@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/model/commands/apiKey/ProlongApiKeyCommand.ts

@@ -1,9 +1,27 @@
-import { Command } from '../Command'
-import { ApiKey } from '../../type'
-import { ApiKeyHelper } from './ApiKeyHelper'
-import { UpdateBuilder } from '@contember/database'
+import { Command } from '../Command.js'
+import { ApiKey } from '../../type/index.js'
+import { ApiKeyHelper } from './ApiKeyHelper.js'
+import { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'
 
-const PROLONG_THROTTLE_MS = 60_000
+/**
+ * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per
+ * this window, even when the IP or User-Agent changes: a key shared by several service replicas
+ * alternates between their addresses, and writing every change makes its row a lock hotspot.
+ * An idle check must add this slack to avoid prematurely expiring an active session whose
+ * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
+ */
+export const PROLONG_THROTTLE_MS = 60_000
+
+export interface ApiKeyRequestInfo {
+	ip?: string
+	userAgent?: string
+}
+
+export interface ApiKeyTrackingState {
+	lastIp: string | null
+	lastUserAgent: string | null
+	lastUsedAt: Date | null
+}
 
 export class ProlongApiKeyCommand implements Command<void> {
 	constructor(
@@ -11,27 +29,70 @@ export class ProlongApiKeyCommand implements Command<void> {
 		private readonly type: ApiKey.Type,
 		private readonly expiration: number | null,
 		private readonly currentExpiration: Date | null,
+		private readonly requestInfo?: ApiKeyRequestInfo,
+		private readonly tracking?: ApiKeyTrackingState,
+		private readonly maxExpiresAt?: Date | null,
 	) {}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)
-		if (newExpiration === null) {
-			return
+		let newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)
+		// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.
+		// NULL maxExpiresAt = today's uncapped sliding window.
+		if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+			newExpiration = this.maxExpiresAt
 		}
+		const now = providers.now()
 
-		if (this.currentExpiration) {
+		let updateExpiration = newExpiration !== null
+		if (updateExpiration && this.currentExpiration && newExpiration !== null) {
 			const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()
 			if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-				return
+				updateExpiration = false
 			}
 		}
 
+		const requestIp = this.requestInfo?.ip || null
+		const requestUserAgent = this.requestInfo?.userAgent || null
+		const updateTracking = this.shouldUpdateTracking(now)
+
+		if (!updateExpiration && !updateTracking) {
+			return
+		}
+
+		const values: QueryBuilder.Values = {}
+		if (updateExpiration && newExpiration !== null) {
+			// Write the sliding expiry on the DB clock and clamp to the stored
+			// max_expires_at in SQL (LEAST ignores a NULL cap → uncapped window). The JS
+			// throttle above only decides *whether* to write; the expiry gate itself is
+			// computed on the DB clock. See engine-tenant-api/CLAUDE.md.
+			values.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), "max_expires_at")', [
+				ApiKeyHelper.getSessionExpirationSeconds(this.expiration),
+			])
+		}
+		if (updateTracking) {
+			values.last_ip = requestIp
+			values.last_user_agent = requestUserAgent
+			// last_used_at on the DB clock: it's compared against now() in the idle gate
+			// (ApiKeyByTokenQuery's is_idle_expired), so it must be written on the same
+			// clock. The app-clock `now` above only drives the write-rate throttle. See CLAUDE.md.
+			values.last_used_at = new Literal('now()')
+		}
+
 		const qb = UpdateBuilder.create()
 			.table('api_key')
 			.where({ id: this.id })
-			.values({
-				expires_at: newExpiration,
-			})
+			.values(values)
 		await qb.execute(db)
 	}
+
+	private shouldUpdateTracking(now: Date): boolean {
+		if (!this.requestInfo) {
+			return false
+		}
+		const lastUsedAt = this.tracking?.lastUsedAt
+		if (!lastUsedAt) {
+			return true
+		}
+		return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
+	}
 }

package/src/model/commands/apiKey/index.ts

@@ -1,5 +1,5 @@
-export * from './CreateApiKeyCommand'
-export * from './DisableApiKeyCommand'
-export * from './DisableIdentityApiKeysCommand'
-export * from './DisableOneOffApiKeyCommand'
-export * from './ProlongApiKeyCommand'
+export * from './CreateApiKeyCommand.js'
+export * from './DisableApiKeyCommand.js'
+export * from './DisableIdentityApiKeysCommand.js'
+export * from './DisableOneOffApiKeyCommand.js'
+export * from './ProlongApiKeyCommand.js'

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -1,5 +1,5 @@
-import { Command } from '../Command'
-import { AuthActionType } from '../../type/AuthLog'
+import { Command } from '../Command.js'
+import { AuthActionType } from '../../type/AuthLog.js'
 import { InsertBuilder } from '@contember/database'
 import { JSONValue } from '@contember/schema'
 
@@ -26,6 +26,10 @@ export class CreateAuthLogEntryCommand implements Command<void> {
 				user_agent: this.data.userAgent,
 				identity_provider_id: this.data.identityProviderId,
 				metadata: this.data.metadata ?? {},
+				target_person_id: this.data.targetPersonId,
+				event_data: this.data.eventData,
+				geo_country: this.data.geoCountry,
+				device_fingerprint: this.data.deviceFingerprint,
 			})
 			.execute(db)
 	}
@@ -34,9 +38,11 @@ export class CreateAuthLogEntryCommand implements Command<void> {
 namespace CreateAuthLogEntryCommand {
 	export type Entry = {
 		type: AuthActionType
-		invokedById: string
+		/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */
+		invokedById?: string
 		personInputIdentifier?: string
 		personId?: string
+		/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */
 		personTokenId?: string
 		success: boolean
 		errorCode?: string
@@ -45,5 +51,11 @@ namespace CreateAuthLogEntryCommand {
 		userAgent?: string
 		identityProviderId?: string
 		metadata?: JSONValue
+		targetPersonId?: string
+		eventData?: JSONValue
+		/** A03: country derived from the trusted reverse-proxy geo header, when present. */
+		geoCountry?: string
+		/** A03: hash of the client user-agent (never the raw UA). */
+		deviceFingerprint?: string
 	}
 }

package/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts

@@ -0,0 +1,41 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+import { AuthPolicyScope } from '../../type/index.js'
+
+export type AuthPolicyWriteValues = {
+	scope: AuthPolicyScope
+	projectId: string | null
+	roles: string[]
+	mfaRequired: boolean | null
+	tokenExpiration: string | null
+	idleTimeout: string | null
+	graceDuration: string | null
+	rememberMeAllowed: boolean | null
+}
+
+/** Inserts a new `auth_policy` row. Returns the generated id. */
+export class CreateAuthPolicyCommand implements Command<string> {
+	constructor(private readonly values: AuthPolicyWriteValues) {}
+
+	async execute({ db, providers }: Command.Args): Promise<string> {
+		const id = providers.uuid()
+		const now = providers.now()
+		await InsertBuilder.create()
+			.into('auth_policy')
+			.values({
+				id,
+				scope: this.values.scope,
+				project_id: this.values.projectId,
+				roles: this.values.roles,
+				mfa_required: this.values.mfaRequired,
+				token_expiration: this.values.tokenExpiration,
+				idle_timeout: this.values.idleTimeout,
+				grace_duration: this.values.graceDuration,
+				remember_me_allowed: this.values.rememberMeAllowed,
+				created_at: now,
+				updated_at: now,
+			})
+			.execute(db)
+		return id
+	}
+}

package/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts

@@ -0,0 +1,15 @@
+import { Command } from '../Command.js'
+import { DeleteBuilder } from '@contember/database'
+
+/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */
+export class DeleteAuthPolicyCommand implements Command<boolean> {
+	constructor(private readonly id: string) {}
+
+	async execute({ db }: Command.Args): Promise<boolean> {
+		const result = await DeleteBuilder.create()
+			.from('auth_policy')
+			.where({ id: this.id })
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts

@@ -0,0 +1,43 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+import { AuthPolicyScope } from '../../type/index.js'
+
+/**
+ * Updates an existing `auth_policy` row. Only the supplied fields are written
+ * (an `undefined` field is left untouched; an explicit `null` clears it).
+ * `updated_at` is always bumped. Returns whether a row was affected.
+ */
+export class UpdateAuthPolicyCommand implements Command<boolean> {
+	constructor(
+		private readonly id: string,
+		private readonly values: {
+			scope?: AuthPolicyScope
+			projectId?: string | null
+			roles?: string[]
+			mfaRequired?: boolean | null
+			tokenExpiration?: string | null
+			idleTimeout?: string | null
+			graceDuration?: string | null
+			rememberMeAllowed?: boolean | null
+		},
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const result = await UpdateBuilder.create()
+			.table('auth_policy')
+			.where({ id: this.id })
+			.values({
+				scope: this.values.scope,
+				project_id: this.values.projectId,
+				roles: this.values.roles,
+				mfa_required: this.values.mfaRequired,
+				token_expiration: this.values.tokenExpiration,
+				idle_timeout: this.values.idleTimeout,
+				grace_duration: this.values.graceDuration,
+				remember_me_allowed: this.values.rememberMeAllowed,
+				updated_at: providers.now(),
+			})
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/authPolicy/index.ts

@@ -0,0 +1,3 @@
+export * from './CreateAuthPolicyCommand.js'
+export * from './UpdateAuthPolicyCommand.js'
+export * from './DeleteAuthPolicyCommand.js'

package/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts

@@ -0,0 +1,32 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+/**
+ * Atomically consumes an unused backup code matching the given hash.
+ * Returns true if a code was consumed. Safe against double-spend: the
+ * UPDATE only touches a row that is still unused, and we rely on the
+ * affected-row count, so two concurrent attempts with the same code can
+ * succeed at most once.
+ */
+export class ConsumeBackupCodeCommand implements Command<boolean> {
+	constructor(
+		private readonly personId: string,
+		private readonly codeHash: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const affected = await UpdateBuilder.create()
+			.table('person_backup_code')
+			.values({
+				used_at: providers.now(),
+			})
+			.where({
+				person_id: this.personId,
+				code_hash: this.codeHash,
+			})
+			.where(expr => expr.isNull('used_at'))
+			.execute(db)
+
+		return affected > 0
+	}
+}

package/src/model/commands/backupCode/CreateBackupCodeCommand.ts

@@ -0,0 +1,24 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+
+/**
+ * Inserts a single backup code (stored as a hash) for a person.
+ */
+export class CreateBackupCodeCommand implements Command<void> {
+	constructor(
+		private readonly personId: string,
+		private readonly codeHash: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await InsertBuilder.create()
+			.into('person_backup_code')
+			.values({
+				id: providers.uuid(),
+				person_id: this.personId,
+				code_hash: this.codeHash,
+				created_at: providers.now(),
+			})
+			.execute(db)
+	}
+}

package/src/model/commands/backupCode/DeleteBackupCodesCommand.ts

@@ -0,0 +1,16 @@
+import { Command } from '../Command.js'
+import { DeleteBuilder } from '@contember/database'
+
+/**
+ * Deletes all backup codes (used and unused) for a person.
+ */
+export class DeleteBackupCodesCommand implements Command<void> {
+	constructor(private readonly personId: string) {}
+
+	async execute({ db }: Command.Args): Promise<void> {
+		await DeleteBuilder.create()
+			.from('person_backup_code')
+			.where({ person_id: this.personId })
+			.execute(db)
+	}
+}

package/src/model/commands/backupCode/index.ts

@@ -0,0 +1,3 @@
+export * from './ConsumeBackupCodeCommand.js'
+export * from './CreateBackupCodeCommand.js'
+export * from './DeleteBackupCodesCommand.js'

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -1,7 +1,7 @@
-import { Command } from '../Command'
-import { ConfigInput } from '../../../schema'
+import { Command } from '../Command.js'
+import { ConfigInput } from '../../../schema/index.js'
 import { UpdateBuilder } from '@contember/database'
-import { ConfigRow } from '../../type/Config'
+import { ConfigRow } from '../../type/Config.js'
 import { IPostgresInterval } from 'postgres-interval'
 
 export class UpdateConfigurationCommand implements Command<void> {
@@ -10,13 +10,32 @@ export class UpdateConfigurationCommand implements Command<void> {
 	) {
 	}
 
-	async execute({ db }: Command.Args): Promise<void> {
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const captcha = this.configuration.captcha
+		const rl = this.configuration.rateLimits
+
+		// Null and omission preserve the stored secret; only an empty string clears it.
+		let captchaSecretCol: Buffer | null | undefined
+		let captchaSecretVersionCol: number | null | undefined
+		if (captcha?.secret !== undefined && captcha.secret !== null) {
+			if (captcha.secret === '') {
+				captchaSecretCol = null
+				captchaSecretVersionCol = null
+			} else {
+				const encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))
+				captchaSecretCol = encrypted.value
+				captchaSecretVersionCol = encrypted.version
+			}
+		}
+
 		const result = await UpdateBuilder.create()
 			.table('config')
 			.where({ id: 'singleton' })
 			.values(
 				{
 					passwordless_enabled: this.configuration.passwordless?.enabled ?? undefined,
+					signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,
+					require_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,
 					passwordless_url: this.configuration.passwordless?.url,
 					passwordless_expiration: this.configuration.passwordless?.expiration ?? undefined,
 					password_min_length: this.configuration.password?.minLength ?? undefined,
@@ -26,12 +45,41 @@ export class UpdateConfigurationCommand implements Command<void> {
 					password_require_special: this.configuration.password?.requireSpecial ?? undefined,
 					password_pattern: this.configuration.password?.pattern,
 					password_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,
+					password_check_hibp: this.configuration.password?.checkHibp ?? undefined,
 					login_base_backoff: this.configuration.login?.baseBackoff ?? undefined,
 					login_max_backoff: this.configuration.login?.maxBackoff ?? undefined,
 					login_attempt_window: this.configuration.login?.attemptWindow ?? undefined,
 					login_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,
+					login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,
 					login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,
 					login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+					login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,
+					login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,
+					login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,
+					login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,
+					login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,
+					captcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,
+					captcha_secret: captchaSecretCol,
+					captcha_secret_version: captchaSecretVersionCol,
+					captcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,
+					captcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,
+					captcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,
+					captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,
+					captcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,
+					rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,
+					rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,
+					rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,
+					rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,
+					rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,
+					rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,
+					rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,
+					rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,
+					rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,
+					rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,
+					rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,
+					rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,
+					panel_global_roles: this.configuration.panel?.globalRoles ?? undefined,
+					panel_project_roles: this.configuration.panel?.projectRoles ?? undefined,
 				} satisfies {
 					[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined
 				},

package/src/model/commands/configuration/index.ts

@@ -1 +1 @@
-export * from './UpdateConfigurationCommand'
+export * from './UpdateConfigurationCommand.js'

package/src/model/commands/customRole/CreateCustomRoleCommand.ts

@@ -0,0 +1,30 @@
+import { Command } from '../Command.js'
+import { InsertBuilder } from '@contember/database'
+
+/** Inserts a new `custom_role` row. Returns the generated id. */
+export class CreateCustomRoleCommand implements Command<string> {
+	constructor(
+		private readonly values: {
+			slug: string
+			description: string | null
+			grants: unknown
+		},
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<string> {
+		const id = providers.uuid()
+		const now = providers.now()
+		await InsertBuilder.create()
+			.into('custom_role')
+			.values({
+				id,
+				slug: this.values.slug,
+				description: this.values.description,
+				grants: JSON.stringify(this.values.grants),
+				created_at: now,
+				updated_at: now,
+			})
+			.execute(db)
+		return id
+	}
+}

package/src/model/commands/customRole/DeleteCustomRoleCommand.ts

@@ -0,0 +1,20 @@
+import { Command } from '../Command.js'
+import { DeleteBuilder } from '@contember/database'
+
+/**
+ * Removes a role definition outright. The slug becomes reusable; the audit log
+ * (`custom_role_change`) is what preserves the trace of what it used to grant.
+ * Callers must strip the slug from every identity in the same transaction —
+ * see `RemoveCustomRoleAssignmentsCommand`.
+ */
+export class DeleteCustomRoleCommand implements Command<boolean> {
+	constructor(private readonly slug: string) {}
+
+	async execute({ db }: Command.Args): Promise<boolean> {
+		const result = await DeleteBuilder.create()
+			.from('custom_role')
+			.where({ slug: this.slug })
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.ts

@@ -0,0 +1,20 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+/** Returns the identities the slug was stripped from, so the delete can audit who actually lost it. */
+export class RemoveCustomRoleAssignmentsCommand implements Command<string[]> {
+	constructor(private readonly slug: string) {
+	}
+
+	async execute({ db }: Command.Args): Promise<string[]> {
+		const result = await UpdateBuilder.create()
+			.table('identity')
+			.where(expr => expr.raw('roles \\? ?', this.slug))
+			.values({
+				roles: expr => expr.raw('roles - ?', this.slug),
+			})
+			.returning('id')
+			.execute(db)
+		return result.map(row => row.id as string)
+	}
+}

package/src/model/commands/customRole/UpdateCustomRoleCommand.ts

@@ -0,0 +1,30 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+/**
+ * Updates an existing `custom_role` row. Only the supplied fields are written
+ * (an `undefined` field is left untouched; an explicit `null` description clears it).
+ * `updated_at` is always bumped. Returns whether a row was affected.
+ */
+export class UpdateCustomRoleCommand implements Command<boolean> {
+	constructor(
+		private readonly slug: string,
+		private readonly values: {
+			description?: string | null
+			grants?: unknown
+		},
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<boolean> {
+		const result = await UpdateBuilder.create()
+			.table('custom_role')
+			.where({ slug: this.slug })
+			.values({
+				description: this.values.description,
+				grants: this.values.grants === undefined ? undefined : JSON.stringify(this.values.grants),
+				updated_at: providers.now(),
+			})
+			.execute(db)
+		return result > 0
+	}
+}

package/src/model/commands/customRole/index.ts

@@ -0,0 +1,4 @@
+export * from './CreateCustomRoleCommand.js'
+export * from './DeleteCustomRoleCommand.js'
+export * from './RemoveCustomRoleAssignmentsCommand.js'
+export * from './UpdateCustomRoleCommand.js'

package/src/model/commands/identity/CreateIdentityCommand.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { InsertBuilder } from '@contember/database'
 
 export class CreateIdentityCommand implements Command<string> {

package/src/model/commands/identity/PatchIdentityGlobalRoles.ts

@@ -1,4 +1,4 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { UpdateBuilder } from '@contember/database'
 
 export class PatchIdentityGlobalRoles implements Command<boolean> {
@@ -19,7 +19,7 @@ export class PatchIdentityGlobalRoles implements Command<boolean> {
 				roles: it =>
 					it.raw(
 						`(
-						SELECT JSONB_AGG(DISTINCT out_role)
+						SELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)
 						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
 						WHERE NOT(out_role = ANY (?::text[]))
 					)`,

package/src/model/commands/identity/index.ts

@@ -1,2 +1,2 @@
-export * from './CreateIdentityCommand'
-export * from './PatchIdentityGlobalRoles'
+export * from './CreateIdentityCommand.js'
+export * from './PatchIdentityGlobalRoles.js'

package/src/model/commands/idp/ClaimIdpRevalidationCommand.ts

@@ -0,0 +1,29 @@
+import { UpdateBuilder } from '@contember/database'
+import { Command } from '../Command.js'
+
+/**
+ * Atomically claim the right to re-validate a federated session: bump `last_validated_at`
+ * to now() iff the throttle window has elapsed. Returns true only to the single request
+ * that wins the claim, false to everyone else (still inside the window, or lost the race).
+ *
+ * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,
+ * where two concurrent revalidations would rotate the refresh token and invalidate each
+ * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.
+ */
+export class ClaimIdpRevalidationCommand implements Command<boolean> {
+	constructor(
+		private readonly id: string,
+		private readonly interval: string,
+	) {
+	}
+
+	async execute({ db }: Command.Args): Promise<boolean> {
+		const qb = UpdateBuilder.create()
+			.table('idp_session')
+			.where({ id: this.id })
+			.where(expr => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval))
+			.values({ last_validated_at: expr => expr.raw('now()') })
+
+		return (await qb.execute(db)) > 0
+	}
+}

package/src/model/commands/idp/CreateIdpCommand.ts

@@ -1,6 +1,6 @@
-import { Command } from '../Command'
+import { Command } from '../Command.js'
 import { InsertBuilder } from '@contember/database'
-import { IdentityProviderData } from '../../type'
+import { IdentityProviderData } from '../../type/index.js'
 
 export class CreateIdpCommand implements Command<void> {
 	constructor(
@@ -9,7 +9,12 @@ export class CreateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data
+		const {
+			configuration,
+			options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+			slug,
+			type,
+		} = this.data
 		await InsertBuilder.create()
 			.into('identity_provider')
 			.values({
@@ -20,6 +25,9 @@ export class CreateIdpCommand implements Command<void> {
 				auto_sign_up: autoSignUp,
 				exclusive,
 				init_returns_config: initReturnsConfig,
+				require_verified_email: requireVerifiedEmail,
+				assume_email_verified: assumeEmailVerified,
+				disable_local_authentication: disableLocalAuthentication,
 			})
 			.execute(db)
 	}