@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/resolvers/TenantResolverContextFactory.ts

@@ -1,15 +1,17 @@
-import { TenantResolverContext } from './TenantResolverContext'
-import { DatabaseContext, PermissionContext, PermissionContextFactory } from '../model'
+import { TenantResolverContext } from './TenantResolverContext.js'
+import { DatabaseContext, LoginRiskAnalyzer, PermissionContext, PermissionContextFactory } from '../model/index.js'
 import { Logger } from '@contember/logger'
-import { AuthLogService } from '../model/service/AuthLogService'
+import { AuthLogService } from '../model/service/AuthLogService.js'
 
-export const createResolverContext = (permissionContext: PermissionContext, apiKeyId: string) => {
+export const createResolverContext = (permissionContext: PermissionContext, apiKeyId: string, trustForwardedInfo = false) => {
 	return {
 		apiKeyId: apiKeyId,
+		trustForwardedInfo,
 		permissionContext,
 		identity: permissionContext.identity,
 		isAllowed: permissionContext.isAllowed.bind(permissionContext),
 		requireAccess: permissionContext.requireAccess.bind(permissionContext),
+		httpInfo: { ip: '' },
 	}
 }
 
@@ -17,27 +19,40 @@ export class TenantResolverContextFactory {
 	constructor(
 		private readonly permissionContextFactory: PermissionContextFactory,
 		private readonly authLogService: AuthLogService,
+		private readonly loginRiskAnalyzer: LoginRiskAnalyzer,
 	) {}
 
-	public create(
-		authContext: { apiKeyId: string; identityId: string; roles: string[] },
-		httpInfo: { ip: string; userAgent?: string },
+	public async create(
+		authContext: { apiKeyId: string; identityId: string; roles: string[]; trustForwardedInfo?: boolean },
+		httpInfo: { ip: string; userAgent?: string; forwarderIp?: string; forwarderUserAgent?: string; geoCountry?: string },
 		db: DatabaseContext,
 		logger: Logger,
-	): TenantResolverContext {
-		const permissionContext = this.permissionContextFactory.create(db, {
+	): Promise<TenantResolverContext> {
+		const permissionContext = await this.permissionContextFactory.createPreloaded(db, {
 			id: authContext.identityId,
 			roles: authContext.roles,
 		})
+		// A03: stamp every auth-log row with the trusted geo country (when present)
+		// and a UA fingerprint, so the next sign-in's anomaly check has a baseline.
+		const deviceFingerprint = this.loginRiskAnalyzer.fingerprint(httpInfo.userAgent) ?? undefined
 		return {
-			...createResolverContext(permissionContext, authContext.apiKeyId),
-			logAuthAction: async data => {
-				await this.authLogService.logAuthAction(db, {
+			...createResolverContext(permissionContext, authContext.apiKeyId, authContext.trustForwardedInfo ?? false),
+			logAuthAction: async (data, transaction) => {
+				await this.authLogService.logAuthAction(transaction ?? db, {
 					identityId: authContext.identityId,
 					userAgent: httpInfo.userAgent,
 					clientIp: httpInfo.ip,
+					forwarderIp: httpInfo.forwarderIp,
+					forwarderUserAgent: httpInfo.forwarderUserAgent,
+					geoCountry: httpInfo.geoCountry,
+					deviceFingerprint,
 				}, data)
 			},
+			httpInfo: {
+				ip: httpInfo.ip,
+				userAgent: httpInfo.userAgent,
+				geoCountry: httpInfo.geoCountry,
+			},
 			db,
 			logger,
 		}

package/src/resolvers/errorUtils.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '../model/utils/Response'
+import { ResponseError } from '../model/utils/Response.js'
 
 type Error<T> = { code: T; developerMessage: string }
 type ErrorResponse<T, Meta = {}> = { ok: false; error: Error<T> & Meta; errors: [Error<T> & Meta] }

package/src/resolvers/index.ts

@@ -1,6 +1,6 @@
-export * from './mutation'
-export * from './query'
-export * from './types'
-export * from './TenantResolverContext'
-export * from './ResolverFactory'
-export * from './TenantResolverContextFactory'
+export * from './mutation/index.js'
+export * from './query/index.js'
+export * from './types/index.js'
+export * from './TenantResolverContext.js'
+export * from './ResolverFactory.js'
+export * from './TenantResolverContextFactory.js'

package/src/resolvers/membershipUtils.ts

@@ -1,5 +1,5 @@
-import { MembershipValidationError, MembershipValidationErrorType } from '../model/service/MembershipValidator'
-import { MembershipValidationError as MembershipValidationErrorSchema, MembershipValidationErrorCode } from '../schema'
+import { MembershipValidationError, MembershipValidationErrorType } from '../model/service/MembershipValidator.js'
+import { MembershipValidationError as MembershipValidationErrorSchema, MembershipValidationErrorCode } from '../schema/index.js'
 
 export type MembershipErrorCode =
 	| 'INVALID_MEMBERSHIP'

package/src/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.ts

@@ -4,13 +4,15 @@ import {
 	MutationCreateApiKeyArgs,
 	MutationCreateGlobalApiKeyArgs,
 	MutationResolvers,
-} from '../../../schema'
+} from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model'
-import { createMembershipValidationErrorResult } from '../../membershipUtils'
-import { createProjectNotFoundResponse } from '../../errorUtils'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ApiKeyManager, isTokenHash, MembershipValidator, PermissionActions, ProjectManager } from '../../../model/index.js'
+import { createMembershipValidationErrorResult } from '../../membershipUtils.js'
+import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
 import { UserInputError } from '@contember/graphql-utils'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { Acl, JSONValue } from '@contember/schema'
 
 export class CreateApiKeyMutationResolver implements MutationResolvers {
 	constructor(
@@ -21,14 +23,15 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 
 	async createApiKey(
 		parent: any,
-		{ projectSlug, memberships, description, tokenHash }: MutationCreateApiKeyArgs,
+		{ projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs,
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
 		const project = await this.projectManager.getProjectBySlug(context.db, projectSlug)
+		const trustForwardedClientInfo = options?.trustForwardedClientInfo === true
 		await context.requireAccess({
 			scope: await context.permissionContext.createProjectScope(project),
-			action: PermissionActions.API_KEY_CREATE,
+			action: PermissionActions.API_KEY_CREATE({ trustForwardedClientInfo }),
 			message: 'You are not allowed to create an API key for this project',
 		})
 		if (!project) {
@@ -47,7 +50,30 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 			}
 		}
 
-		const result = await this.apiKeyManager.createProjectPermanentApiKey(context.db, project.id, memberships, description, tokenHash ?? undefined)
+		const result = await this.apiKeyManager.createProjectPermanentApiKey(
+			context.db,
+			project.id,
+			memberships,
+			description,
+			tokenHash ?? undefined,
+			trustForwardedClientInfo,
+		)
+		if (!result.ok) {
+			return createErrorResponse(result)
+		}
+
+		await context.logAuthAction({
+			type: 'api_key_create',
+			response: new ResponseOk(null),
+			eventData: {
+				scope: 'project',
+				projectSlug: project.slug,
+				apiKeyId: result.result.apiKey.id,
+				identityId: result.result.identity.id,
+				description,
+				memberships: memberships.map(membershipToJson),
+			},
+		})
 
 		return {
 			ok: true,
@@ -60,19 +86,42 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 
 	async createGlobalApiKey(
 		parent: any,
-		{ roles, description, tokenHash }: MutationCreateGlobalApiKeyArgs,
+		{ roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs,
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<CreateApiKeyResponse> {
 		roles ??= []
+		const trustForwardedClientInfo = options?.trustForwardedClientInfo === true
 		await context.requireAccess({
-			action: PermissionActions.API_KEY_CREATE_GLOBAL(roles),
+			action: PermissionActions.API_KEY_CREATE_GLOBAL({ requestedRoles: roles, trustForwardedClientInfo }),
 			message: 'You are not allowed to create a global API key',
 		})
 		if (typeof tokenHash === 'string' && !isTokenHash(tokenHash)) {
 			throw new UserInputError('Invalid format of tokenHash. Must be hex-encoded sha256.')
 		}
-		const result = await this.apiKeyManager.createGlobalPermanentApiKey(context.db, description, roles, tokenHash ?? undefined)
+		const result = await this.apiKeyManager.createGlobalPermanentApiKey(
+			context.db,
+			description,
+			roles,
+			tokenHash ?? undefined,
+			trustForwardedClientInfo,
+		)
+		if (!result.ok) {
+			return createErrorResponse(result)
+		}
+
+		await context.logAuthAction({
+			type: 'api_key_create',
+			response: new ResponseOk(null),
+			eventData: {
+				scope: 'global',
+				apiKeyId: result.result.apiKey.id,
+				identityId: result.result.identity.id,
+				description,
+				roles: [...roles],
+			},
+		})
+
 		return {
 			ok: true,
 			errors: [],
@@ -82,3 +131,8 @@ export class CreateApiKeyMutationResolver implements MutationResolvers {
 		}
 	}
 }
+
+const membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({
+	role,
+	variables: variables.map(({ name, values }) => ({ name, values: [...values] })),
+})

package/src/resolvers/mutation/apiKey/DisableApiKeyMutationResolver.ts

@@ -1,8 +1,9 @@
-import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema'
+import { DisableApiKeyErrorCode, DisableApiKeyResponse, MutationDisableApiKeyArgs, MutationResolvers } from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ApiKeyManager, PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ApiKeyManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class DisableApiKeyMutationResolver implements MutationResolvers {
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
@@ -24,6 +25,12 @@ export class DisableApiKeyMutationResolver implements MutationResolvers {
 			return createErrorResponse('KEY_NOT_FOUND', 'API key not found')
 		}
 
+		await context.logAuthAction({
+			type: 'api_key_disable',
+			response: new ResponseOk(null),
+			eventData: { apiKeyId: id },
+		})
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/apiKey/index.ts

@@ -1,2 +1,2 @@
-export * from './CreateApiKeyMutationResolver'
-export * from './DisableApiKeyMutationResolver'
+export * from './CreateApiKeyMutationResolver.js'
+export * from './DisableApiKeyMutationResolver.js'

package/src/resolvers/mutation/configuration/AuthPolicyMutationResolver.ts

@@ -0,0 +1,125 @@
+import {
+	AuthPolicyInput,
+	CreateAuthPolicyResponse,
+	DeleteAuthPolicyResponse,
+	MutationCreateAuthPolicyArgs,
+	MutationDeleteAuthPolicyArgs,
+	MutationResolvers,
+	MutationUpdateAuthPolicyArgs,
+	UpdateAuthPolicyResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { AuthPolicyManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { JSONValue } from '@contember/schema'
+
+/**
+ * CRUD over `auth_policy` (per-role MFA / session policy). Gated like
+ * `configure` (a tenant-wide admin action). Every mutation audits
+ * `auth_policy_change` with a snapshot of the input. Shared infra reused by A19.
+ */
+export class AuthPolicyMutationResolver implements Pick<MutationResolvers, 'createAuthPolicy' | 'updateAuthPolicy' | 'deleteAuthPolicy'> {
+	constructor(
+		private readonly authPolicyManager: AuthPolicyManager,
+	) {}
+
+	async createAuthPolicy(parent: any, { policy }: MutationCreateAuthPolicyArgs, context: TenantResolverContext): Promise<CreateAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.createPolicy(context.db, this.mapInput(policy))
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'create',
+				id: result.result.id,
+				policy: snapshotInput(policy),
+			},
+		})
+
+		return { ok: true, result: { id: result.result.id } }
+	}
+
+	async updateAuthPolicy(
+		parent: any,
+		{ id, policy }: MutationUpdateAuthPolicyArgs,
+		context: TenantResolverContext,
+	): Promise<UpdateAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.updatePolicy(context.db, id, this.mapInput(policy))
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'update',
+				id,
+				policy: snapshotInput(policy),
+			},
+		})
+
+		return { ok: true }
+	}
+
+	async deleteAuthPolicy(parent: any, { id }: MutationDeleteAuthPolicyArgs, context: TenantResolverContext): Promise<DeleteAuthPolicyResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to manage auth policies',
+		})
+
+		const result = await this.authPolicyManager.deletePolicy(context.db, id)
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		await context.logAuthAction({
+			type: 'auth_policy_change',
+			response: new ResponseOk(null),
+			eventData: {
+				operation: 'delete',
+				id,
+			},
+		})
+
+		return { ok: true }
+	}
+
+	private mapInput(policy: AuthPolicyInput) {
+		return {
+			scope: policy.scope,
+			project: policy.project ?? null,
+			roles: [...policy.roles],
+			mfaRequired: policy.mfaRequired ?? null,
+			tokenExpiration: policy.tokenExpiration ?? null,
+			idleTimeout: policy.idleTimeout ?? null,
+			graceDuration: policy.mfaGraceDuration ?? null,
+			rememberMeAllowed: policy.rememberMeAllowed ?? null,
+		}
+	}
+}
+
+const snapshotInput = (policy: AuthPolicyInput): JSONValue => ({
+	scope: policy.scope,
+	project: policy.project ?? null,
+	roles: [...policy.roles],
+	mfaRequired: policy.mfaRequired ?? null,
+	tokenExpiration: policy.tokenExpiration ?? null,
+	idleTimeout: policy.idleTimeout ?? null,
+	mfaGraceDuration: policy.mfaGraceDuration ?? null,
+	rememberMeAllowed: policy.rememberMeAllowed ?? null,
+})

package/src/resolvers/mutation/configuration/ConfigurationMutationResolver.ts

@@ -1,8 +1,10 @@
-import { ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema'
-import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { ConfigInput, ConfigureResponse, MutationConfigureArgs, MutationResolvers } from '../../../schema/index.js'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { JSONValue } from '@contember/schema'
 
 export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'configure'> {
 	constructor(
@@ -22,8 +24,34 @@ export class ConfigurationMutationResolver implements Pick<MutationResolvers, 'c
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await context.logAuthAction({
+			type: 'tenant_config_change',
+			response: new ResponseOk(null),
+			eventData: {
+				input: redactConfigInput(config),
+			},
+		})
+
 		return {
 			ok: true,
 		}
 	}
 }
+
+/**
+ * Strip secret-bearing fields from a ConfigInput before it lands in the
+ * persistent audit trail. The mere fact that captcha.secret was set is
+ * useful forensics; the value never is.
+ */
+const redactConfigInput = (input: ConfigInput): JSONValue => {
+	const out: Record<string, JSONValue> = { ...(input as unknown as Record<string, JSONValue>) }
+	if (input.captcha) {
+		out.captcha = {
+			...(input.captcha as unknown as Record<string, JSONValue>),
+			secret: input.captcha.secret !== null && input.captcha.secret !== undefined && input.captcha.secret !== ''
+				? '***'
+				: input.captcha.secret ?? null,
+		}
+	}
+	return out as JSONValue
+}

package/src/resolvers/mutation/customRole/CustomRoleMutationResolver.ts

@@ -0,0 +1,125 @@
+import {
+	CreateCustomRoleResponse,
+	DeleteCustomRoleResponse,
+	MutationCreateCustomRoleArgs,
+	MutationDeleteCustomRoleArgs,
+	MutationResolvers,
+	MutationUpdateCustomRoleArgs,
+	UpdateCustomRoleResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { CustomRoleManager, PermissionActions } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+
+/**
+ * CRUD over `custom_role` (runtime-defined global roles). Gated by `customRole:manage`,
+ * which is deliberately NOT grantable to a custom role — by default only SUPER_ADMIN
+ * (via the wildcard grant) can manage role definitions.
+ */
+export class CustomRoleMutationResolver implements Pick<MutationResolvers, 'createCustomRole' | 'updateCustomRole' | 'deleteCustomRole'> {
+	constructor(
+		private readonly customRoleManager: CustomRoleManager,
+	) {}
+
+	async createCustomRole(parent: any, args: MutationCreateCustomRoleArgs, context: TenantResolverContext): Promise<CreateCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		// the conflict is caught out here: a unique violation aborts the transaction, so
+		// mapping it inside would return normally and then fail on COMMIT
+		let result
+		try {
+			result = await context.db.transaction(async db => {
+				const result = await this.customRoleManager.createRole(db, {
+					slug: args.slug,
+					description: args.description ?? null,
+					grants: args.grants,
+				})
+				if (result.ok) {
+					await context.logAuthAction({
+						type: 'custom_role_change',
+						response: new ResponseOk(null),
+						eventData: {
+							operation: 'create',
+							after: result.result.role,
+						},
+					}, db)
+				}
+				return result
+			}, { isolation: 'readCommitted' })
+		} catch (error) {
+			if (CustomRoleManager.isSlugConflict(error)) {
+				return createErrorResponse('SLUG_ALREADY_EXISTS', `Custom role ${args.slug} already exists`)
+			}
+			throw error
+		}
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+
+	async updateCustomRole(parent: any, args: MutationUpdateCustomRoleArgs, context: TenantResolverContext): Promise<UpdateCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		const result = await context.db.transaction(async db => {
+			const result = await this.customRoleManager.updateRole(db, args.slug, {
+				description: args.description,
+				grants: args.grants,
+			})
+			if (result.ok) {
+				await context.logAuthAction({
+					type: 'custom_role_change',
+					response: new ResponseOk(null),
+					eventData: {
+						operation: 'update',
+						before: result.result.before,
+						after: result.result.after,
+					},
+				}, db)
+			}
+			return result
+		}, { isolation: 'readCommitted' })
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+
+	async deleteCustomRole(parent: any, args: MutationDeleteCustomRoleArgs, context: TenantResolverContext): Promise<DeleteCustomRoleResponse> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_MANAGE,
+			message: 'You are not allowed to manage custom roles',
+		})
+
+		const result = await context.db.transaction(async db => {
+			const result = await this.customRoleManager.deleteRole(db, args.slug)
+			if (result.ok) {
+				await context.logAuthAction({
+					type: 'custom_role_change',
+					response: new ResponseOk(null),
+					eventData: {
+						operation: 'delete',
+						before: result.result.before,
+						removedAssignments: result.result.removedAssignments,
+						removedAssignmentIdentityIds: [...result.result.removedAssignmentIdentityIds],
+					},
+				}, db)
+			}
+			return result
+		}, { isolation: 'readCommitted' })
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return { ok: true }
+	}
+}

package/src/resolvers/mutation/identity/GlobalRolesMutationResolver.ts

@@ -4,12 +4,14 @@ import {
 	MutationRemoveGlobalIdentityRolesArgs,
 	MutationResolvers,
 	RemoveGlobalIdentityRolesResponse,
-} from '../../../schema'
+} from '../../../schema/index.js'
 import { GraphQLResolveInfo } from 'graphql'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
-import { RolesManager } from '../../../model'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { createTargetIdentityPermissionTarget, PermissionActions, RolesManager } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
+import { IdentityQuery } from '../../../model/queries/identity/IdentityQuery.js'
+import { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 	constructor(
@@ -23,21 +25,36 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 		context: TenantResolverContext,
 		info: GraphQLResolveInfo,
 	): Promise<AddGlobalIdentityRolesResponse> {
+		// cheap gate first, so a caller holding the permission in no form cannot probe identity existence
 		await context.requireAccess({
-			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(roles),
+			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(),
 			message: 'You are not allowed to add global roles',
 		})
 
-		const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)
+		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
+		if (before === undefined) {
+			return createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
+		}
+		await context.requireAccess({
+			action: PermissionActions.IDENTITY_ADD_GLOBAL_ROLES({
+				requestedRoles: roles,
+				target: await createTargetIdentityPermissionTarget(context.db, before),
+				self: identityId === context.identity.id,
+			}),
+			message: 'You are not allowed to add these global roles',
+		})
 
+		const result = await this.rolesManager.addGlobalRoles(context.db, identityId, roles)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await this.logRolesChange(context, identityId, 'global_role_grant', before.roles)
+
 		return {
 			ok: true,
 			result: {
-				identity: { id: identityId, projects: [] },
+				identity: { id: identityId, projects: [], sessions: [] },
 			},
 		}
 	}
@@ -49,21 +66,54 @@ export class IdentityGlobalRolesMutationResolver implements MutationResolvers {
 		info: GraphQLResolveInfo,
 	): Promise<RemoveGlobalIdentityRolesResponse> {
 		await context.requireAccess({
-			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(roles),
+			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(),
 			message: 'You are not allowed to remove global roles',
 		})
 
-		const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)
+		const [before] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
+		if (before === undefined) {
+			return createErrorResponse('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
+		}
+		await context.requireAccess({
+			action: PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES({
+				requestedRoles: roles,
+				target: await createTargetIdentityPermissionTarget(context.db, before),
+				self: identityId === context.identity.id,
+			}),
+			message: 'You are not allowed to remove these global roles',
+		})
 
+		const result = await this.rolesManager.removeGlobalRoles(context.db, identityId, roles)
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await this.logRolesChange(context, identityId, 'global_role_revoke', before.roles)
+
 		return {
 			ok: true,
 			result: {
-				identity: { id: identityId, projects: [] },
+				identity: { id: identityId, projects: [], sessions: [] },
 			},
 		}
 	}
+
+	private async logRolesChange(
+		context: TenantResolverContext,
+		identityId: string,
+		auditType: 'global_role_grant' | 'global_role_revoke',
+		beforeRoles: readonly string[],
+	): Promise<void> {
+		const [after] = await context.db.queryHandler.fetch(new IdentityQuery([identityId]))
+		const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))
+		await context.logAuthAction({
+			type: auditType,
+			response: new ResponseOk(null),
+			targetPersonId: targetPerson?.id,
+			eventData: {
+				before: { roles: beforeRoles },
+				after: { roles: after?.roles ?? [] },
+			},
+		})
+	}
 }