@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/resolvers/mutation/person/SignUpMutationResolver.ts

@@ -1,12 +1,33 @@
-import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ApiKeyManager, NoPassword, PasswordHash, PasswordPlain, PermissionActions, SignUpManager } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { MutationResolvers, MutationSignUpArgs, SignUpResponse } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import {
+	ApiKeyManager,
+	CaptchaValidator,
+	ConfigurationQuery,
+	EmailVerificationManager,
+	NoPassword,
+	PasswordHash,
+	PasswordPlain,
+	PermissionActions,
+	PermissionContextFactory,
+	PersonQuery,
+	RateLimiter,
+	SignUpManager,
+} from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
 import { UserInputError } from '@contember/graphql-utils'
-import { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory'
+import { PersonResponseFactory } from '../../responseHelpers/PersonResponseFactory.js'
+import { ResponseError, ResponseOk } from '../../../model/utils/Response.js'
 
 export class SignUpMutationResolver implements MutationResolvers {
-	constructor(private readonly signUpManager: SignUpManager, private readonly apiKeyManager: ApiKeyManager) {}
+	constructor(
+		private readonly signUpManager: SignUpManager,
+		private readonly apiKeyManager: ApiKeyManager,
+		private readonly captchaValidator: CaptchaValidator,
+		private readonly rateLimiter: RateLimiter,
+		private readonly emailVerificationManager: EmailVerificationManager,
+		private readonly permissionContextFactory: PermissionContextFactory,
+	) {}
 
 	async signUp(parent: any, args: MutationSignUpArgs, context: TenantResolverContext): Promise<SignUpResponse> {
 		const roles = args.roles ?? []
@@ -14,6 +35,28 @@ export class SignUpMutationResolver implements MutationResolvers {
 			action: PermissionActions.PERSON_SIGN_UP(roles),
 			message: 'You are not allowed to sign up',
 		})
+
+		const configuration = await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))
+
+		const rl = await this.rateLimiter.consume(context.db, 'sign_up_per_ip', context.httpInfo.ip, configuration)
+		if (!rl.ok) {
+			return createErrorResponse(
+				new ResponseError('RATE_LIMIT_EXCEEDED', `Too many sign-up attempts. Retry after ${rl.retryAfterSeconds}s.`),
+			)
+		}
+
+		const captchaConfig = this.captchaValidator.extractConfig(configuration)
+		if (this.captchaValidator.isEnabledFor(captchaConfig, 'signUp')) {
+			const captcha = await this.captchaValidator.verify({
+				config: captchaConfig,
+				token: args.captchaToken ?? undefined,
+				remoteIp: context.httpInfo.ip,
+			})
+			if (!captcha.ok) {
+				return createErrorResponse('INVALID_CAPTCHA', `Captcha verification failed: ${captcha.reason}`)
+			}
+		}
+
 		const password = (() => {
 			if (args.password) {
 				return new PasswordPlain(args.password)
@@ -32,6 +75,7 @@ export class SignUpMutationResolver implements MutationResolvers {
 			name: args.name ?? undefined,
 			password,
 			roles,
+			config: configuration,
 		})
 
 		if (!response.ok) {
@@ -40,6 +84,27 @@ export class SignUpMutationResolver implements MutationResolvers {
 		const result = response.result
 		await this.apiKeyManager.disableOneOffApiKey(context.db, context.apiKeyId)
 
+		if (result.emailVerificationRequired) {
+			// Re-fetch to get the identity roles needed for the project lookup
+			// the verification mail is scoped to.
+			const personRow = await context.db.queryHandler.fetch(PersonQuery.byId(result.person.id))
+			if (personRow?.email) {
+				const permissionContext = await this.permissionContextFactory.create(context.db, {
+					id: personRow.identity_id,
+					roles: personRow.roles,
+				}, context.permissionContext.authorizator)
+				const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)
+				if (sent) {
+					await context.logAuthAction({
+						type: 'email_verify_init',
+						response: new ResponseOk(null),
+						personId: personRow.id,
+						personInput: personRow.email,
+					})
+				}
+			}
+		}
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/person/TogglePasswordlessMutationResolver.ts

@@ -1,8 +1,8 @@
-import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema'
-import { ConfigurationManager } from '../../../model/service/ConfigurationManager'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { MutationResolvers, ToggleMyPasswordlessResponse } from '../../../schema/index.js'
+import { ConfigurationManager } from '../../../model/service/ConfigurationManager.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ConfigurationQuery, PermissionActions, PersonManager, PersonQuery } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
 
 export class TogglePasswordlessMutationResolver implements Pick<MutationResolvers, 'enableMyPasswordless' | 'disableMyPasswordless'> {
 	constructor(
@@ -31,7 +31,7 @@ export class TogglePasswordlessMutationResolver implements Pick<MutationResolver
 			action: PermissionActions.PERSON_TOGGLE_PASSWORDLESS,
 			message: 'You are not allowed to enable passwordless',
 		})
-		const config = await await context.db.queryHandler.fetch(new ConfigurationQuery())
+		const config = await await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))
 		if (config.passwordless?.enabled === 'always' || config.passwordless?.enabled === 'never') {
 			return createErrorResponse('CANNOT_TOGGLE', 'Passwordless is configured globally and cannot be toggled')
 		}

package/src/resolvers/mutation/person/index.ts

@@ -1,9 +1,12 @@
-export * from './ChangeProfileMutationResolver'
-export * from './ChangePasswordMutationResolver'
-export * from './IDPMutationResolver'
-export * from './InviteMutationResolver'
-export * from './OtpMutationResolver'
-export * from './ResetPasswordMutationResolver'
-export * from './SignInMutationResolver'
-export * from './SignOutMutationResolver'
-export * from './SignUpMutationResolver'
+export * from './ChangeProfileMutationResolver.js'
+export * from './ChangePasswordMutationResolver.js'
+export * from './EmailVerificationMutationResolver.js'
+export * from './IDPMutationResolver.js'
+export * from './InviteMutationResolver.js'
+export * from './OtpMutationResolver.js'
+export * from './EmailOtpMutationResolver.js'
+export * from './RegenerateBackupCodesMutationResolver.js'
+export * from './ResetPasswordMutationResolver.js'
+export * from './SignInMutationResolver.js'
+export * from './SignOutMutationResolver.js'
+export * from './SignUpMutationResolver.js'

package/src/resolvers/mutation/project/CreateProjectMutationResolver.ts

@@ -1,8 +1,9 @@
-import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model'
-import { createErrorResponse } from '../../errorUtils'
+import { CreateProjectResponse, MutationCreateProjectArgs, MutationResolvers } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { isTokenHash, PermissionActions, ProjectManager, TenantRole } from '../../../model/index.js'
+import { createErrorResponse } from '../../errorUtils.js'
 import { UserInputError } from '@contember/graphql-utils'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class CreateProjectMutationResolver implements MutationResolvers {
 	constructor(private readonly projectManager: ProjectManager) {}
@@ -48,6 +49,17 @@ export class CreateProjectMutationResolver implements MutationResolvers {
 		if (!response.ok) {
 			return createErrorResponse(response.error, response.errorMessage)
 		}
+
+		await context.logAuthAction({
+			type: 'project_create',
+			response: new ResponseOk(null),
+			eventData: {
+				slug: projectSlug,
+				name: name || projectSlug,
+				secretKeys: (secrets ?? []).map(it => it.key).sort(),
+			},
+		})
+
 		return {
 			ok: true,
 			error: null,

package/src/resolvers/mutation/project/SetProjectSecretMutationResolver.ts

@@ -4,10 +4,11 @@ import {
 	MutationResolvers,
 	MutationSetProjectSecretArgs,
 	SetProjectSecretResponse,
-} from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, ProjectManager, SecretsManager } from '../../../model'
-import { createProjectNotFoundResponse } from '../../errorUtils'
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions, ProjectManager, SecretsManager } from '../../../model/index.js'
+import { createProjectNotFoundResponse } from '../../errorUtils.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class SetProjectSecretMutationResolver implements MutationResolvers {
 	constructor(private readonly projectManager: ProjectManager, private readonly secretManager: SecretsManager) {}
@@ -27,6 +28,16 @@ export class SetProjectSecretMutationResolver implements MutationResolvers {
 			return createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)
 		}
 		await this.secretManager.setSecret(context.db, project.id, args.key, args.value)
+
+		await context.logAuthAction({
+			type: 'project_secret_change',
+			response: new ResponseOk(null),
+			eventData: {
+				slug: project.slug,
+				key: args.key,
+			},
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/project/UpdateProjectMutationResolver.ts

@@ -1,8 +1,9 @@
-import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, ProjectManager } from '../../../model'
-import { createProjectNotFoundResponse } from '../../errorUtils'
+import { MutationResolvers, MutationUpdateProjectArgs, UpdateProjectResponse } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions, ProjectManager } from '../../../model/index.js'
+import { createProjectNotFoundResponse } from '../../errorUtils.js'
 import { Merger } from '@contember/config-loader'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class UpdateProjectMutationResolver implements MutationResolvers {
 	constructor(private readonly projectManager: ProjectManager) {}
@@ -21,10 +22,23 @@ export class UpdateProjectMutationResolver implements MutationResolvers {
 		if (!project) {
 			return createProjectNotFoundResponse('PROJECT_NOT_FOUND', args.projectSlug)
 		}
+		const nameChange = args.name && args.name !== project.name ? { before: project.name, after: args.name } : undefined
+		const configChanged = args.config !== undefined
 		await this.projectManager.updateProject(context.db, project.id, {
 			name: args.name || undefined,
 			config: args.config !== undefined ? Merger.merge(args.mergeConfig ? project.config : {}, args.config as any) : undefined,
 		})
+
+		await context.logAuthAction({
+			type: 'project_update',
+			response: new ResponseOk(null),
+			eventData: {
+				slug: project.slug,
+				...(nameChange ? { name: nameChange } : {}),
+				...(configChanged ? { configChanged: true, mergeConfig: args.mergeConfig ?? false } : {}),
+			},
+		})
+
 		return { ok: true }
 	}
 }

package/src/resolvers/mutation/project/index.ts

@@ -1,3 +1,3 @@
-export * from './CreateProjectMutationResolver'
-export * from './SetProjectSecretMutationResolver'
-export * from './UpdateProjectMutationResolver'
+export * from './CreateProjectMutationResolver.js'
+export * from './SetProjectSecretMutationResolver.js'
+export * from './UpdateProjectMutationResolver.js'

package/src/resolvers/mutation/projectMember/AddProjectMemberMutationResolver.ts

@@ -1,8 +1,9 @@
-import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'
-import { createMembershipValidationErrorResult } from '../../membershipUtils'
-import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'
+import { AddProjectMemberErrorCode, AddProjectMemberResponse, MutationAddProjectMemberArgs, MutationResolvers } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'
+import { createMembershipValidationErrorResult } from '../../membershipUtils.js'
+import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
+import { logProjectMembershipChange } from './audit.js'
 
 export class AddProjectMemberMutationResolver implements MutationResolvers {
 	constructor(
@@ -41,6 +42,8 @@ export class AddProjectMemberMutationResolver implements MutationResolvers {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await logProjectMembershipChange(context, 'project_membership_create', project.id, identityId, [])
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.ts

@@ -1,7 +1,14 @@
-import { MutationRemoveProjectMemberArgs, MutationResolvers, RemoveProjectMemberErrorCode, RemoveProjectMemberResponse } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'
-import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'
+import {
+	MutationRemoveProjectMemberArgs,
+	MutationResolvers,
+	RemoveProjectMemberErrorCode,
+	RemoveProjectMemberResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'
+import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
+import { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'
+import { logProjectMembershipChange } from './audit.js'
 
 export class RemoveProjectMemberMutationResolver implements MutationResolvers {
 	constructor(
@@ -36,12 +43,15 @@ export class RemoveProjectMemberMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to remove a project member',
 		})
 
+		const before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))
 		const result = await this.projectMemberManager.removeProjectMember(context.db, project.id, identityId)
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await logProjectMembershipChange(context, 'project_membership_remove', project.id, identityId, before)
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.ts

@@ -1,10 +1,17 @@
-import { MutationResolvers, MutationUpdateProjectMemberArgs, UpdateProjectMemberErrorCode, UpdateProjectMemberResponse } from '../../../schema'
-import { TenantResolverContext } from '../../TenantResolverContext'
-import { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model'
-import { createMembershipValidationErrorResult } from '../../membershipUtils'
-import { createMembershipModification } from '../../../model/service/membershipUtils'
-import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils'
+import {
+	MutationResolvers,
+	MutationUpdateProjectMemberArgs,
+	UpdateProjectMemberErrorCode,
+	UpdateProjectMemberResponse,
+} from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { MembershipValidationErrorType, MembershipValidator, PermissionActions, ProjectManager, ProjectMemberManager } from '../../../model/index.js'
+import { createMembershipValidationErrorResult } from '../../membershipUtils.js'
+import { createMembershipModification } from '../../../model/service/membershipUtils.js'
+import { createErrorResponse, createProjectNotFoundResponse } from '../../errorUtils.js'
 import { Acl } from '@contember/schema'
+import { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'
+import { logProjectMembershipChange } from './audit.js'
 
 export class UpdateProjectMemberMutationResolver implements MutationResolvers {
 	constructor(
@@ -62,12 +69,15 @@ export class UpdateProjectMemberMutationResolver implements MutationResolvers {
 			}
 		}
 
+		const before = await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))
 		const result = await this.projectMemberManager.updateProjectMember(context.db, project.id, identityId, membershipPatch)
 
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)
 		}
 
+		await logProjectMembershipChange(context, 'project_membership_update', project.id, identityId, before)
+
 		return {
 			ok: true,
 			errors: [],

package/src/resolvers/mutation/projectMember/audit.ts

@@ -0,0 +1,35 @@
+import { Acl, JSONValue } from '@contember/schema'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { ProjectMembershipByIdentityQuery } from '../../../model/queries/index.js'
+import { PersonByIdentityBatchQuery } from '../../../model/queries/person/PersonByIdentityBatchQuery.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
+import { AuthActionType } from '../../../model/type/AuthLog.js'
+
+export const logProjectMembershipChange = async (
+	context: TenantResolverContext,
+	auditType: Extract<AuthActionType, 'project_membership_create' | 'project_membership_update' | 'project_membership_remove'>,
+	projectId: string,
+	identityId: string,
+	before: readonly Acl.Membership[],
+): Promise<void> => {
+	const after = auditType === 'project_membership_remove'
+		? []
+		: await context.db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: projectId }, [identityId]))
+	const [targetPerson] = await context.db.queryHandler.fetch(new PersonByIdentityBatchQuery([identityId]))
+	await context.logAuthAction({
+		type: auditType,
+		response: new ResponseOk(null),
+		targetPersonId: targetPerson?.id,
+		eventData: {
+			projectId,
+			identityId,
+			before: before.map(membershipToJson),
+			after: after.map(membershipToJson),
+		},
+	})
+}
+
+const membershipToJson = ({ role, variables }: Acl.Membership): JSONValue => ({
+	role,
+	variables: variables.map(({ name, values }) => ({ name, values: [...values] })),
+})

package/src/resolvers/mutation/projectMember/index.ts

@@ -1,3 +1,3 @@
-export * from './AddProjectMemberMutationResolver'
-export * from './RemoveProjectMemberMutationResolver'
-export * from './UpdateProjectMemberMutationResolver'
+export * from './AddProjectMemberMutationResolver.js'
+export * from './RemoveProjectMemberMutationResolver.js'
+export * from './UpdateProjectMemberMutationResolver.js'

package/src/resolvers/query/ApiKeyQueryResolver.ts

@@ -0,0 +1,15 @@
+import { ApiKey, QueryResolvers } from '../../schema/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+import { PermissionActions } from '../../model/index.js'
+import { GlobalApiKeysQuery } from '../../model/queries/apiKey/index.js'
+import { ApiKeyResponseFactory } from '../responseHelpers/ApiKeyResponseFactory.js'
+
+export class ApiKeyQueryResolver implements QueryResolvers {
+	async globalApiKeys(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly ApiKey[]> {
+		if (!(await context.isAllowed({ action: PermissionActions.API_KEY_LIST }))) {
+			return []
+		}
+		const rows = await context.db.queryHandler.fetch(new GlobalApiKeysQuery())
+		return rows.map(row => ApiKeyResponseFactory.createApiKeyResponse(row))
+	}
+}

package/src/resolvers/query/AuthLogQueryResolver.ts

@@ -0,0 +1,63 @@
+import { AuthLogPage, QueryAuthLogArgs, QueryResolvers } from '../../schema/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+import { PermissionActions } from '../../model/index.js'
+import { AuthLogQuery } from '../../model/queries/authLog/AuthLogQuery.js'
+import { AuthActionType } from '../../model/type/AuthLog.js'
+
+export class AuthLogQueryResolver implements Pick<QueryResolvers, 'authLog'> {
+	async authLog(
+		parent: unknown,
+		args: QueryAuthLogArgs,
+		context: TenantResolverContext,
+	): Promise<AuthLogPage> {
+		await context.requireAccess({
+			action: PermissionActions.AUTH_LOG_VIEW,
+			message: 'You are not allowed to view the audit log',
+		})
+
+		const limit = args.limit ?? undefined
+		const offset = args.offset ?? undefined
+		const filter = args.filter ?? {}
+
+		const rows = await context.db.queryHandler.fetch(
+			new AuthLogQuery(
+				{
+					types: (filter.types ?? undefined) as readonly AuthActionType[] | undefined,
+					success: filter.success ?? undefined,
+					invokedByIdentityId: filter.invokedByIdentityId ?? undefined,
+					personId: filter.personId ?? undefined,
+					targetPersonId: filter.targetPersonId ?? undefined,
+					personInputIdentifier: filter.personInputIdentifier ?? undefined,
+					createdAfter: filter.createdAfter ?? undefined,
+					createdBefore: filter.createdBefore ?? undefined,
+				},
+				{ limit: limit ?? undefined, offset: offset ?? undefined },
+			),
+		)
+
+		const effectiveLimit = Math.min(limit ?? AuthLogQuery.defaultLimit, AuthLogQuery.hardLimit)
+		const hasMore = rows.length > effectiveLimit
+		const visible = hasMore ? rows.slice(0, effectiveLimit) : rows
+
+		return {
+			hasMore,
+			entries: visible.map(row => ({
+				id: row.id,
+				createdAt: row.created_at,
+				type: row.type,
+				success: row.success,
+				invokedByIdentityId: row.invoked_by_id,
+				personId: row.person_id,
+				targetPersonId: row.target_person_id,
+				personInputIdentifier: row.person_input_identifier,
+				errorCode: row.error_code,
+				errorMessage: row.error_message,
+				ipAddress: row.ip_address,
+				userAgent: row.user_agent,
+				identityProviderId: row.identity_provider_id,
+				metadata: row.metadata,
+				eventData: row.event_data,
+			})),
+		}
+	}
+}

package/src/resolvers/query/AuthPolicyQueryResolver.ts

@@ -0,0 +1,41 @@
+import { AuthPolicy, QueryResolvers } from '../../schema/index.js'
+import { AuthPolicyManager, PermissionActions } from '../../model/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+import { ProjectsQuery } from '../../model/queries/index.js'
+
+/**
+ * Lists configured auth policies. Gated like `configure`. Maps each row's
+ * `project_id` back to a project slug, and lets the Interval scalar serialize
+ * the IPostgresInterval session fields.
+ */
+export class AuthPolicyQueryResolver implements Pick<QueryResolvers, 'authPolicies'> {
+	constructor(
+		private readonly authPolicyManager: AuthPolicyManager,
+	) {}
+
+	async authPolicies(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly AuthPolicy[]> {
+		await context.requireAccess({
+			action: PermissionActions.CONFIGURE,
+			message: 'You are not allowed to view auth policies',
+		})
+
+		const [rows, projects] = await Promise.all([
+			this.authPolicyManager.listPolicies(context.db),
+			context.db.queryHandler.fetch(new ProjectsQuery()),
+		])
+		const slugById = new Map(projects.map(p => [p.id, p.slug]))
+
+		return rows.map((row): AuthPolicy => ({
+			id: row.id,
+			scope: row.scope,
+			project: row.project_id !== null ? slugById.get(row.project_id) ?? null : null,
+			roles: row.roles,
+			mfaRequired: row.mfa_required,
+			// IPostgresInterval; the Interval scalar serializes it to an ISO 8601 string.
+			tokenExpiration: row.token_expiration as unknown as AuthPolicy['tokenExpiration'],
+			idleTimeout: row.idle_timeout as unknown as AuthPolicy['idleTimeout'],
+			mfaGraceDuration: row.grace_duration as unknown as AuthPolicy['mfaGraceDuration'],
+			rememberMeAllowed: row.remember_me_allowed,
+		}))
+	}
+}

package/src/resolvers/query/ConfigurationQueryResolver.ts

@@ -1,7 +1,7 @@
-import { Config, QueryResolvers } from '../../schema'
-import { ConfigurationQuery, PermissionActions } from '../../model'
-import { TenantResolverContext } from '../TenantResolverContext'
-import { ConfigurationManager } from '../../model/service/ConfigurationManager'
+import { Config, QueryResolvers } from '../../schema/index.js'
+import { ConfigurationQuery, PermissionActions } from '../../model/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+import { ConfigurationManager } from '../../model/service/ConfigurationManager.js'
 
 export class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configuration'> {
 	constructor(
@@ -15,6 +15,6 @@ export class ConfigurationQueryResolver implements Pick<QueryResolvers, 'configu
 			message: 'You are not allowed to view configuration',
 		})
 
-		return await context.db.queryHandler.fetch(new ConfigurationQuery())
+		return await context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))
 	}
 }

package/src/resolvers/query/CustomRoleQueryResolver.ts

@@ -0,0 +1,41 @@
+import { CustomRole, CustomRolePermissionDefinition, QueryResolvers } from '../../schema/index.js'
+import { CustomRoleManager, PermissionActions } from '../../model/index.js'
+import { getGrantablePermissions, isConfigurationRequired } from '../../model/authorization/CustomRolePermissions.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+
+/** Lists custom roles and the grantable permission vocabulary. Gated by `customRole:view`. */
+export class CustomRoleQueryResolver implements Pick<QueryResolvers, 'customRoles' | 'customRolePermissions'> {
+	constructor(
+		private readonly customRoleManager: CustomRoleManager,
+	) {}
+
+	async customRoles(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRole[]> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_VIEW,
+			message: 'You are not allowed to view custom roles',
+		})
+
+		const rows = await this.customRoleManager.listRoles(context.db)
+		return rows.map((row): CustomRole => ({
+			slug: row.slug,
+			description: row.description,
+			grants: row.grants,
+		}))
+	}
+
+	async customRolePermissions(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRolePermissionDefinition[]> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_VIEW,
+			message: 'You are not allowed to view custom role permissions',
+		})
+
+		return [...getGrantablePermissions().values()]
+			.sort((left, right) => left.name.localeCompare(right.name))
+			.map(definition => ({
+				name: definition.name,
+				configurationKind: definition.configurationKind,
+				configurationRequired: isConfigurationRequired(definition),
+				defaultConfig: definition.defaultConfig,
+			}))
+	}
+}

package/src/resolvers/query/IDPQueryResolver.ts

@@ -1,7 +1,7 @@
-import { IdentityProvider, QueryResolvers } from '../../schema'
-import { PermissionActions } from '../../model'
-import { TenantResolverContext } from '../TenantResolverContext'
-import { IDPManager } from '../../model/service/idp/IDPManager'
+import { IdentityProvider, QueryResolvers } from '../../schema/index.js'
+import { PermissionActions } from '../../model/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+import { IDPManager } from '../../model/service/idp/IDPManager.js'
 
 export class IDPQueryResolver implements QueryResolvers {
 	constructor(

package/src/resolvers/query/MailTemplateQueryResolver.ts

@@ -1,17 +1,22 @@
-import { MailTemplateData, QueryResolvers } from '../../schema'
-import { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model'
-import { TenantResolverContext } from '../TenantResolverContext'
+import { MailTemplateData, QueryResolvers } from '../../schema/index.js'
+import { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from '../../model/index.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
 
 export class MailTemplateQueryResolver implements QueryResolvers {
+	/** Filters per row rather than throwing, like the other tenant read fields. */
 	async mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {
-		await context.requireAccess({
-			action: PermissionActions.MAIL_TEMPLATE_LIST,
-			message: 'You are not allowed to list mail templates',
-		})
-		return (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({
-			...it,
-			variant: it.variant || null,
-			type: mailTypeFromDbToSchema(it.type),
+		const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())
+		const visible = await Promise.all(rows.map(async row => {
+			const type = mailTypeFromDbToSchema(row.type)
+			const allowed = await context.isAllowed({
+				action: PermissionActions.MAIL_TEMPLATE_LIST({
+					kind: row.projectSlug === null ? 'global' : 'project',
+					projectSlug: row.projectSlug,
+					type,
+				}),
+			})
+			return allowed ? { ...row, variant: row.variant || null, type } : null
 		}))
+		return visible.filter(row => row !== null)
 	}
 }