@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/model/authorization/PermissionActions.ts

@@ -1,6 +1,50 @@
 import { Authorizator } from '@contember/authorization'
 import { Acl } from '@contember/schema'
 
+export type TargetIdentityPermissionTarget = {
+	readonly id: string
+	readonly globalRoles: readonly string[]
+	readonly hasProjectMemberships: boolean
+}
+
+export type TargetIdentityPermissionMeta = {
+	readonly target: TargetIdentityPermissionTarget | null
+}
+
+export type ProfileField = 'name' | 'email'
+
+export type ChangeProfilePermissionMeta = TargetIdentityPermissionMeta & {
+	readonly fields: readonly ProfileField[]
+}
+
+export type CreateSessionTokenPermissionMeta = {
+	readonly phase: 'preflight' | 'target'
+	readonly target?: TargetIdentityPermissionTarget
+	readonly requestedExpirationMinutes?: number | null
+	readonly trustForwardedClientInfo?: boolean
+}
+
+export type GlobalRoleMutationPermissionMeta = {
+	readonly requestedRoles: readonly string[]
+	readonly target: TargetIdentityPermissionTarget
+	readonly self: boolean
+}
+
+export type GlobalApiKeyPermissionMeta = {
+	readonly requestedRoles: readonly string[]
+	readonly trustForwardedClientInfo: boolean
+}
+
+export type ApiKeyPermissionMeta = {
+	readonly trustForwardedClientInfo: boolean
+}
+
+export type MailTemplatePermissionMeta = {
+	readonly kind: 'global' | 'project'
+	readonly projectSlug: string | null
+	readonly type: string
+}
+
 namespace PermissionActions {
 	export enum Resources {
 		system = 'system',
@@ -11,34 +55,50 @@ namespace PermissionActions {
 		apiKey = 'apiKey',
 		mailTemplate = 'mailTemplate',
 		idp = 'idp',
+		customRole = 'customRole',
 	}
 
 	export const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')
 	export const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')
+	export const AUTH_LOG_VIEW = Authorizator.createAction(Resources.system, 'viewAuthLog')
 
 	export const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')
-	export const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })
-	export const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) =>
-		Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
+	export const IDENTITY_ADD_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>
+		Authorizator.createAction(Resources.identity, 'addGlobalRoles', meta)
+	export const IDENTITY_REMOVE_GLOBAL_ROLES = (meta?: GlobalRoleMutationPermissionMeta) =>
+		Authorizator.createAction(Resources.identity, 'removeGlobalRoles', meta)
 
-	export const PERSON_DISABLE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'disable', { roles })
+	export const PERSON_DISABLE = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'disable', { target })
+	export const PERSON_FORCE_SIGN_OUT = (target: TargetIdentityPermissionTarget | null) =>
+		Authorizator.createAction(Resources.person, 'forceSignOut', { target })
+	export const PERSON_RESET_MFA = (target: TargetIdentityPermissionTarget | null) =>
+		Authorizator.createAction(Resources.person, 'resetMfa', { target })
+	export const PERSON_REVOKE_SESSION = Authorizator.createAction(Resources.person, 'revokeSession')
+	export const PERSON_VIEW_SESSIONS = (target: TargetIdentityPermissionTarget | null) =>
+		Authorizator.createAction(Resources.person, 'viewSessions', { target })
 
 	export const PERSON_VIEW = Authorizator.createAction(Resources.person, 'view')
+	export const PERSON_LIST = Authorizator.createAction(Resources.person, 'list')
 	export const PERSON_SIGN_IN = Authorizator.createAction(Resources.person, 'signIn')
-	export const PERSON_SIGN_UP = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { roles })
+	export const PERSON_SIGN_UP = (requestedRoles?: readonly string[]) => Authorizator.createAction(Resources.person, 'signUp', { requestedRoles })
 	export const PERSON_SIGN_OUT = Authorizator.createAction(Resources.person, 'signOut')
 	export const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')
-	export const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })
+	export const PERSON_CHANGE_PROFILE = (target: TargetIdentityPermissionTarget | null, fields: readonly ProfileField[]) =>
+		Authorizator.createAction(Resources.person, 'changeProfile', { target, fields })
 	export const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')
 	export const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')
-	export const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })
+	export const PERSON_CHANGE_PASSWORD = (target: TargetIdentityPermissionTarget | null) =>
+		Authorizator.createAction(Resources.person, 'changePassword', { target })
 	export const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')
 	export const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')
 	export const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')
 	export const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')
+	export const PERSON_VIEW_IDP = (target: TargetIdentityPermissionTarget | null) => Authorizator.createAction(Resources.person, 'viewIdp', { target })
+	export const PERSON_DISCONNECT_MY_IDP = Authorizator.createAction(Resources.person, 'disconnectMyIdp')
 	export const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')
 	export const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')
-	export const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })
+	export const PERSON_CREATE_SESSION_KEY = (meta: CreateSessionTokenPermissionMeta) =>
+		Authorizator.createAction(Resources.person, 'createSessionToken', meta)
 
 	export const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })
 	export const PERSON_INVITE_UNMANAGED = (memberships: readonly Acl.Membership[]) =>
@@ -46,6 +106,7 @@ namespace PermissionActions {
 
 	export const PROJECT_VIEW = Authorizator.createAction(Resources.project, 'view')
 	export const PROJECT_SET_SECRET = Authorizator.createAction(Resources.project, 'setSecret')
+	export const PROJECT_VIEW_SECRETS = Authorizator.createAction(Resources.project, 'viewSecrets')
 	export const PROJECT_UPDATE = Authorizator.createAction(Resources.project, 'update')
 
 	export const PROJECT_CREATE = Authorizator.createAction(Resources.project, 'create')
@@ -60,19 +121,25 @@ namespace PermissionActions {
 	export const PROJECT_UPDATE_MEMBER = (memberships: readonly Acl.Membership[]) =>
 		Authorizator.createAction(Resources.project, 'updateMember', { memberships })
 
-	export const API_KEY_CREATE = Authorizator.createAction(Resources.apiKey, 'create')
-	export const API_KEY_CREATE_GLOBAL = (roles?: readonly string[]) => Authorizator.createAction(Resources.apiKey, 'createGlobal', { roles })
+	export const API_KEY_CREATE = (meta?: ApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'create', meta)
+	export const API_KEY_CREATE_GLOBAL = (meta?: GlobalApiKeyPermissionMeta) => Authorizator.createAction(Resources.apiKey, 'createGlobal', meta)
 	export const API_KEY_DISABLE = Authorizator.createAction(Resources.apiKey, 'disable')
+	export const API_KEY_LIST = Authorizator.createAction(Resources.apiKey, 'list')
 
-	export const MAIL_TEMPLATE_ADD = Authorizator.createAction(Resources.mailTemplate, 'add')
-	export const MAIL_TEMPLATE_REMOVE = Authorizator.createAction(Resources.mailTemplate, 'remove')
-	export const MAIL_TEMPLATE_LIST = Authorizator.createAction(Resources.mailTemplate, 'list')
+	// meta is optional only so a grant can be registered without one — `Permissions.allow`
+	// keys on resource + privilege and never reads it. Every check site passes it.
+	export const MAIL_TEMPLATE_ADD = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'add', meta)
+	export const MAIL_TEMPLATE_REMOVE = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'remove', meta)
+	export const MAIL_TEMPLATE_LIST = (meta?: MailTemplatePermissionMeta) => Authorizator.createAction(Resources.mailTemplate, 'list', meta)
 
 	export const IDP_ADD = Authorizator.createAction(Resources.idp, 'add')
 	export const IDP_UPDATE = Authorizator.createAction(Resources.idp, 'update')
 	export const IDP_DISABLE = Authorizator.createAction(Resources.idp, 'disable')
 	export const IDP_ENABLE = Authorizator.createAction(Resources.idp, 'enable')
 	export const IDP_LIST = Authorizator.createAction(Resources.idp, 'list')
+
+	export const CUSTOM_ROLE_MANAGE = Authorizator.createAction(Resources.customRole, 'manage')
+	export const CUSTOM_ROLE_VIEW = Authorizator.createAction(Resources.customRole, 'view')
 }
 
 export { PermissionActions }

package/src/model/authorization/PermissionContext.ts

@@ -1,8 +1,8 @@
 import { AccessNode, AuthorizationScope, Authorizator } from '@contember/authorization'
 import { ForbiddenError } from '@contember/graphql-utils'
-import { ProjectScopeFactory } from './ProjectScopeFactory'
-import { Project, ProjectSchemaResolver } from '../type'
-import { Identity } from './Identity'
+import { ProjectScopeFactory } from './ProjectScopeFactory.js'
+import { Project, ProjectSchemaResolver } from '../type/index.js'
+import { Identity } from './Identity.js'
 
 export type AccessVerifier = (action: Authorizator.Action) => Promise<boolean>
 

package/src/model/authorization/PermissionContextFactory.ts

@@ -1,20 +1,56 @@
 import { Authorizator } from '@contember/authorization'
-import { IdentityFactory } from './IdentityFactory'
-import { PermissionContext } from './PermissionContext'
-import { ProjectScopeFactory } from './ProjectScopeFactory'
-import { ProjectSchemaResolver } from '../type'
-import { DatabaseContext } from '../utils'
+import { IdentityFactory } from './IdentityFactory.js'
+import { PermissionContext } from './PermissionContext.js'
+import { ProjectScopeFactory } from './ProjectScopeFactory.js'
+import { ProjectSchemaResolver } from '../type/index.js'
+import { DatabaseContext } from '../utils/index.js'
+import { CustomRoleAuthorizator } from './CustomRoleAuthorizator.js'
+import { Identity } from './Identity.js'
 
 export class PermissionContextFactory {
 	constructor(
-		private readonly authorizator: Authorizator,
+		private readonly authorizator: Authorizator<Identity>,
 		private readonly identityFactory: IdentityFactory,
 		private readonly projectScopeFactory: ProjectScopeFactory,
 		private readonly schemaResolver: ProjectSchemaResolver,
 	) {}
 
-	public create(db: DatabaseContext, args: { id: string; roles: readonly string[] }): PermissionContext {
+	public create(
+		db: DatabaseContext,
+		args: { id: string; roles: readonly string[] },
+		requestAuthorizator?: Authorizator<Identity>,
+	): PermissionContext {
+		const authorizator = this.createAuthorizator(db, requestAuthorizator)
+		return this.buildContext(db, args, authorizator)
+	}
+
+	/**
+	 * Same as `create`, but resolves the custom-role definitions before returning, so
+	 * the request never has to query for them while holding a transaction open.
+	 */
+	public async createPreloaded(
+		db: DatabaseContext,
+		args: { id: string; roles: readonly string[] },
+		requestAuthorizator?: Authorizator<Identity>,
+	): Promise<PermissionContext> {
+		const authorizator = this.createAuthorizator(db, requestAuthorizator)
+		await authorizator.preload(args.roles)
+		return this.buildContext(db, args, authorizator)
+	}
+
+	private createAuthorizator(db: DatabaseContext, requestAuthorizator?: Authorizator<Identity>): CustomRoleAuthorizator {
+		const customRoleCache = requestAuthorizator instanceof CustomRoleAuthorizator
+			? requestAuthorizator.customRoleCache
+			: undefined
+		return new CustomRoleAuthorizator(this.authorizator, db, customRoleCache)
+	}
+
+	private buildContext(
+		db: DatabaseContext,
+		args: { id: string; roles: readonly string[] },
+		authorizator: CustomRoleAuthorizator,
+	): PermissionContext {
 		const identity = this.identityFactory.create(db, args)
-		return new PermissionContext(identity, this.authorizator, this.projectScopeFactory, this.schemaResolver)
+		return new PermissionContext(identity, authorizator, this.projectScopeFactory, this.schemaResolver)
 	}
 }

package/src/model/authorization/PermissionsFactory.ts

@@ -1,18 +1,44 @@
 import { Permissions } from '@contember/authorization'
-import { PermissionActions } from './PermissionActions'
-import { TenantRole } from './Roles'
-
-const allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])
-
-const projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {
-	return roles === undefined || roles.every(it => allowedRoles.has(it))
-}
-
-const forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])
-
-const projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {
-	return roles === undefined || roles.every(it => !forbiddenRoles.has(it))
-}
+import {
+	ApiKeyPermissionMeta,
+	ChangeProfilePermissionMeta,
+	CreateSessionTokenPermissionMeta,
+	GlobalApiKeyPermissionMeta,
+	GlobalRoleMutationPermissionMeta,
+	PermissionActions,
+	TargetIdentityPermissionMeta,
+} from './PermissionActions.js'
+import { NON_DELEGABLE_TENANT_ROLES, TenantRole } from './Roles.js'
+
+const projectAdminAllowsRoles = (roles: readonly string[] | undefined): boolean =>
+	roles === undefined || roles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))
+
+const projectAdminAllowedSignUpRoles = (meta: { readonly requestedRoles?: readonly string[] }) => projectAdminAllowsRoles(meta.requestedRoles)
+
+/**
+ * A key minted with trust-forwarded-info decides what lands in the audit log and what per-IP rate limits key on,
+ * so delegated authority may not mint one — same rule the custom-role grants apply via `allowTrustForwardedClientInfo`.
+ */
+const projectAdminAllowsTrustForwardedClientInfo = (meta: { readonly trustForwardedClientInfo?: boolean } | undefined) =>
+	meta?.trustForwardedClientInfo !== true
+
+const projectAdminAllowedApiKey = (meta: ApiKeyPermissionMeta | undefined) => projectAdminAllowsTrustForwardedClientInfo(meta)
+
+const projectAdminAllowedGlobalApiKeyRoles = (meta: GlobalApiKeyPermissionMeta | undefined) =>
+	projectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta)
+
+const projectAdminAllowedRoleMutation = (meta: GlobalRoleMutationPermissionMeta | undefined) =>
+	meta === undefined
+	|| (
+		projectAdminAllowsRoles(meta.requestedRoles)
+		&& meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))
+	)
+
+const projectAdminMayTarget = (meta: TargetIdentityPermissionMeta) =>
+	meta.target === null || meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))
+
+const projectAdminMayCreateSession = (meta: CreateSessionTokenPermissionMeta) =>
+	meta.phase === 'preflight' || meta.target?.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true
 
 class PermissionsFactory {
 	public create(): Permissions {
@@ -33,35 +59,48 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)
+		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)
+		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)
 
 		permissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)
-
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles)
+
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)
+		permissions.allow(
+			TenantRole.PROJECT_ADMIN,
+			PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),
+			projectAdminMayCreateSession,
+		)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))
 
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)
-		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD())
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE())
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST())
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)
@@ -69,6 +108,8 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)
 
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)

package/src/model/authorization/ProjectScope.ts

@@ -1,9 +1,9 @@
 import { AccessNode, AuthorizationScope } from '@contember/authorization'
-import { Project } from '../type'
-import { TenantRole } from './Roles'
+import { Project } from '../type/index.js'
+import { TenantRole } from './Roles.js'
 import { Acl, ProjectRole } from '@contember/schema'
-import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'
-import { Identity } from './Identity'
+import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'
+import { Identity } from './Identity.js'
 
 export class ProjectScope implements AuthorizationScope<Identity> {
 	constructor(

package/src/model/authorization/ProjectScopeFactory.ts

@@ -1,8 +1,8 @@
-import { Project, ProjectSchemaResolver } from '../type'
-import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'
+import { Project, ProjectSchemaResolver } from '../type/index.js'
+import { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'
 import { AuthorizationScope } from '@contember/authorization'
-import { ProjectScope } from './ProjectScope'
-import { Identity } from './Identity'
+import { ProjectScope } from './ProjectScope.js'
+import { Identity } from './Identity.js'
 
 export class ProjectScopeFactory {
 	constructor(

package/src/model/authorization/Roles.ts

@@ -8,3 +8,16 @@ export enum TenantRole {
 	PROJECT_ADMIN = 'project_admin',
 	ENTRYPOINT_DEPLOYER = 'entrypoint_deployer',
 }
+
+/**
+ * Roles no delegated authority may ever grant, hold as a target, or impersonate.
+ * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —
+ * keep it the single source, so a newly protected role cannot be added to one path only.
+ */
+export const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string> = new Set([
+	TenantRole.SUPER_ADMIN,
+	TenantRole.PROJECT_CREATOR,
+])
+
+/** Shared by custom-role slug validation and by role references inside grant configuration. */
+export const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/

package/src/model/authorization/TargetIdentityPermission.ts

@@ -0,0 +1,37 @@
+import { DatabaseContext } from '../utils/index.js'
+import { IdentityHasProjectMembershipsQuery, IdentityQuery, IdentityQueryResult } from '../queries/index.js'
+import { TargetIdentityPermissionTarget } from './PermissionActions.js'
+import { TenantRole } from './Roles.js'
+import { batchLoader } from '../../utils/batchQuery.js'
+
+const projectMembershipPresenceLoader = batchLoader<string, ReadonlySet<string>, boolean>(
+	async (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),
+	(identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId),
+)
+
+/** Batches the identity lookup that precedes a target-identity permission check. */
+export const targetIdentityLoader = batchLoader<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>(
+	async (identityIds, db) => {
+		const identities = await db.queryHandler.fetch(new IdentityQuery(identityIds))
+		return Object.fromEntries(identities.map(identity => [identity.id, identity]))
+	},
+	(identityId, identities) => identities[identityId],
+)
+
+export const createTargetIdentityPermissionTarget = async (
+	db: DatabaseContext,
+	identity: { readonly id: string; readonly roles: readonly string[] },
+): Promise<TargetIdentityPermissionTarget> => ({
+	id: identity.id,
+	globalRoles: identity.roles,
+	hasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN)
+		|| identity.roles.includes(TenantRole.PROJECT_ADMIN)
+		|| await db.batchLoad(projectMembershipPresenceLoader, identity.id),
+})
+
+/** Convenience for the common case where the caller already holds the target's person row. */
+export const createPersonPermissionTarget = async (
+	db: DatabaseContext,
+	person: { readonly identity_id: string; readonly roles: readonly string[] } | null,
+): Promise<TargetIdentityPermissionTarget | null> =>
+	person === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles })

package/src/model/authorization/index.ts

@@ -1,12 +1,15 @@
-export * from './AclSchemaAccessNodeFactory'
-export * from './Identity'
-export * from './IdentityFactory'
-export * from './IdentityScope'
-export * from './MembershipMatcher'
-export * from './PermissionActions'
-export * from './PermissionContext'
-export * from './PermissionContextFactory'
-export * from './PermissionsFactory'
-export * from './ProjectScope'
-export * from './ProjectScopeFactory'
-export * from './Roles'
+export * from './AclSchemaAccessNodeFactory.js'
+export * from './Identity.js'
+export * from './IdentityFactory.js'
+export * from './IdentityScope.js'
+export * from './MembershipMatcher.js'
+export * from './CustomRoleAuthorizator.js'
+export * from './CustomRolePermissions.js'
+export * from './PermissionActions.js'
+export * from './PermissionContext.js'
+export * from './PermissionContextFactory.js'
+export * from './TargetIdentityPermission.js'
+export * from './PermissionsFactory.js'
+export * from './ProjectScope.js'
+export * from './ProjectScopeFactory.js'
+export * from './Roles.js'

package/src/model/commands/Command.ts

@@ -1,6 +1,6 @@
 import { Client } from '@contember/database'
-import { Providers } from '../providers'
-import { CommandBus } from './CommandBus'
+import { Providers } from '../providers.js'
+import { CommandBus } from './CommandBus.js'
 
 interface Command<Result> {
 	execute(args: Command.Args): Promise<Result>

package/src/model/commands/CommandBus.ts

@@ -1,6 +1,6 @@
-import { Command } from './Command'
+import { Command } from './Command.js'
 import { Client, Connection } from '@contember/database'
-import { Providers } from '../providers'
+import { Providers } from '../providers.js'
 
 export class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	constructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}

package/src/model/commands/apiKey/ApiKeyHelper.ts

@@ -1,9 +1,15 @@
-import { ApiKey } from '../../type'
-import { Providers } from '../../providers'
-import { plusMinutes } from '../../utils/time'
+import { ApiKey } from '../../type/index.js'
+import { Providers } from '../../providers.js'
+import { plusMinutes } from '../../utils/time.js'
+import { Literal } from '@contember/database'
 
 const DEFAULT_EXPIRATION = 30
 export class ApiKeyHelper {
+	/**
+	 * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+	 * throttle (a write-rate optimization, not an auth gate). The value actually
+	 * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+	 */
 	public static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {
 		switch (type) {
 			case ApiKey.Type.PERMANENT:
@@ -16,4 +22,21 @@ export class ApiKeyHelper {
 				return null
 		}
 	}
+
+	/** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+	public static getSessionExpirationSeconds(expiration?: number | null): number {
+		return (expiration || DEFAULT_EXPIRATION) * 60
+	}
+
+	/**
+	 * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+	 * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+	 * against the same clock and cannot be weakened by app/DB skew. NULL for
+	 * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+	 */
+	public static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null {
+		return type === ApiKey.Type.SESSION
+			? new Literal('now() + make_interval(secs => ?)', [ApiKeyHelper.getSessionExpirationSeconds(expiration)])
+			: null
+	}
 }

package/src/model/commands/apiKey/CreateApiKeyCommand.ts

@@ -1,14 +1,28 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
-import { ApiKeyHelper } from './ApiKeyHelper'
-import { InsertBuilder } from '@contember/database'
-import { computeTokenHash, generateToken, TokenHash } from '../../utils'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
+import { ApiKeyHelper } from './ApiKeyHelper.js'
+import { InsertBuilder, Literal } from '@contember/database'
+import { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'
+import { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'
 
 interface CreateSessionApiKeyArgs {
 	type: ApiKey.Type.SESSION
 	identityId: string
 	expiration?: number
 	tokenHash?: string
+	requestInfo?: ApiKeyRequestInfo
+	trustForwardedInfo?: boolean
+	/**
+	 * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's
+	 * behavior (no idle timeout, no absolute cap on the sliding window).
+	 * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).
+	 */
+	idleTimeout?: string | null
+	/**
+	 * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB
+	 * clock so the cap is compared against the same clock. NULL = uncapped.
+	 */
+	maxExpirationSeconds?: number | null
 }
 
 interface CreatePermanentApiKeyArgs {
@@ -16,6 +30,8 @@ interface CreatePermanentApiKeyArgs {
 	identityId: string
 	tokenHash?: TokenHash
 	expiration?: undefined
+	requestInfo?: ApiKeyRequestInfo
+	trustForwardedInfo?: boolean
 }
 
 export type CreateApiKeyArgs =
@@ -34,6 +50,18 @@ export class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {
 			tokenHash = computeTokenHash(token)
 		}
 
+		// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off
+		// keys have no session policy → NULL (preserving today's behavior).
+		const args = this.args
+		const sessionPolicy = args.type === ApiKey.Type.SESSION
+			? {
+				issued_at: providers.now(), // display/ordering only, never compared
+				idle_timeout: args.idleTimeout ?? null,
+				max_expires_at: args.maxExpirationSeconds != null
+					? new Literal('now() + make_interval(secs => ?)', [args.maxExpirationSeconds])
+					: null,
+			}
+			: { issued_at: null, idle_timeout: null, max_expires_at: null }
 		await InsertBuilder.create()
 			.into('api_key')
 			.values({
@@ -42,9 +70,16 @@ export class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {
 				type: this.args.type,
 				identity_id: this.args.identityId,
 				disabled_at: null,
-				expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+				// expires_at on the DB clock so the verify gate compares like-for-like.
+				expires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),
 				expiration: this.args.expiration || null,
 				created_at: providers.now(),
+				created_ip: this.args.requestInfo?.ip || null,
+				created_user_agent: this.args.requestInfo?.userAgent || null,
+				trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+				issued_at: sessionPolicy.issued_at,
+				idle_timeout: sessionPolicy.idle_timeout,
+				max_expires_at: sessionPolicy.max_expires_at,
 			})
 			.execute(db)
 

package/src/model/commands/apiKey/DisableApiKeyCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableApiKeyCommand implements Command<boolean> {

package/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableIdentityApiKeysCommand implements Command<void> {

package/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts

@@ -1,5 +1,5 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class DisableOneOffApiKeyCommand implements Command<void> {