ `remove ${unknown.length === 1 ? 'it' : 'them'} or check the spelling — the provider would ignore ${unknown.length === 1 ? 'it' : 'them'}`,
+			)
+		}
+	}
+
 	public async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {
 		const result = await db.queryHandler.fetch(new IdentityProvidersQuery())
 		return result.map(it => {

package/src/model/utils/DatabaseContext.ts

@@ -1,8 +1,20 @@
-import { Client, Connection } from '@contember/database'
+import { Client, Connection, retryTransaction } from '@contember/database'
+import { Logger } from '@contember/logger'
 import { Providers } from '../providers'
 import { CommandBus } from '../commands'
 import { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery'
 
+export interface TransactionOptions {
+	/**
+	 * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
+	 * repeatable-read level every transaction here runs at.
+	 *
+	 * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside
+	 * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.
+	 */
+	retry?: { logger: Logger }
+}
+
 export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	private loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()
 
@@ -20,11 +32,20 @@ export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection
 		return this.client.createQueryHandler()
 	}
 
-	public async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {
-		return await this.client.transaction(async db => {
-			await db.query(Connection.REPEATABLE_READ)
-			return await cb(new DatabaseContext(db, this.providers))
-		})
+	public async transaction<T>(
+		cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>,
+		options: TransactionOptions = {},
+	): Promise<T> {
+		const run = async () =>
+			await this.client.transaction(async db => {
+				await db.query(Connection.REPEATABLE_READ)
+				return await cb(new DatabaseContext(db, this.providers))
+			})
+		const retry = options.retry
+		if (!retry) {
+			return await run()
+		}
+		return await retryTransaction(run, message => retry.logger.warn(message))
 	}
 
 	public async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {

package/src/resolvers/mutation/person/DisablePersonMutationResolver.ts

@@ -32,7 +32,7 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to disable person account',
 		})
 
-		const result = await this.personAccessManager.disablePerson(context.db, targetPerson)
+		const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)
 		await context.logAuthAction({
 			type: 'person_disable',
 			response: result,

package/tests/cases/integration/mocked/listProjectMembersQuery.test.ts

@@ -4,14 +4,18 @@ import { testUuid } from '../../../src/testUuid'
 import { test } from 'bun:test'
 import { sqlTransaction } from './sql/sqlTransaction'
 
-test('list project members by email query', async () => {
+test('list project members by email query with stable pagination order', async () => {
 	await executeTenantTest({
 		query: {
 			query: GQL`
 query {	
 	projectBySlug(slug: "sandbox") {
 		members(
-			input: { filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON } }
+			input: {
+				filter: { email: ["foo@localhost", "bar@localhost"], memberType: PERSON }
+				limit: 10
+				offset: 20
+			}
 		) {
 			identity {
 				id
@@ -41,7 +45,8 @@ query {
 					sql: `select "id", "description"  from "tenant"."identity"  
                             where exists (select ?::int  from "tenant"."project_membership"  
                                                          where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?) 
-                              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))`,
+				              and exists (select ?::int  from "tenant"."person"  where "person"."identity_id" = "identity"."id" and "email" in (?, ?))
+				            order by "identity"."id" asc limit 10 offset 20`,
 					parameters: [1, testUuid(1), 1, 'foo@localhost', 'bar@localhost'],
 					response: {
 						rows: [

package/tests/cases/unit/databaseContextRetry.test.ts

@@ -0,0 +1,80 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { SerializationFailureError } from '@contember/database'
+import { createLogger, TestLoggerHandler } from '@contember/logger'
+import { DatabaseContext } from '../../../src/index'
+import { Providers } from '../../../src/model/providers'
+
+// Every tenant transaction runs at repeatable read, so postgres aborts it with a 40001 as soon as another
+// transaction commits to a row it wants — the api_key row disablePerson touches is written by that very
+// person's background session tracking. Repeating is the only correct answer, but it is opt-in: several
+// managers send a mail from inside their transaction and would send it twice.
+
+const providers: Providers = {
+	uuid: () => '11111111-1111-1111-1111-111111111111',
+	now: () => new Date('2026-01-01T00:00:00Z'),
+	randomBytes: length => Promise.resolve(Buffer.alloc(length)),
+	bcrypt: value => Promise.resolve(value),
+	bcryptCompare: (data, encrypted) => Promise.resolve(data === encrypted),
+	hash: value => Buffer.from(String(value)),
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+}
+
+const serializationFailure = () =>
+	new SerializationFailureError('update "tenant"."api_key" set "disabled_at" = $1 where "identity_id" = $2', [], {
+		code: '40001',
+		message: 'could not serialize access due to concurrent update',
+	})
+
+const begin: ExpectedQuery[] = [
+	{ sql: 'BEGIN;', response: { rowCount: 1 } },
+	{ sql: 'SET TRANSACTION ISOLATION LEVEL REPEATABLE READ', response: { rowCount: 1 } },
+]
+const commit: ExpectedQuery = { sql: 'COMMIT;', response: { rowCount: 1 } }
+
+const createDbContext = (queries: ExpectedQuery[]) => {
+	const connection = createConnectionMock(queries)
+	return new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+}
+
+test('transaction with retry repeats the whole transaction after a serialization failure', async () => {
+	const queries = [...begin, ...begin, commit]
+	const dbContext = createDbContext(queries)
+	const handler = new TestLoggerHandler()
+	let attempts = 0
+
+	const result = await dbContext.transaction(async () => {
+		attempts++
+		if (attempts === 1) {
+			throw serializationFailure()
+		}
+		return 'done'
+	}, { retry: { logger: createLogger(handler) } })
+
+	expect(result).toBe('done')
+	expect(attempts).toBe(2)
+	// The second attempt opens its own transaction, so it gets a fresh snapshot — a retry on the same one
+	// would abort again forever.
+	expect(queries).toHaveLength(0)
+	// Logged through the injected logger, not an ambient one — a retry must not depend on request-scoped state.
+	expect(handler.messages).toHaveLength(1)
+	expect(handler.messages[0].message).toMatch(/^RETRY: Serialization failure \(attempt #1/)
+})
+
+test('transaction without retry lets the serialization failure through', async () => {
+	const dbContext = createDbContext([...begin])
+	let attempts = 0
+
+	const run = dbContext.transaction(async () => {
+		attempts++
+		throw serializationFailure()
+	})
+
+	await expect(run).rejects.toBeInstanceOf(SerializationFailureError)
+	expect(attempts).toBe(1)
+})

package/tests/cases/unit/idp/idpManagerUnknownConfigKeys.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, test } from 'bun:test'
+import { IDPHandlerRegistry, IDPManager } from '../../../../src/model/service/idp'
+import { OIDCProvider } from '../../../../src/model/service/idp/providers/OIDCProvider'
+import { DatabaseContext } from '../../../../src'
+
+// Provider configurations are parsed with `Typesafe.partial`, which DROPS unknown properties. Without a
+// write-time guard, `addIDP` / `updateIDP` answer `ok` to a configuration the provider will never act on:
+// a typo such as `fetchUserinfo` (lowercase i) reads as an applied setting while the option stays off.
+// These pin the rejection. `OIDCProvider.validateConfiguration` is pure Typesafe parsing (no discovery,
+// no network), so the real provider can be used here rather than a pass-through double.
+
+const OIDC_BASE = { url: 'https://idp.example.com', clientId: 'client', clientSecret: 'secret' }
+const OPTIONS = { autoSignUp: false, exclusive: false, initReturnsConfig: false }
+
+const makeManager = () => {
+	const registry = new IDPHandlerRegistry()
+	registry.registerHandler('oidc', new OIDCProvider())
+	return new IDPManager(registry)
+}
+
+/** `existing` undefined ⇒ no IdP with that slug yet (the addIDP path). */
+const makeDb = (existing?: Record<string, unknown>) => {
+	const executed: unknown[] = []
+	const inner: any = {
+		queryHandler: {
+			fetch: async () => existing ? { id: 'idp-1', slug: 'sso', type: 'oidc', configuration: existing, disabledAt: null } : undefined,
+		},
+		commandBus: { execute: async (command: unknown) => void executed.push(command) },
+	}
+	inner.transaction = async (cb: (db: any) => Promise<unknown>) => cb(inner)
+	return { db: inner as unknown as DatabaseContext, executed }
+}
+
+describe('IDPManager — unknown configuration keys', () => {
+	test('addIDP rejects a key the provider would silently ignore', async () => {
+		const { db, executed } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			// `fetchUserinfo` is a plausible typo of `fetchUserInfo`; before the guard this returned ok
+			// and left the option off.
+			configuration: { ...OIDC_BASE, fetchUserinfo: true },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(false)
+		expect(response.ok === false && response.error).toBe('INVALID_CONFIGURATION')
+		expect(response.ok === false && response.errorMessage).toContain('fetchUserinfo')
+		// nothing was written
+		expect(executed).toHaveLength(0)
+	})
+
+	test('reports every unknown key at once, so several typos take one round trip', async () => {
+		const { db } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			configuration: { ...OIDC_BASE, fetchUserinfo: true, idTokenSignedResponseAlgo: 'RS256' },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(false)
+		const message = response.ok === false ? response.errorMessage ?? '' : ''
+		expect(message).toContain('fetchUserinfo')
+		expect(message).toContain('idTokenSignedResponseAlgo')
+	})
+
+	test('a configuration the provider fully understands still passes', async () => {
+		const { db, executed } = makeDb()
+		const response = await makeManager().addIDP(db, {
+			slug: 'sso',
+			type: 'oidc',
+			configuration: { ...OIDC_BASE, scope: 'openid email', fetchUserInfo: true },
+			options: OPTIONS,
+		})
+
+		expect(response.ok).toBe(true)
+		expect(executed).toHaveLength(1)
+	})
+
+	test('updateIDP rejects an unknown key in the MERGED result, not just in the patch', async () => {
+		const { db, executed } = makeDb(OIDC_BASE)
+		const response = await makeManager().updateIDP(db, 'sso', { configuration: { fetchUserinfo: true } }, true)
+
+		expect(response.ok).toBe(false)
+		expect(response.ok === false && response.error).toBe('INVALID_CONFIGURATION')
+		expect(response.ok === false && response.errorMessage).toContain('fetchUserinfo')
+		expect(executed).toHaveLength(0)
+	})
+
+	test('an update that does not touch the configuration is not re-validated', async () => {
+		// A row written before this guard may hold keys the provider ignores. Toggling something else
+		// about it must not become impossible — the guard is a write-time check on a submitted
+		// configuration, not a re-validation of what is already stored.
+		const { db, executed } = makeDb({ ...OIDC_BASE, legacyIgnoredKey: true })
+		const response = await makeManager().updateIDP(db, 'sso', { options: { autoSignUp: true } }, false)
+
+		expect(response.ok).toBe(true)
+		expect(executed).toHaveLength(1)
+	})
+})