@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/types/utils/Mailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAApD,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW;IAEjF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQtF;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAIzC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgB1D;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,KAAG,MAQrD,CAAA"}
+{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAjF,YAA6B,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW,EAAI;IAErF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOrF;CACD;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHzB,YACkB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAErD;IAEY,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAezD;CACD;AAED,eAAO,MAAM,YAAY,YAAa,aAAa,KAAG,MAQrD,CAAA"}

package/dist/types/utils/TemplateRenderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAGvF"}
+{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtF;CACD"}

package/dist/types/utils/array.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EACvG,OAAO,IAAI,EAAE,EACb,KAAK,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}
+{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,SAChG,IAAI,EAAE,OACR,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}

package/dist/types/utils/batchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAChD,yBAAyB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAC3D,IAAI,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}
+{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,WAAW,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,2BACvB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MACvD,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.1",
+  "version": "2.2.0-alpha.10",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.1.0-beta.2",
-    "@contember/config-loader": "2.1.0-beta.2",
-    "@contember/database": "2.1.0-beta.2",
-    "@contember/database-migrations": "2.1.0-beta.2",
-    "@contember/dic": "2.1.0-beta.2",
-    "@contember/graphql-utils": "2.1.0-beta.2",
-    "@contember/logger": "2.1.0-beta.2",
-    "@contember/schema": "2.1.0-beta.2",
-    "@contember/schema-utils": "2.1.0-beta.2",
-    "@contember/typesafe": "2.1.0-beta.2",
+    "@contember/authorization": "2.2.0-alpha.10",
+    "@contember/config-loader": "2.2.0-alpha.10",
+    "@contember/database": "2.2.0-alpha.10",
+    "@contember/database-migrations": "2.2.0-alpha.10",
+    "@contember/dic": "2.2.0-alpha.10",
+    "@contember/graphql-utils": "2.2.0-alpha.10",
+    "@contember/logger": "2.2.0-alpha.10",
+    "@contember/schema": "2.2.0-alpha.10",
+    "@contember/schema-utils": "2.2.0-alpha.10",
+    "@contember/typesafe": "2.2.0-alpha.10",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.1.0-beta.2",
+    "@contember/database-tester": "2.2.0-alpha.10",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/readme.md

@@ -1,3 +1,59 @@
 # @contember/engine-tenant-api
 
 API for Contember user & API key management.
+
+## Custom tenant roles
+
+Custom roles are runtime-defined global roles stored in `custom_role`. An identity receives one through the existing
+`addGlobalIdentityRoles` mutation. Each definition contains explicit grants:
+
+```graphql
+input CustomRoleGrantInput {
+	permission: String!
+	config: Json
+}
+```
+
+The grant catalog is an explicit allowlist returned by `customRolePermissions`; adding a new `PermissionActions` entry never makes it grantable
+automatically. Its action surface is a subset of the built-in `project_admin` permissions; `project:create` remains reserved for `project_creator`
+and `super_admin`. Project and membership authorization remains controlled by project schema ACL. The only project-aware exception is
+mail-template management, whose dedicated configuration matches exact project slugs and mail types.
+
+Configurations are strict action-specific JSON objects validated with `@contember/typesafe`, like IdP configuration. Unknown properties, invalid
+types, duplicate grants, nonexistent referenced roles/projects, and unsupported configuration are rejected. Invalid data found during evaluation
+makes the entire persisted role inert.
+
+Role constraints use:
+
+```json
+{
+	"allowed": ["person", "support"]
+}
+```
+
+`allowed` is exhaustive — every role observed at the constrained position must appear in it. There is no `denied` counterpart; a constraint can only
+be expressed as an allowlist. `super_admin` and `project_creator` are always denied by code and cannot appear in an allowlist.
+
+Configured grant kinds:
+
+- `ROLE_INPUT` (`person:signUp`) — `{ "roles": RoleConstraint }`.
+- `TARGET_IDENTITY` (`person:disable`, `person:forceSignOut`, `person:resetMfa`, `person:viewSessions`, `person:viewIdp`,
+  `person:changePassword`) — `{ "target": { "globalRoles": RoleConstraint, "projectMemberships": "none" | "any" } }`.
+- `CHANGE_PROFILE` — the target selector plus `{ "fields": { "allowed": ["name" | "email"] } }`.
+- `CREATE_SESSION_TOKEN` — the target selector plus
+  `{ "session": { "maxExpirationMinutes": number, "allowTrustForwardedClientInfo": boolean } }`.
+- `ROLE_MUTATION` (`identity:addGlobalRoles`, `identity:removeGlobalRoles`) — requested-role constraint, target selector, and `allowSelf`.
+- `GLOBAL_API_KEY` (`apiKey:createGlobal`) — requested-role constraint and `allowTrustForwardedClientInfo`, which must be `false` (as for `project_admin`).
+- `MAIL_TEMPLATE_SCOPE` (`mailTemplate:add`, `mailTemplate:remove`, `mailTemplate:list`) —
+  `{ "global": boolean, "projects": ["exact-slug"], "types": ["FORCED_SIGN_OUT", "..."] }`.
+- `NONE` — exact tenant-global actions with no configuration: `person:view`, `person:list`, `identity:viewPermissions`, `system:viewConfig`,
+  `system:viewAuthLog`, `apiKey:list`, `idp:list`, `idp:enable`, `idp:disable`, `entrypoint:deployEntrypoint`, `customRole:view`,
+  `system:configure`. Note that
+  `system:configure` also gates auth-policy management, so a role holding it can weaken or remove the MFA/session policy of any role including
+  `super_admin`, and it takes no configuration to narrow that.
+
+Custom-role grants compile into the existing `Permissions.allow(..., verifier)` mechanism. They do not introduce generic conditions, resource
+patterns, first-class denies, or a parallel authorization data flow. Role definitions are cached once per request.
+
+Deleting a custom role removes the definition and strips that slug from every `identity.roles` value in the same transaction, so no assignment
+survives the role. The slug becomes available again; the `custom_role_change` audit entry keeps the record of what it used to grant.

package/src/TenantContainer.ts

@@ -1,3 +1,4 @@
+import { Logger } from '@contember/logger'
 import { AccessEvaluator, Authorizator } from '@contember/authorization'
 import { Connection, DatabaseConfig } from '@contember/database'
 import { Builder } from '@contember/dic'
@@ -11,15 +12,18 @@ import {
 	BackchannelLogoutManager,
 	BackupCodeManager,
 	CaptchaValidator,
+	CustomRoleManager,
 	DatabaseContext,
 	EmailChangeManager,
 	EmailOtpManager,
 	EmailValidator,
 	EmailVerificationManager,
 	FacebookProvider,
+	GlobalRoleValidator,
 	HCaptchaProvider,
 	Identity,
 	IdentityFactory,
+	IDPClaimSyncService,
 	IDPHandlerRegistry,
 	IDPManager,
 	IdpSessionRevalidator,
@@ -31,6 +35,7 @@ import {
 	OIDCProvider,
 	OtpAuthenticator,
 	OtpManager,
+	PanelAccessResolver,
 	PasswordChangeManager,
 	PasswordResetManager,
 	PermissionContextFactory,
@@ -101,6 +106,7 @@ import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'
 import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'
 import { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'
 import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'
+import { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'
 import { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'
 import { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'
 import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'
@@ -108,6 +114,8 @@ import { ConfigurationManager } from './model/service/ConfigurationManager.js'
 import { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'
 import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'
 import { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'
+import { CustomRoleMutationResolver } from './resolvers/mutation/customRole/CustomRoleMutationResolver.js'
+import { CustomRoleQueryResolver } from './resolvers/query/CustomRoleQueryResolver.js'
 import { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'
 import { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'
 import { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'
@@ -124,9 +132,11 @@ export interface TenantContainer {
 	backchannelLogoutManager: BackchannelLogoutManager
 	signUpManager: SignUpManager
 	projectManager: ProjectManager
+	panelAccessResolver: PanelAccessResolver
 	resolvers: Schema.Resolvers
 	resolverContextFactory: TenantResolverContextFactory
 	authorizator: Authorizator<Identity>
+	permissionContextFactory: PermissionContextFactory
 	identityFetcher: IdentityFetcher
 	databaseContext: DatabaseContext
 	readDatabaseContext: DatabaseContext
@@ -144,6 +154,7 @@ export interface TenantContainerArgs {
 	projectInitializer: ProjectInitializer
 	tenantCredentials: TenantCredentials
 	cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>
+	logger: Logger
 }
 
 export class TenantContainerFactory {
@@ -159,9 +170,11 @@ export class TenantContainerFactory {
 				'backchannelLogoutManager',
 				'projectMemberManager',
 				'projectManager',
+				'panelAccessResolver',
 				'signUpManager',
 				'resolvers',
 				'authorizator',
+				'permissionContextFactory',
 				'resolverContextFactory',
 				'identityFetcher',
 				'databaseContext',
@@ -178,12 +191,15 @@ export class TenantContainerFactory {
 			.addService('mailer', () => createMailer(args.mailOptions))
 			.addService('projectSchemaResolver', () => args.projectSchemaResolver)
 			.addService('templateRenderer', () => new TemplateRenderer())
-			.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))
+			.addService('permissions', () => new PermissionsFactory().create())
+			.addService('accessEvaluator', ({ permissions }) => new AccessEvaluator.PermissionEvaluator(permissions))
 			.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))
 			.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))
 			.addService('apiKeyService', () => new ApiKeyService())
 			.addService('authPolicyResolver', () => new AuthPolicyResolver())
+			.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))
 			.addService('authLogService', () => new AuthLogService())
+			.addService('globalRoleValidator', () => new GlobalRoleValidator())
 			.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))
 			.addService('idpRegistry', () => {
 				const idpRegistry = new IDPHandlerRegistry()
@@ -192,7 +208,11 @@ export class TenantContainerFactory {
 				idpRegistry.registerHandler('apple', new AppleProvider())
 				return idpRegistry
 			})
-			.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))
+			.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))
+			.addService(
+				'idpSessionRevalidator',
+				({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger),
+			)
 			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
 			.addService('unpersistedApiKeyManager', () =>
 				UnpersistedApiKeyManager.createForRootTokens({
@@ -201,8 +221,15 @@ export class TenantContainerFactory {
 				}))
 			.addService(
 				'apiKeyManager',
-				({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>
-					new ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),
+				({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator, globalRoleValidator }) =>
+					new ApiKeyManager(
+						apiKeyService,
+						authPolicyResolver,
+						authLogService,
+						unpersistedApiKeyManager,
+						idpSessionRevalidator,
+						globalRoleValidator,
+					),
 			)
 			.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))
 			.addService('emailValidator', () => new EmailValidator())
@@ -218,7 +245,8 @@ export class TenantContainerFactory {
 			.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))
 			.addService(
 				'signUpManager',
-				({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),
+				({ emailValidator, passwordStrengthValidator, globalRoleValidator }) =>
+					new SignUpManager(emailValidator, passwordStrengthValidator, globalRoleValidator),
 			)
 			.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))
 			.addService('projectMemberManager', () => new ProjectMemberManager())
@@ -246,14 +274,18 @@ export class TenantContainerFactory {
 				({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>
 					new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),
 			)
-			.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))
-			.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))
+			.addService(
+				'idpSignInManager',
+				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger),
+			)
+			.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))
 			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())
 			.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))
 			.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))
 			.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))
 			.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))
 			.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))
+			.addService('customRoleManager', ({ globalRoleValidator }) => new CustomRoleManager(globalRoleValidator))
 			.addService(
 				'signInManager',
 				({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>
@@ -271,7 +303,7 @@ export class TenantContainerFactory {
 			.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))
 			.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))
 			.addService('mailTemplateManager', () => new MailTemplateManager())
-			.addService('rolesManager', () => new RolesManager())
+			.addService('rolesManager', ({ globalRoleValidator }) => new RolesManager(globalRoleValidator))
 			.addService('configurationManager', () => new ConfigurationManager())
 			.addService(
 				'passwordlessSignInManager',
@@ -388,6 +420,10 @@ export class TenantContainerFactory {
 				'disablePersonMutationResolver',
 				({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),
 			)
+			.addService(
+				'enablePersonMutationResolver',
+				({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),
+			)
 			.addService(
 				'forceSignOutMutationResolver',
 				({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),
@@ -410,6 +446,8 @@ export class TenantContainerFactory {
 			.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))
 			.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))
 			.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))
+			.addService('customRoleMutationResolver', ({ customRoleManager }) => new CustomRoleMutationResolver(customRoleManager))
+			.addService('customRoleQueryResolver', ({ customRoleManager }) => new CustomRoleQueryResolver(customRoleManager))
 			.addService('authLogQueryResolver', () => new AuthLogQueryResolver())
 			.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())
 			.addService(

package/src/migrations/2026-06-18-120000-idp-claim-mapping.ts

@@ -0,0 +1,15 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// A09 — IdP claim mapping. The mapping itself rides inside the existing
+// `identity_provider.configuration` JSONB (`configuration.claimMapping`), so no table or column
+// change is needed. This migration only wires the call sites: the new `idp_role_mapped` audit
+// action emitted when claim-mapping (re)syncs project memberships, and `idp_role_mapping_failed`
+// emitted when a configured mapping failed and was skipped (fail-open).
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapped';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-03-120000-person-enable-auth-log.ts

@@ -0,0 +1,12 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// New enum values are added in their own migration so the values are committed
+// before any later migration (or runtime code) inserts rows using them — a new
+// enum value cannot be used in the same transaction that adds it.
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'person_enable';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-04-120000-config-panel.ts

@@ -0,0 +1,13 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// Who may enter the management panel. Defaults reproduce the pre-config
+// behaviour (super admins and project admins), an empty list means nobody.
+const sql = `
+ALTER TABLE "config"
+	ADD COLUMN "panel_global_roles"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',
+	ADD COLUMN "panel_project_roles" TEXT[] NOT NULL DEFAULT '{admin}';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts

@@ -0,0 +1,18 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+-- When TRUE, a person linked to this identity provider may authenticate ONLY through
+-- it: password sign-in, passwordless sign-in and password-reset mails are refused for
+-- them. The link itself is the marker, so it also covers a person who predates the
+-- provider and got linked by e-mail matching.
+--
+-- Scoped to providers that are currently enabled: disabling the provider restores
+-- local authentication for everyone linked to it, which is the break-glass for an IdP
+-- outage. Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "disable_local_authentication" BOOLEAN NOT NULL DEFAULT FALSE;
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-09-11-120000-custom-role.ts

@@ -0,0 +1,19 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// Custom tenant roles: runtime-defined global roles carrying validated grants.
+const sql = `
+CREATE TABLE custom_role (
+	id          UUID PRIMARY KEY,
+	slug        TEXT NOT NULL UNIQUE,
+	description TEXT,
+	grants      JSONB NOT NULL CHECK (jsonb_typeof(grants) = 'array'),
+	created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+	updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'custom_role_change';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -62,6 +62,11 @@ import _20260526140000idpsession from './2026-05-26-140000-idp-session.js'
 import _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'
 import _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'
 import _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'
+import _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'
+import _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'
+import _20260804120000configpanel from './2026-08-04-120000-config-panel.js'
+import _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'
+import _20260911120000customrole from './2026-09-11-120000-custom-role.js'
 import snapshot from './snapshot.js'
 import { computeTokenHash, Providers } from '../model/index.js'
 import { Logger } from '@contember/logger'
@@ -147,6 +152,11 @@ const migrations = {
 	'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,
 	'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,
 	'2026-06-16-130000-idp-logout': _20260616130000idplogout,
+	'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,
+	'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,
+	'2026-08-04-120000-config-panel': _20260804120000configpanel,
+	'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,
+	'2026-09-11-120000-custom-role': _20260911120000customrole,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -56,7 +56,11 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable',
+    'custom_role_change'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -179,9 +183,20 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );
+CREATE TABLE "custom_role" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "description" "text",
+    "grants" "jsonb" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    CONSTRAINT "custom_role_grants_check" CHECK (("jsonb_typeof"("grants") = 'array'::"text"))
+);
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
     "parent_id" "uuid",
@@ -199,7 +214,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,
@@ -333,6 +349,10 @@ ALTER TABLE ONLY "auth_policy"
     ADD CONSTRAINT "auth_policy_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "config"
     ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "email_unique" UNIQUE ("email");
 ALTER TABLE ONLY "identity"

package/src/model/authorization/CustomRoleAuthorizator.ts

@@ -0,0 +1,72 @@
+import { AuthorizationScope, Authorizator, Permissions } from '@contember/authorization'
+import { DatabaseContext } from '../utils/index.js'
+import { CustomRolesQuery } from '../queries/index.js'
+import { Identity } from './Identity.js'
+import { IdentityScope } from './IdentityScope.js'
+import { buildCustomRolePermissions, BUILTIN_TENANT_ROLES } from './CustomRolePermissions.js'
+
+export class CustomRolePermissionCache {
+	private loading: Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> | undefined
+
+	constructor(private readonly db: DatabaseContext) {}
+
+	/**
+	 * One query, two maps. `projectScoped` holds only the grants that carry their own project
+	 * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+	 */
+	load(): Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> {
+		this.loading ??= this.db.queryHandler.fetch(new CustomRolesQuery()).then(rows => ({
+			global: buildCustomRolePermissions(rows),
+			projectScoped: buildCustomRolePermissions(rows, { projectScoped: true }),
+		}))
+		return this.loading
+	}
+}
+
+/**
+ * Which scopes bound a check to one project. `Global` is unbounded and `IdentityScope` only *widens*
+ * (it adds `self` when the target is the caller), so neither constrains what a grant may reach —
+ * everything else is treated as project-bounded, so a scope kind added later fails closed rather
+ * than letting a tenant-global grant answer for every project.
+ */
+const isProjectBoundedScope = (scope: AuthorizationScope<Identity>): boolean =>
+	!(scope instanceof AuthorizationScope.Global) && !(scope instanceof IdentityScope)
+
+export class CustomRoleAuthorizator implements Authorizator<Identity> {
+	constructor(
+		private readonly inner: Authorizator<Identity>,
+		db: DatabaseContext,
+		public readonly customRoleCache = new CustomRolePermissionCache(db),
+	) {
+	}
+
+	/**
+	 * Loads the definitions up front so no later check has to query mid-transaction —
+	 * that would need a second pooled connection while the first one is pinned. No-op
+	 * for identities carrying only built-in roles.
+	 */
+	async preload(roles: readonly string[]): Promise<void> {
+		if (roles.some(role => !BUILTIN_TENANT_ROLES.has(role))) {
+			await this.customRoleCache.load()
+		}
+	}
+
+	async isAllowed(
+		identity: Identity,
+		scope: Parameters<Authorizator<Identity>['isAllowed']>[1],
+		action: Authorizator.Action,
+	): Promise<boolean> {
+		if (await this.inner.isAllowed(identity, scope, action)) {
+			return true
+		}
+		const customRoles = identity.roles.filter(role => !BUILTIN_TENANT_ROLES.has(role))
+		if (customRoles.length === 0) {
+			return false
+		}
+		// `Permissions.isAllowed` takes no scope, so a grant answering a project-bounded check would
+		// answer it for every project. Only grants carrying their own project filter get to try.
+		const loaded = await this.customRoleCache.load()
+		const permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global
+		return customRoles.some(role => permissions.isAllowed(role, action.resource, action.privilege, action.meta))
+	}
+}