@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/tests/cases/unit/panelAccessResolver.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, PanelAccessResolver, Providers } from '../../../src/index.js'
+import { getConfigSql } from '../integration/mocked/sql/getConfigSql.js'
+
+const identityId = '123e4567-e89b-12d3-a456-000000000001'
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => new Date('2026-08-06T12:00:00.000Z'),
+	randomBytes: length => Promise.resolve(Buffer.alloc(length)),
+	uuid: () => 'uuid',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const resolve = async (queries: ExpectedQuery[], globalRoles: readonly string[]) => {
+	const connection = createConnectionMock(queries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+	const result = await new PanelAccessResolver(providers).isAllowed(db, identityId, globalRoles)
+	expect(queries).toHaveLength(0)
+	return result
+}
+
+const projectRolesSql = (roles: string[]): ExpectedQuery => ({
+	sql: 'select "project_id", "role" from "tenant"."project_membership" where "identity_id" = ?',
+	parameters: [identityId],
+	response: { rows: roles.map((role, index) => ({ project_id: `project-${index}`, role })) },
+})
+
+describe('PanelAccessResolver', () => {
+	test('allows project_admin through the default global policy without reading memberships', async () => {
+		expect(await resolve([getConfigSql()], ['project_admin'])).toBe(true)
+	})
+
+	test('allows a configured custom global role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: ['project_creator'], panel_project_roles: [] })], ['project_creator'])).toBe(true)
+	})
+
+	test('denies everyone when both policy lists are empty', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: [] })], ['super_admin'])).toBe(false)
+	})
+
+	test('allows a matching project role and denies a non-matching role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor', 'admin'])], [])).toBe(
+			true,
+		)
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor'])], [])).toBe(false)
+	})
+})

package/tests/cases/unit/passwordStrengthValidator.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from 'bun:test'
+import { PasswordStrengthValidator } from '../../../src/model/service/PasswordStrengthValidator.js'
+import { HibpChecker } from '../../../src/model/service/HibpChecker.js'
+
+const passwordConfig = {
+	minLength: 6,
+	requireUppercase: 0,
+	requireLowercase: 0,
+	requireDigit: 0,
+	requireSpecial: 0,
+	pattern: null,
+	checkBlacklist: false,
+	checkHibp: false,
+}
+
+class StubHibp implements HibpChecker {
+	constructor(private readonly result: boolean) {}
+	async isCompromised(): Promise<boolean> {
+		return this.result
+	}
+}
+
+describe('PasswordStrengthValidator', () => {
+	test('passes a strong, uncompromised password', async () => {
+		const validator = new PasswordStrengthValidator(new StubHibp(false))
+		const result = await validator.verify('correct horse battery staple', passwordConfig, 'WEAK')
+		expect(result.ok).toBe(true)
+	})
+
+	test('does not call HIBP when checkHibp is false', async () => {
+		// If we *did* call it, this stub would return true and trip COMPROMISED.
+		const validator = new PasswordStrengthValidator(new StubHibp(true))
+		const result = await validator.verify('correct horse battery staple', passwordConfig, 'WEAK')
+		expect(result.ok).toBe(true)
+	})
+
+	test('returns COMPROMISED when HIBP says so and checkHibp is on', async () => {
+		const validator = new PasswordStrengthValidator(new StubHibp(true))
+		const result = await validator.verify('correct horse battery staple', { ...passwordConfig, checkHibp: true }, 'WEAK')
+		expect(result.ok).toBe(false)
+		if (!result.ok) {
+			expect(result.metadata?.weakPasswordReasons).toContain('COMPROMISED')
+		}
+	})
+
+	test('passes when HIBP says clean and checkHibp is on', async () => {
+		const validator = new PasswordStrengthValidator(new StubHibp(false))
+		const result = await validator.verify('correct horse battery staple', { ...passwordConfig, checkHibp: true }, 'WEAK')
+		expect(result.ok).toBe(true)
+	})
+})

package/tests/cases/unit/rateLimiter.test.ts

@@ -0,0 +1,134 @@
+import { describe, expect, test } from 'bun:test'
+import PostgresInterval from 'postgres-interval'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { Config, DatabaseContext, Providers, RateLimiter } from '../../../src/index.js'
+
+const NOW = new Date('2026-05-20T12:00:00.000Z')
+
+const baseProviders: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => 'rate-limit-event-id',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	// Mirrors the real sha256 contract closely enough to assert the key is hashed
+	// (and never stored raw) without pulling in node:crypto.
+	hash: (value, algo) => Buffer.from(`${String(algo)}:${value.toString()}`),
+}
+
+const configWith = (limit: number, window = '01:00:00'): Config =>
+	({
+		rateLimits: {
+			signUpPerIp: { limit, window: PostgresInterval(window) },
+			loginPerIp: { limit, window: PostgresInterval(window) },
+			passwordResetPerIp: { limit, window: PostgresInterval(window) },
+			passwordlessInitPerIp: { limit, window: PostgresInterval(window) },
+		},
+	}) as unknown as Config
+
+const COUNT_SQL = `select count(*)::text as count from "tenant"."rate_limit_event"
+	where "scope" = ? and "key_hash" = ? and occurred_at >= NOW() - make_interval(secs => ?)`
+const INSERT_SQL = `insert into "tenant"."rate_limit_event" ("id", "scope", "key_hash") values (?, ?, ?)`
+
+const expectedHash = Buffer.from('sha256:1.2.3.4')
+
+const run = async (args: {
+	limit: number
+	queries: ExpectedQuery[]
+	key?: string | null
+	scope?: 'sign_up_per_ip' | 'login_per_ip'
+}) => {
+	const connection = createConnectionMock(args.queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, baseProviders)
+	const limiter = new RateLimiter(baseProviders)
+	const decision = await limiter.consume(
+		db,
+		args.scope ?? 'sign_up_per_ip',
+		args.key === undefined ? '1.2.3.4' : args.key,
+		configWith(args.limit),
+	)
+	expect(args.queries).toHaveLength(0)
+	return decision
+}
+
+describe('RateLimiter', () => {
+	test('passes through without touching the DB when the key is missing', async () => {
+		expect(await run({ limit: 5, key: null, queries: [] })).toEqual({ ok: true })
+		expect(await run({ limit: 5, key: '', queries: [] })).toEqual({ ok: true })
+	})
+
+	test('disabled limit (0) skips the COUNT query but still records the event', async () => {
+		// NOTE: `check` short-circuits on limit <= 0 (no COUNT), yet `consume`
+		// records because the decision is ok. So a "disabled" limit still writes
+		// one rate_limit_event row per call (with a real key). Pinning current
+		// behaviour — see review note about the unnecessary write.
+		const decision = await run({
+			limit: 0,
+			queries: [
+				{
+					sql: INSERT_SQL,
+					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash],
+					response: { rowCount: 1 },
+				},
+			],
+		})
+		expect(decision).toEqual({ ok: true })
+	})
+
+	test('records the event (hashed key, current timestamp) when under the limit', async () => {
+		const decision = await run({
+			limit: 3,
+			queries: [
+				{
+					sql: COUNT_SQL,
+					// window of 1h → occurred_at >= NOW - 3600s
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
+					response: { rows: [{ count: '2' }] },
+				},
+				{
+					sql: INSERT_SQL,
+					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash],
+					response: { rowCount: 1 },
+				},
+			],
+		})
+		expect(decision).toEqual({ ok: true })
+	})
+
+	test('denies and does NOT record when the count has reached the limit', async () => {
+		const decision = await run({
+			limit: 3,
+			queries: [
+				{
+					sql: COUNT_SQL,
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
+					response: { rows: [{ count: '3' }] },
+				},
+				// no INSERT — a denied attempt must not extend the window
+			],
+		})
+		expect(decision).toEqual({ ok: false, retryAfterSeconds: 3600 })
+	})
+
+	test('denies once the count exceeds the limit', async () => {
+		const decision = await run({
+			limit: 3,
+			queries: [
+				{
+					sql: COUNT_SQL,
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
+					response: { rows: [{ count: '9' }] },
+				},
+			],
+		})
+		expect(decision).toEqual({ ok: false, retryAfterSeconds: 3600 })
+	})
+})

package/tests/cases/unit/savePersonTokenCommand.test.ts

@@ -0,0 +1,40 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { computeTokenHash, DatabaseContext, Providers, SavePersonTokenCommand } from '../../../src/index.js'
+
+const APP_NOW = new Date('2026-07-14T10:00:00Z')
+const DB_EXPIRES_AT = new Date('2026-07-14T09:15:00Z')
+const TOKEN_HASH = computeTokenHash('token')
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => APP_NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => 'token-id',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+test('returns the database-clock expiration', async () => {
+	const queries: ExpectedQuery[] = [{
+		sql:
+			`insert into "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta") values (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) returning "expires_at"`,
+		parameters: ['token-id', TOKEN_HASH, 'person-id', 900, APP_NOW, null, 'passwordless', null],
+		response: { rows: [{ expires_at: DB_EXPIRES_AT }] },
+	}]
+	const connection = createConnectionMock(queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+
+	const result = await db.commandBus.execute(new SavePersonTokenCommand('person-id', TOKEN_HASH, 'passwordless', 15))
+
+	expect(result).toEqual({ id: 'token-id', expiresAt: DB_EXPIRES_AT })
+	expect(queries).toHaveLength(0)
+})

package/tests/cases/unit/updateConfigurationCommand.test.ts

@@ -0,0 +1,63 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers, Schema, UpdateConfigurationCommand } from '../../../src/index.js'
+
+const createProviders = (encrypt: Providers['encrypt'] = async value => ({ value, version: 1 })): Providers => ({
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-08-11T00:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt,
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+})
+
+const execute = async (
+	configuration: Schema.ConfigInput,
+	expectedQuery: ExpectedQuery,
+	providers: Providers = createProviders(),
+): Promise<void> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+
+	await db.commandBus.execute(new UpdateConfigurationCommand(configuration))
+
+	expect(expectedQueries).toHaveLength(0)
+}
+
+test('captcha secret null preserves the stored secret and version while provider null disables captcha', async () => {
+	let encryptCalls = 0
+	const providers = createProviders(async value => {
+		encryptCalls++
+		return { value, version: 99 }
+	})
+
+	await execute({ captcha: { provider: null, secret: null } }, {
+		sql: 'update "tenant"."config" set "captcha_provider" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	}, providers)
+
+	// The partial UPDATE omits both stored columns, so their existing bytes/version survive.
+	expect(encryptCalls).toBe(0)
+})
+
+test('omitting captcha secret preserves the stored secret and version', async () => {
+	await execute({ captcha: { threshold: null } }, {
+		sql: 'update "tenant"."config" set "captcha_threshold" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})
+
+test('an empty captcha secret explicitly clears both stored secret columns', async () => {
+	await execute({ captcha: { secret: '' } }, {
+		sql: 'update "tenant"."config" set "captcha_secret" = ?, "captcha_secret_version" = ? where "id" = ?',
+		parameters: [null, null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})

package/tests/src/IdPMock.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../../src'
+import { IdentityProviderHandler, IDPResponse, InitIDPAuthResult, LogoutTokenClaims, LogoutUrlRequest } from '../../src/index.js'
 
 export class IdPMock implements IdentityProviderHandler<any> {
 	initAuth(configuration: any, data: unknown): Promise<InitIDPAuthResult> {
@@ -12,10 +12,50 @@ export class IdPMock implements IdentityProviderHandler<any> {
 		return Promise.resolve({
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,
+			emailVerified: configuration.emailVerified,
+			// Surface any extra claims configured on the mock (e.g. `groups`, `department`) verbatim,
+			// mirroring how real providers spread raw OIDC claims into the IDPResponse — lets tests
+			// drive claim-mapping (A09). `claimMapping` itself lives on the IdP config, not here.
+			...(configuration.claims ?? {}),
+			// Lets tests drive the federated-session branch of sign-in (re-validation state).
+			...(configuration.idpSession ? { idpSession: configuration.idpSession } : {}),
 		})
 	}
 
 	validateConfiguration(config: unknown): any {
 		return config
 	}
+
+	/**
+	 * Test double for OIDC RP-initiated logout. Returns a deterministic URL built from the config's
+	 * `endSessionEndpoint` (null when absent, mirroring an IdP without an `end_session_endpoint`).
+	 */
+	buildLogoutUrl(configuration: any, request: LogoutUrlRequest): Promise<string | null> {
+		if (!configuration?.endSessionEndpoint) {
+			return Promise.resolve(null)
+		}
+		const params = new URLSearchParams()
+		if (request.idToken) {
+			params.set('id_token_hint', request.idToken)
+		}
+		if (request.postLogoutRedirectUri) {
+			params.set('post_logout_redirect_uri', request.postLogoutRedirectUri)
+		}
+		const query = params.toString()
+		return Promise.resolve(query ? `${configuration.endSessionEndpoint}?${query}` : configuration.endSessionEndpoint)
+	}
+
+	/**
+	 * Test double for OIDC back-channel logout token validation. A token of the form `sid:<value>`
+	 * or `sub:<value>` is treated as valid and decoded; anything else throws (invalid token).
+	 */
+	validateLogoutToken(configuration: any, logoutToken: string): Promise<LogoutTokenClaims> {
+		if (logoutToken.startsWith('sid:')) {
+			return Promise.resolve({ sid: logoutToken.slice('sid:'.length) })
+		}
+		if (logoutToken.startsWith('sub:')) {
+			return Promise.resolve({ sub: logoutToken.slice('sub:'.length) })
+		}
+		return Promise.reject(new Error('invalid logout token'))
+	}
 }

package/tests/src/mailer.ts

@@ -1,4 +1,4 @@
-import { Mailer, MailMessage, SentInfo } from '../../src/utils'
+import { Mailer, MailMessage, SentInfo } from '../../src/utils/index.js'
 import { expect } from 'bun:test'
 
 export type ExpectedMessage = { subject: string }

package/tests/src/testTenant.ts

@@ -1,8 +1,9 @@
-import { GraphQLTestQuery } from '../cases/integration/mocked/gql/types'
-import { testUuid } from './testUuid'
+import { GraphQLTestQuery } from '../cases/integration/mocked/gql/types.js'
+import { testUuid } from './testUuid.js'
 import {
 	AclSchemaAccessNodeFactory,
 	createResolverContext,
+	Identity,
 	PermissionContext,
 	ProjectSchemaResolver,
 	ProjectScopeFactory,
@@ -11,26 +12,51 @@ import {
 	TenantContainerFactory,
 	TenantResolverContext,
 	typeDefs,
-} from '../../src'
+} from '../../src/index.js'
+import { Authorizator } from '@contember/authorization'
 import { Buffer } from 'buffer'
 import { makeExecutableSchema } from '@graphql-tools/schema'
-import { executeGraphQlTest } from './testGraphql'
+import { executeGraphQlTest } from './testGraphql.js'
 import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
 import { Acl, Schema } from '@contember/schema'
-import { createMockedMailer, ExpectedMessage } from './mailer'
-import { dbCredentials } from './dbUtils'
-import { IdPMock } from './IdPMock'
+import { createMockedMailer, ExpectedMessage } from './mailer.js'
+import { dbCredentials } from './dbUtils.js'
+import { IdPMock } from './IdPMock.js'
 import { createLogger, JsonStreamLoggerHandler } from '@contember/logger'
 import { emptySchema } from '@contember/schema-utils'
 import { expect } from 'bun:test'
-import { AuthLogService } from '../../src/model/service/AuthLogService'
+import { AuthLogService } from '../../src/model/service/AuthLogService.js'
 
 export interface Test {
 	query: GraphQLTestQuery
 	executes: ExpectedQuery[]
 	return: object
 	sentMails?: ExpectedMessage[]
-	expectedAuthLog?: AuthLogService.LogArgs
+	/** A single expected auth log, or a sequence of them when the mutation emits more than one. */
+	expectedAuthLog?: AuthLogService.LogArgs | AuthLogService.LogArgs[]
+	callerTrustForwardedInfo?: boolean
+	httpInfo?: { ip?: string; userAgent?: string; geoCountry?: string }
+	/** Override individual providers (e.g. a working `decrypt` to enable captcha). */
+	providers?: Partial<Providers>
+	/**
+	 * Tenant roles of the authenticated identity (default: none). Setting this switches the
+	 * context to the REAL authorization stack — the static permission map plus
+	 * `CustomRoleAuthorizator` — instead of the allow-everything default, so the test
+	 * actually exercises what these roles may do. Custom-role slugs listed here trigger the
+	 * request-scoped `custom_role` lookup, which must appear in `executes`.
+	 */
+	identityRoles?: string[]
+	/**
+	 * Override the authorizator. Without this and without `identityRoles`, every action is
+	 * allowed; pass a custom one to exercise forbidden / partially-allowed ACL branches.
+	 */
+	authorizator?: Authorizator<Identity>
+	/**
+	 * Override the project schema resolver (default: a fixed schema defining roles `editor` / `reviewer`).
+	 * Pass `{ getSchema: () => Promise.resolve(undefined) }` to exercise the unresolvable-schema branch of
+	 * the A09 apply-time backstop.
+	 */
+	projectSchemaResolver?: ProjectSchemaResolver
 }
 
 export const createUuidGenerator = () => {
@@ -51,13 +77,37 @@ const schema: Schema = {
 						type: Acl.VariableType.entity,
 						entityName: 'Language',
 					},
+					// A condition variable for the claim-mapping config-validation tests. It carries a `fallback`
+					// so it is OPTIONAL — a membership that doesn't set it (e.g. createApiKey's editor grant)
+					// stays valid instead of failing with VARIABLE_EMPTY.
+					siteFilter: {
+						type: Acl.VariableType.condition,
+						fallback: { never: true },
+					},
+					// An entity variable used by the claim-mapping apply tests (a claim mapped to locale ids).
+					// Carries a `fallback` so it stays OPTIONAL on the direct add-member path, while A09's
+					// apply-time backstop now drops a grant naming a role/variable absent from the live ACL — so
+					// the variable must exist here for the happy-path apply tests to validate and be applied.
+					locale: {
+						type: Acl.VariableType.entity,
+						entityName: 'Locale',
+						fallback: { never: true },
+					},
 				},
 			},
+			// A second project role for the claim-mapping reconciliation tests (unmatched: remove grants and
+			// strips both `editor` and `reviewer`). Must exist in the live ACL or A09's apply-time backstop
+			// drops the grant for it.
+			reviewer: {
+				stages: '*',
+				entities: {},
+				variables: {},
+			},
 		},
 	},
 }
 
-const projectSchemaResolver: ProjectSchemaResolver = {
+const defaultProjectSchemaResolver: ProjectSchemaResolver = {
 	getSchema: project => Promise.resolve(schema),
 }
 
@@ -66,6 +116,7 @@ export const authenticatedApiKeyId = testUuid(998)
 
 export const executeTenantTest = async (test: Test) => {
 	const mailer = createMockedMailer()
+	const projectSchemaResolver = test.projectSchemaResolver ?? defaultProjectSchemaResolver
 	const providers: Providers = {
 		bcrypt: (value: string) => Promise.resolve('BCRYPTED-' + value),
 		bcryptCompare: (data: string, hash: string) => Promise.resolve('BCRYPTED-' + data === hash),
@@ -78,7 +129,9 @@ export const executeTenantTest = async (test: Test) => {
 		encrypt: () => {
 			throw new Error('not supported')
 		},
+		encryptionEnabled: false,
 		hash: value => Buffer.from(value.toString()),
+		...test.providers,
 	}
 	const projectInitializer = {
 		initializeProject: () => {
@@ -96,6 +149,7 @@ export const executeTenantTest = async (test: Test) => {
 			connection,
 			readConnection: connection,
 			cryptoProviders: providers,
+			logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
 		})
 		.replaceService('mailer', () => mailer)
 		.setupService('idpRegistry', reg => {
@@ -103,29 +157,46 @@ export const executeTenantTest = async (test: Test) => {
 		})
 		.build()
 
+	const expectedAuthLogs = test.expectedAuthLog === undefined
+		? undefined
+		: Array.isArray(test.expectedAuthLog)
+		? [...test.expectedAuthLog]
+		: [test.expectedAuthLog]
+
 	const databaseContext = tenantContainer.databaseContext
+	// `identityRoles` means "evaluate what these roles really may do", so it routes through
+	// the container's PermissionContextFactory — the static map plus CustomRoleAuthorizator.
+	// Without it (and without an explicit authorizator) the default stays allow-everything,
+	// which is what the bulk of these tests want.
+	const permissionContext = test.authorizator === undefined && test.identityRoles !== undefined
+		? await tenantContainer.permissionContextFactory.createPreloaded(databaseContext, {
+			id: authenticatedIdentityId,
+			roles: test.identityRoles,
+		})
+		: new PermissionContext(
+			new StaticIdentity(authenticatedIdentityId, test.identityRoles ?? []),
+			test.authorizator ?? {
+				isAllowed: () => Promise.resolve(true),
+			},
+			new ProjectScopeFactory(new AclSchemaAccessNodeFactory()),
+			projectSchemaResolver,
+		)
 	const context: TenantResolverContext = {
 		...createResolverContext(
-			new PermissionContext(
-				new StaticIdentity(authenticatedIdentityId, []),
-				{
-					isAllowed: () => Promise.resolve(true),
-				},
-				new ProjectScopeFactory(new AclSchemaAccessNodeFactory()),
-				projectSchemaResolver,
-			),
+			permissionContext,
 			authenticatedApiKeyId,
+			test.callerTrustForwardedInfo ?? false,
 		),
 		logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
 		logAuthAction: async args => {
-			if (!test.expectedAuthLog) {
+			if (!expectedAuthLogs || expectedAuthLogs.length === 0) {
 				console.log(JSON.stringify(args))
 				throw new Error('No expected auth log')
 			}
-			expect(args).toEqual(test.expectedAuthLog)
-			test.expectedAuthLog = undefined
+			expect(args).toEqual(expectedAuthLogs.shift()!)
 		},
 		db: databaseContext,
+		httpInfo: { ip: test.httpInfo?.ip ?? '', userAgent: test.httpInfo?.userAgent, geoCountry: test.httpInfo?.geoCountry },
 	}
 
 	const schema = makeExecutableSchema({
@@ -147,5 +218,7 @@ export const executeTenantTest = async (test: Test) => {
 	}
 	mailer.expectEmpty()
 	expect(test.executes).toHaveLength(0)
-	expect(test.expectedAuthLog).toBeUndefined()
+	if (expectedAuthLogs) {
+		expect(expectedAuthLogs).toHaveLength(0)
+	}
 }

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/types/model/commands/membership/RemoveProjectMembershipsCommand.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAGpC,qBAAa,8BAA+B,YAAW,OAAO,CAAC,IAAI,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA7E,SAAS,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM;IAE5G,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}