@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/sql/getPersonsByIdentitySql.ts

@@ -0,0 +1,24 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export const getPersonsByIdentitySql = (args: {
+	identityIds: readonly string[]
+	response: readonly { personId: string; identityId: string; email: string; password?: string; roles?: readonly string[] }[]
+}): ExpectedQuery => ({
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+	         FROM "tenant"."person"
+		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
+	         WHERE "person"."identity_id" IN (${args.identityIds.map(() => '?').join(', ')})`,
+	parameters: [...args.identityIds],
+	response: {
+		rows: args.response.map(it => ({
+			id: it.personId,
+			password_hash: it.password ? `BCRYPTED-${it.password}` : null,
+			identity_id: it.identityId,
+			roles: it.roles ?? [],
+			email: it.email,
+		})),
+	},
+})

package/tests/cases/integration/mocked/sql/getProjectBySlugSql.ts

@@ -1,8 +1,8 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
-import { Project } from '../../../../../src'
+import { SQL } from '../../../../src/tags.js'
+import { Project } from '../../../../../src/index.js'
 
-export const getProjectBySlugSql = (args: { projectSlug: string; response: Project }): ExpectedQuery => ({
+export const getProjectBySlugSql = (args: { projectSlug: string; response: Project | null }): ExpectedQuery => ({
 	sql: SQL`select "id", "name", "slug", "config", "updated_at" as "updatedAt"
 	         FROM "tenant"."project"
 	         WHERE "slug" = ?`,

package/tests/cases/integration/mocked/sql/getProjectMembershipSql.ts

@@ -1,6 +1,6 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
-import { testUuid } from '../../../../src/testUuid'
+import { SQL } from '../../../../src/tags.js'
+import { testUuid } from '../../../../src/testUuid.js'
 
 export const getProjectMembershipSql = (
 	args: { identityId: string; projectId: string },

package/tests/cases/integration/mocked/sql/listApiKeysSql.ts

@@ -0,0 +1,45 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ApiKeyListResponseRow {
+	id: string
+	identityId: string
+	description?: string | null
+	disabledAt?: Date | null
+	createdAt: Date
+	lastUsedAt?: Date | null
+	expiresAt?: Date | null
+}
+
+const baseSelect =
+	`select "api_key"."id", "api_key"."type", "api_key"."disabled_at", "api_key"."created_at", "api_key"."last_used_at", "api_key"."expires_at", "api_key"."identity_id", "identity"."description"
+	 from "tenant"."api_key"
+	 inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id"`
+
+const mapRows = (rows: ApiKeyListResponseRow[]) =>
+	rows.map(row => ({
+		id: row.id,
+		type: 'permanent',
+		disabled_at: row.disabledAt ?? null,
+		created_at: row.createdAt,
+		last_used_at: row.lastUsedAt ?? null,
+		expires_at: row.expiresAt ?? null,
+		identity_id: row.identityId,
+		description: row.description ?? null,
+	}))
+
+export const projectApiKeysSql = (args: { projectId: string; rows: ApiKeyListResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`${baseSelect}
+		where "api_key"."type" = ? and exists (select ?::int from "tenant"."project_membership" where "project_membership"."identity_id" = "api_key"."identity_id" and "project_id" = ?)
+		order by "api_key"."created_at" desc`,
+	parameters: ['permanent', 1, args.projectId],
+	response: { rows: mapRows(args.rows) },
+})
+
+export const globalApiKeysSql = (args: { rows: ApiKeyListResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`${baseSelect}
+		where "api_key"."type" = ? and not(exists (select ?::int from "tenant"."project_membership" where "project_membership"."identity_id" = "api_key"."identity_id"))
+		order by "api_key"."created_at" desc`,
+	parameters: ['permanent', 1],
+	response: { rows: mapRows(args.rows) },
+})

package/tests/cases/integration/mocked/sql/listPersonsSql.ts

@@ -0,0 +1,58 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ListPersonsResponseRow {
+	personId: string
+	identityId: string
+	email: string
+	name?: string
+	emailOtpEnabled?: boolean
+	passwordlessEnabled?: boolean | null
+	disabledAt?: Date | null
+}
+
+const COLUMNS =
+	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at", "person"."disabled_at"'
+
+const FROM = `FROM "tenant"."person"
+	LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"`
+
+/**
+ * Slim person listing emitted by `PersonsQuery` — no `password_hash` / TOTP
+ * secrets, capped to `limit 100 offset 0` by default. Supports the `email` and
+ * `identityIds` (scoped) filter variants.
+ */
+export const listPersonsSql = (args: {
+	emailFilter?: string
+	identityIds?: string[]
+	rows: ListPersonsResponseRow[]
+}): ExpectedQuery => {
+	const where: string[] = []
+	const parameters: unknown[] = []
+	if (args.emailFilter) {
+		where.push(`"person"."email" ILIKE '%' || ? || '%'`)
+		parameters.push(args.emailFilter)
+	}
+	if (args.identityIds) {
+		where.push(`"person"."identity_id" IN (${args.identityIds.map(() => '?').join(', ')})`)
+		parameters.push(...args.identityIds)
+	}
+	const whereSql = where.length > 0 ? `WHERE ${where.join(' AND ')}` : ''
+	return {
+		sql: SQL`SELECT ${COLUMNS} ${FROM} ${whereSql} ORDER BY "person"."email" ASC limit 100 offset 0`,
+		parameters,
+		response: {
+			rows: args.rows.map(row => ({
+				id: row.personId,
+				identity_id: row.identityId,
+				email: row.email,
+				name: row.name ?? null,
+				otp_activated_at: null,
+				email_otp_enabled: row.emailOtpEnabled ?? false,
+				passwordless_enabled: row.passwordlessEnabled ?? null,
+				email_verified_at: null,
+				disabled_at: row.disabledAt ?? null,
+			})),
+		},
+	}
+}

package/tests/cases/integration/mocked/sql/listProjectSecretsSql.ts

@@ -0,0 +1,23 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface ProjectSecretResponseRow {
+	key: string
+	createdAt: Date
+	updatedAt: Date
+}
+
+export const listProjectSecretsSql = (args: { projectId: string; rows: ProjectSecretResponseRow[] }): ExpectedQuery => ({
+	sql: SQL`select "key", "created_at", "updated_at"
+		from "tenant"."project_secret"
+		where "project_id" = ?
+		order by "key" asc`,
+	parameters: [args.projectId],
+	response: {
+		rows: args.rows.map(row => ({
+			key: row.key,
+			created_at: row.createdAt,
+			updated_at: row.updatedAt,
+		})),
+	},
+})

package/tests/cases/integration/mocked/sql/listSessionsSql.ts

@@ -0,0 +1,38 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface SessionRow {
+	id: string
+	created_at: Date
+	expires_at: Date | null
+	last_used_at: Date | null
+	last_ip: string | null
+	last_user_agent: string | null
+	created_ip: string | null
+	created_user_agent: string | null
+	trust_forwarded_info: boolean
+}
+
+export const listSessionsSql = (args: {
+	identityId: string
+	now?: Date
+	rows: SessionRow[]
+}): ExpectedQuery => ({
+	sql: SQL`select "api_key"."id",
+			       "api_key"."created_at",
+			       "api_key"."expires_at",
+			       "api_key"."last_used_at",
+			       "api_key"."last_ip",
+			       "api_key"."last_user_agent",
+			       "api_key"."created_ip",
+			       "api_key"."created_user_agent",
+			       "api_key"."trust_forwarded_info"
+			from "tenant"."api_key"
+			where "api_key"."identity_id" = ?
+			  and "api_key"."type" = ?
+			  and "api_key"."disabled_at" is null
+			  and ("api_key"."expires_at" is null or "api_key"."expires_at" > now())
+			order by "api_key"."created_at" desc`,
+	parameters: [args.identityId, 'session'],
+	response: { rows: args.rows },
+})

package/tests/cases/integration/mocked/sql/localAuthDisablingIdpsSql.ts

@@ -0,0 +1,21 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+/**
+ * The `LocalAuthDisablingIdpsQuery` lookup every local authentication path runs.
+ * `slugs` defaults to none, i.e. local authentication stays available.
+ */
+export const localAuthDisablingIdpsSql = (args: {
+	personId: string
+	slugs?: string[]
+}): ExpectedQuery => ({
+	sql: SQL`SELECT "identity_provider"."slug" AS "slug"
+	         FROM "tenant"."person_identity_provider"
+		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
+	         WHERE "person_identity_provider"."person_id" = ? AND "identity_provider"."disable_local_authentication" = ? AND "identity_provider"."disabled_at" IS NULL
+	         ORDER BY "identity_provider"."slug" ASC`,
+	parameters: [args.personId, true],
+	response: {
+		rows: (args.slugs ?? []).map(slug => ({ slug })),
+	},
+})

package/tests/cases/integration/mocked/sql/loginHistorySql.ts

@@ -0,0 +1,29 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export type PriorLoginRow = {
+	geoCountry?: string | null
+	deviceFingerprint?: string | null
+	ip?: string | null
+}
+
+/**
+ * Mocks `LoginRiskAnalyzer.analyze`'s history lookup: the person's last N
+ * successful interactive sign-ins (password / IdP / passwordless), newest first.
+ * Only runs when anomaly detection is enabled in config.
+ */
+export const getLoginHistorySql = (args: { personId: string; limit?: number; rows?: PriorLoginRow[] }): ExpectedQuery => ({
+	sql: SQL`select "person_auth_log"."geo_country", "person_auth_log"."device_fingerprint", "person_auth_log"."ip_address"
+		from "tenant"."person_auth_log"
+		where "person_auth_log"."person_id" = ? and "person_auth_log"."type" in (?, ?, ?) and "person_auth_log"."success" = ?
+		order by "person_auth_log"."created_at" desc
+		limit ${String(args.limit ?? 10)}`,
+	parameters: [args.personId, 'login', 'idp_login', 'passwordless_login', true],
+	response: {
+		rows: (args.rows ?? []).map(row => ({
+			geo_country: row.geoCountry ?? null,
+			device_fingerprint: row.deviceFingerprint ?? null,
+			ip_address: row.ip ?? null,
+		})),
+	},
+})

package/tests/cases/integration/mocked/sql/patchVariablesSql.ts

@@ -1,4 +1,4 @@
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 import { ExpectedQuery } from '@contember/database-tester'
 
 export const patchVariablesSql = (args: {

package/tests/cases/integration/mocked/sql/personIdentityProvidersSql.ts

@@ -0,0 +1,89 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export interface PersonIdpConnectionRow {
+	id: string
+	createdAt: Date
+	externalIdentifier: string
+	slug: string
+	type: string
+	disabledAt?: Date | null
+	disableLocalAuthentication?: boolean
+}
+
+export const getPersonIdentityProvidersSql = (args: {
+	personId: string
+	response: PersonIdpConnectionRow[]
+}): ExpectedQuery => ({
+	sql:
+		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt", "identity_provider"."disable_local_authentication" as "identityProviderDisableLocalAuthentication"
+	         FROM "tenant"."person_identity_provider"
+		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
+	         WHERE "person_id" = ?
+	         ORDER BY "person_identity_provider"."created_at" ASC, "person_identity_provider"."id" ASC`,
+	parameters: [args.personId],
+	response: {
+		rows: args.response.map(it => ({
+			id: it.id,
+			createdAt: it.createdAt,
+			externalIdentifier: it.externalIdentifier,
+			identityProviderSlug: it.slug,
+			identityProviderType: it.type,
+			identityProviderDisabledAt: it.disabledAt ?? null,
+			identityProviderDisableLocalAuthentication: it.disableLocalAuthentication ?? false,
+		})),
+	},
+})
+
+/**
+ * Person-by-identity lookup with explicit control over the auth-method columns
+ * (`password_hash`, `passwordless_enabled`) that the disconnect lock-out check
+ * reads. The generic `getPersonByIdentity` helper always returns a non-null
+ * password hash, which would mask the lock-out path.
+ */
+export const getPersonByIdentityForIdp = (args: {
+	identityId: string
+	personId: string
+	passwordHash: string | null
+	passwordlessEnabled?: boolean | null
+}): ExpectedQuery => ({
+	sql:
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+	         FROM "tenant"."person"
+		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
+	         WHERE "person"."identity_id" = ?`,
+	parameters: [args.identityId],
+	response: {
+		rows: [
+			{
+				id: args.personId,
+				password_hash: args.passwordHash,
+				identity_id: args.identityId,
+				roles: [],
+				email: 'john@doe.com',
+				name: 'John',
+				otp_secret: null,
+				otp_secret_version: null,
+				otp_activated_at: null,
+				otp_pending_secret: null,
+				otp_pending_version: null,
+				email_otp_enabled: false,
+				disabled_at: null,
+				passwordless_enabled: args.passwordlessEnabled ?? null,
+				email_verified_at: null,
+				email_verification_required: false,
+			},
+		],
+	},
+})
+
+export const disconnectPersonIdentityProviderSql = (args: {
+	personId: string
+	personIdentityProviderId: string
+	affectedRows?: number
+}): ExpectedQuery => ({
+	sql: SQL`DELETE FROM "tenant"."person_identity_provider" WHERE "id" = ? AND "person_id" = ?`,
+	parameters: [args.personIdentityProviderId, args.personId],
+	response: { rowCount: args.affectedRows ?? 1 },
+})

package/tests/cases/integration/mocked/sql/removeMembershipSql.ts

@@ -0,0 +1,14 @@
+import { SQL } from '../../../../src/tags.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+/** RemoveProjectMembershipCommand — delete a single (project, identity, role) membership. */
+export const removeMembershipSql = (args: {
+	projectId: string
+	identityId: string
+	role: string
+}): ExpectedQuery => ({
+	sql: SQL`DELETE FROM "tenant"."project_membership"
+	         WHERE "project_id" = ? AND "identity_id" = ? AND "role" = ?`,
+	parameters: [args.projectId, args.identityId, args.role],
+	response: { rowCount: 1 },
+})

package/tests/cases/integration/mocked/sql/selectMembershipsSql.ts

@@ -1,4 +1,4 @@
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 import { ExpectedQuery } from '@contember/database-tester'
 import { Acl } from '@contember/schema'
 

package/tests/cases/integration/mocked/sql/setEmailOtpEnabledSql.ts

@@ -0,0 +1,10 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+/** Mocks SetEmailOtpEnabledCommand: upsert person_mfa.email_otp_enabled. */
+export const setEmailOtpEnabledSql = (args: { personId: string; enabled: boolean }): ExpectedQuery => ({
+	sql:
+		SQL`insert into "tenant"."person_mfa" ("person_id", "email_otp_enabled") values (?, ?) on conflict ("person_id") do update set "email_otp_enabled" = ?`,
+	parameters: [args.personId, args.enabled, args.enabled],
+	response: { rowCount: 1 },
+})

package/tests/cases/integration/mocked/sql/sqlTransaction.ts

@@ -1,5 +1,5 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 export const sqlTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
 	{
 		sql: SQL`BEGIN;`,
@@ -15,3 +15,31 @@ export const sqlTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] =>
 		response: { rowCount: 1 },
 	},
 ]
+
+/**
+ * A nested `client.transaction()` inside an open transaction. Postgres runs it as a savepoint; the
+ * connection mock renders every transaction as BEGIN/COMMIT and sets no isolation level for it.
+ */
+export const sqlNestedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]
+
+export const sqlReadCommittedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]

package/tests/cases/integration/mocked/sql/updatePesonNameSql.ts

@@ -1,5 +1,5 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 
 export const updatePersonProfileNameSql = (args: { personId: string; name: string | null }): ExpectedQuery => ({
 	sql: SQL`UPDATE "tenant"."person"
@@ -9,18 +9,20 @@ export const updatePersonProfileNameSql = (args: { personId: string; name: strin
 	response: { rowCount: 1 },
 })
 
+// A direct e-mail change clears email_verified_at: the new address is unproven,
+// so a stale verified timestamp must not carry over (see ChangeProfileCommand).
 export const updatePersonProfileEmailSql = (args: { personId: string; email: string | null }): ExpectedQuery => ({
 	sql: SQL`UPDATE "tenant"."person"
-	         SET "email" = ?
+	         SET "email" = ?, "email_verified_at" = ?
 	         WHERE "id" = ?`,
-	parameters: [args.email, args.personId],
+	parameters: [args.email, null, args.personId],
 	response: { rowCount: 1 },
 })
 
 export const updatePersonProfileNameAndEmailSql = (args: { personId: string; email: string | null; name: string | null }): ExpectedQuery => ({
 	sql: SQL`UPDATE "tenant"."person"
-	         SET "email" = ?, "name" = ?
+	         SET "email" = ?, "name" = ?, "email_verified_at" = ?
 	         WHERE "id" = ?`,
-	parameters: [args.email, args.name, args.personId],
+	parameters: [args.email, args.name, null, args.personId],
 	response: { rowCount: 1 },
 })

package/tests/cases/integration/mocked/sql/updatePesonPasswordSql.ts

@@ -1,5 +1,5 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { SQL } from '../../../../src/tags'
+import { SQL } from '../../../../src/tags.js'
 
 export const updatePersonPasswordSql = (args: { personId: string; password: string }): ExpectedQuery => ({
 	sql: SQL`UPDATE "tenant"."person"