@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts

@@ -0,0 +1,41 @@
+import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'
+
+/**
+ * Slugs of the identity providers that forbid this person every local
+ * authentication method — password sign-in, passwordless sign-in and the
+ * password-reset mail. Empty means local authentication is available.
+ *
+ * The IdP link is the marker, so this also covers a person who predates the
+ * provider and was linked to it by e-mail matching, not only one created by
+ * auto-sign-up. A DISABLED provider does not count: turning the provider off
+ * hands local authentication back to everyone linked to it, which is the
+ * break-glass when the IdP is unreachable.
+ */
+export class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {
+	constructor(
+		private readonly personId: string,
+	) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<string[]> {
+		const rows = await SelectBuilder.create<{ slug: string }>()
+			.select(['identity_provider', 'slug'], 'slug')
+			.from('person_identity_provider')
+			.join(
+				'identity_provider',
+				'identity_provider',
+				expr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),
+			)
+			.where(where =>
+				where
+					.compare(['person_identity_provider', 'person_id'], Operator.eq, this.personId)
+					.compare(['identity_provider', 'disable_local_authentication'], Operator.eq, true)
+					.isNull(['identity_provider', 'disabled_at'])
+			)
+			.orderBy(['identity_provider', 'slug'])
+			.getResult(db)
+
+		return rows.map(it => it.slug)
+	}
+}

package/src/model/queries/idp/PersonIdentityProvidersQuery.ts

@@ -7,6 +7,7 @@ export interface PersonIdentityProviderRow {
 	readonly identityProviderSlug: string
 	readonly identityProviderType: string
 	readonly identityProviderDisabledAt: Date | null
+	readonly identityProviderDisableLocalAuthentication: boolean
 }
 
 /**
@@ -29,6 +30,7 @@ export class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityPr
 			.select(['identity_provider', 'slug'], 'identityProviderSlug')
 			.select(['identity_provider', 'type'], 'identityProviderType')
 			.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')
+			.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')
 			.from('person_identity_provider')
 			.join(
 				'identity_provider',

package/src/model/queries/idp/helpers.ts

@@ -13,13 +13,14 @@ export const createBaseIdpQuery = () =>
 		.select('init_returns_config', 'initReturnsConfig')
 		.select('require_verified_email', 'requireVerifiedEmail')
 		.select('assume_email_verified', 'assumeEmailVerified')
+		.select('disable_local_authentication', 'disableLocalAuthentication')
 		.from('identity_provider')
 
 export const createIdpDto = (
-	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,
+	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,
 ): IdentityProviderDto => {
 	return {
 		...row,
-		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },
+		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
 	}
 }

package/src/model/queries/idp/index.ts

@@ -3,4 +3,5 @@ export * from './IdentityProvidersQuery.js'
 export * from './IdpSessionByApiKeyQuery.js'
 export * from './IdpSessionsBySidQuery.js'
 export * from './IdpSessionsBySubQuery.js'
+export * from './LocalAuthDisablingIdpsQuery.js'
 export * from './PersonIdentityProvidersQuery.js'

package/src/model/queries/idp/types.ts

@@ -11,6 +11,7 @@ export type IdentityProviderRow = {
 	initReturnsConfig: boolean
 	requireVerifiedEmail: boolean
 	assumeEmailVerified: boolean
+	disableLocalAuthentication: boolean
 }
 
 export type IdentityProviderDto =

package/src/model/queries/index.ts

@@ -1,5 +1,6 @@
 export * from './apiKey/index.js'
 export * from './authPolicy/index.js'
+export * from './customRole/index.js'
 export * from './configuration/index.js'
 export * from './mailTemplate/index.js'
 export * from './membership/index.js'

package/src/model/queries/membership/IdentityHasProjectMembershipsQuery.ts

@@ -0,0 +1,17 @@
+import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'
+
+export class IdentityHasProjectMembershipsQuery extends DatabaseQuery<ReadonlySet<string>> {
+	constructor(private readonly identityIds: readonly string[]) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<ReadonlySet<string>> {
+		const rows = await SelectBuilder.create<{ identity_id: string }>()
+			.distinct('identity_id')
+			.select('identity_id')
+			.from('project_membership')
+			.where(expr => expr.in('identity_id', this.identityIds))
+			.getResult(db)
+		return new Set(rows.map(row => row.identity_id))
+	}
+}

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -50,6 +50,7 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 
 				return qb
 			})
+			.orderBy(['identity', 'id'])
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)
 			.getResult(db)
 	}

package/src/model/queries/membership/index.ts

@@ -1,4 +1,5 @@
 export * from './AllProjectRolesByIdentityQuery.js'
+export * from './IdentityHasProjectMembershipsQuery.js'
 export * from './ProjectMembershipByIdentityQuery.js'
 export * from './ProjectMembersQuery.js'
 export * from './ProjectRolesByIdentityQuery.js'

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -17,6 +17,7 @@ export class PersonQueryBuilderFactory {
 			.select(expr => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), 'email_otp_enabled')
 			.select(['person', 'passwordless_enabled'])
 			.select(['person', 'email_verified_at'])
+			.select(['person', 'disabled_at'])
 			.from('person')
 			.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))
 	}
@@ -38,6 +39,9 @@ export class PersonQueryBuilderFactory {
 			.select(['person', 'disabled_at'])
 			.select(['person', 'passwordless_enabled'])
 			.select(['person', 'mfa_grace_until'])
+			// MFA grace gate on the DB clock (against now()), so app/DB skew can't
+			// extend the window. See SignInManager.enforceMfaEnrollment / CLAUDE.md.
+			.select(expr => expr.raw('"person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now()'), 'is_in_grace')
 			.select(['person', 'email_verified_at'])
 			.select(['person', 'email_verification_required'])
 			.select(['identity', 'roles'])

package/src/model/queries/person/types.ts

@@ -15,6 +15,8 @@ export interface PersonRow {
 	readonly disabled_at: Date | null
 	readonly passwordless_enabled: boolean | null
 	readonly mfa_grace_until: Date | null
+	/** `mfa_grace_until > now()` computed on the DB clock — the authoritative grace-window gate. */
+	readonly is_in_grace: boolean
 	readonly email_verified_at: Date | null
 	readonly email_verification_required: boolean
 }
@@ -36,4 +38,5 @@ export interface PersonListRow {
 	readonly email_otp_enabled: boolean
 	readonly passwordless_enabled: boolean | null
 	readonly email_verified_at: Date | null
+	readonly disabled_at: Date | null
 }

package/src/model/queries/personToken/PersonTokenQuery.ts

@@ -30,6 +30,10 @@ export class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {
 		let qb = SelectBuilder.create<PersonToken.Row>()
 			.from('person_token')
 			.select(new Literal('*'))
+			// Evaluate expiry on the DATABASE clock so the gate (validateToken's
+			// `is_expired` check) cannot be weakened by app/DB clock skew. The
+			// `expires_at` column itself is written on the DB clock too. See CLAUDE.md.
+			.select(new Literal('"expires_at" <= now()'), 'is_expired')
 			.where({
 				[this.identifierType]: this.identifier,
 				type: this.type,

package/src/model/queries/rateLimit/RateLimitCountQuery.ts

@@ -5,17 +5,20 @@ export class RateLimitCountQuery extends DatabaseQuery<number> {
 	constructor(
 		private readonly scope: RateLimitScope,
 		private readonly keyHash: Buffer,
-		private readonly windowStart: Date,
+		private readonly windowSeconds: number,
 	) {
 		super()
 	}
 
 	async fetch({ db }: DatabaseQueryable): Promise<number> {
+		// The window start is computed against the database clock (NOW()), not the
+		// application clock, so the limiter cannot be weakened by app/DB clock skew
+		// or by clock divergence between engine instances. See NextLoginAttemptQuery.
 		const rows = await SelectBuilder.create<{ count: string }>()
 			.from('rate_limit_event')
 			.select(new Literal('count(*)::text as count'))
 			.where({ scope: this.scope, key_hash: this.keyHash })
-			.where(expr => expr.compare('occurred_at', '>=', this.windowStart))
+			.where(new Literal('occurred_at >= NOW() - make_interval(secs => ?)', [this.windowSeconds]))
 			.getResult(db)
 		return Number(rows[0]?.count ?? '0')
 	}

package/src/model/service/AuthLogService.ts

@@ -3,6 +3,18 @@ import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntr
 import { Response } from '../utils/Response.js'
 import { AuthActionType } from '../type/AuthLog.js'
 import { JSONValue } from '@contember/schema'
+import { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'
+
+/**
+ * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a
+ * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort
+ * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is
+ * still recorded, just not as a reference.
+ */
+const invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>
+	isUnpersistedIdentityId(identityId)
+		? { metadata: { invokedByUnpersistedIdentityId: identityId } }
+		: { invokedById: identityId }
 
 class AuthLogService {
 	async logAuthAction(
@@ -37,13 +49,15 @@ class AuthLogService {
 		if (ctx.forwarderUserAgent !== undefined) {
 			metadata.forwarderUserAgent = ctx.forwarderUserAgent
 		}
+		const invoker = invokedBy(ctx.identityId)
+		Object.assign(metadata, invoker.metadata)
 
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				success: data.response.ok,
 				personInputIdentifier: data.personInput ?? authData?.data?.personInput,
 				personId: data.personId ?? authData?.data?.personId,
-				invokedById: ctx.identityId,
+				invokedById: invoker.invokedById,
 				type: data.type,
 				identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
 				errorCode: data.response.ok ? null : data.response.error,
@@ -77,10 +91,12 @@ class AuthLogService {
 			eventData?: JSONValue
 		},
 	): Promise<void> {
+		const invoker = invokedBy(entry.identityId)
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				type: entry.type,
-				invokedById: entry.identityId,
+				invokedById: invoker.invokedById,
+				metadata: invoker.metadata,
 				personId: entry.personId ?? undefined,
 				success: entry.success,
 				ipAddress: entry.ipAddress,

package/src/model/service/CustomRoleManager.ts

@@ -0,0 +1,221 @@
+import { LockType, UniqueViolationError } from '@contember/database'
+import { DatabaseContext } from '../utils/index.js'
+import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
+import { CustomRolesQuery, IdentitiesHoldingRoleCountQuery, ProjectsQuery } from '../queries/index.js'
+import { CreateCustomRoleCommand, DeleteCustomRoleCommand, RemoveCustomRoleAssignmentsCommand, UpdateCustomRoleCommand } from '../commands/index.js'
+import { CustomRoleRow } from '../type/index.js'
+import {
+	BUILTIN_TENANT_ROLES,
+	CanonicalCustomRoleGrant,
+	CustomRoleGrantValidationError,
+	parseCustomRoleGrants,
+	parsePersistedCustomRoleGrants,
+	parsePersistedCustomRoleReferences,
+} from '../authorization/CustomRolePermissions.js'
+import { ROLE_SLUG_PATTERN } from '../authorization/Roles.js'
+import { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js'
+import { GlobalRoleValidator } from './GlobalRoleValidator.js'
+
+const SLUG_MAX_LENGTH = 64
+
+export type CustomRoleState = {
+	readonly slug: string
+	readonly description: string | null
+	readonly grants: readonly CanonicalCustomRoleGrant[]
+}
+
+type CreateResult = {
+	readonly id: string
+	readonly role: CustomRoleState
+}
+
+type UpdateResult = {
+	readonly before: CustomRoleState
+	readonly after: CustomRoleState
+}
+
+type DeleteResult = {
+	readonly before: CustomRoleState
+	readonly removedAssignments: number
+	/** Which identities lost the role — a count alone cannot answer "who lost what" after the fact. */
+	readonly removedAssignmentIdentityIds: readonly string[]
+}
+
+export class CustomRoleManager {
+	constructor(
+		private readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),
+	) {
+	}
+
+	async listRoles(db: DatabaseContext): Promise<CustomRoleState[]> {
+		const rows = await db.queryHandler.fetch(new CustomRolesQuery())
+		return rows.map(row => this.toState(row))
+	}
+
+	async createRole(
+		db: DatabaseContext,
+		input: { slug: string; description: string | null; grants: unknown },
+	): Promise<Response<CreateResult, CreateCustomRoleErrorCode>> {
+		if (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {
+			return new ResponseError('INVALID_SLUG', `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`)
+		}
+		if (BUILTIN_TENANT_ROLES.has(input.slug)) {
+			return new ResponseError('INVALID_SLUG', `Slug ${input.slug} collides with a built-in role`)
+		}
+		const parsed = this.parseGrants(input.grants)
+		if (parsed instanceof ResponseError) {
+			return parsed
+		}
+		const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([input.slug]))
+		if (referenceError !== null) {
+			return referenceError
+		}
+		const existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }))
+		if (existing.length > 0) {
+			return new ResponseError('SLUG_ALREADY_EXISTS', `Custom role ${input.slug} already exists`)
+		}
+		// Only legacy rows can match: every assignment path rejects a slug with no custom_role row,
+		// so no concurrent writer can add one before this insert commits.
+		const holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug))
+		if (holders > 0) {
+			return new ResponseError(
+				'SLUG_ALREADY_ASSIGNED',
+				`Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`,
+			)
+		}
+		// A racing INSERT aborts the transaction, so UniqueViolationError cannot be mapped
+		// here — the caller catches it outside, once the transaction has rolled back.
+		const id = await db.commandBus.execute(
+			new CreateCustomRoleCommand({
+				slug: input.slug,
+				description: input.description,
+				grants: parsed.grants,
+			}),
+		)
+		return new ResponseOk({
+			id,
+			role: {
+				slug: input.slug,
+				description: input.description,
+				grants: parsed.grants,
+			},
+		})
+	}
+
+	/** Maps the racing-insert failure the transaction could not report itself. */
+	static isSlugConflict(error: unknown): boolean {
+		return error instanceof UniqueViolationError
+	}
+
+	async updateRole(
+		db: DatabaseContext,
+		slug: string,
+		input: { description?: string | null; grants?: unknown },
+	): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>> {
+		const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))
+		if (current === undefined) {
+			return new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)
+		}
+		let canonicalGrants: readonly CanonicalCustomRoleGrant[] | undefined
+		if (input.grants !== undefined) {
+			const parsed = this.parseGrants(input.grants)
+			if (parsed instanceof ResponseError) {
+				return parsed
+			}
+			const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([slug]))
+			if (referenceError !== null) {
+				return referenceError
+			}
+			canonicalGrants = parsed.grants
+		}
+		const before = this.toState(current)
+		const updated = await db.commandBus.execute(
+			new UpdateCustomRoleCommand(slug, {
+				description: input.description,
+				grants: canonicalGrants,
+			}),
+		)
+		if (!updated) {
+			return new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)
+		}
+		return new ResponseOk({
+			before,
+			after: {
+				slug,
+				description: input.description === undefined ? before.description : input.description,
+				grants: canonicalGrants ?? before.grants,
+			},
+		})
+	}
+
+	async deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>> {
+		const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))
+		if (current === undefined) {
+			return new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)
+		}
+		// References live inside an opaque jsonb blob — no FK can catch this. Read the other rows
+		// unlocked: a concurrent create/update naming this slug holds FOR SHARE on the row we
+		// already hold FOR UPDATE, so the two serialize without a second lock (and without the
+		// deadlock a reversed acquisition order would invite).
+		const referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery()))
+			.filter(row => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug))
+			.map(row => row.slug)
+		if (referencedBy.length > 0) {
+			return new ResponseError(
+				'ROLE_IN_USE',
+				`Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(', ')}`,
+			)
+		}
+		const deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug))
+		if (!deleted) {
+			return new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)
+		}
+		const removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug))
+		return new ResponseOk({
+			before: this.toState(current),
+			removedAssignments: removedAssignmentIdentityIds.length,
+			removedAssignmentIdentityIds,
+		})
+	}
+
+	private parseGrants(
+		grants: unknown,
+	): ReturnType<typeof parseCustomRoleGrants> | ResponseError<'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION'> {
+		try {
+			return parseCustomRoleGrants(grants)
+		} catch (error) {
+			if (error instanceof CustomRoleGrantValidationError) {
+				return new ResponseError(error.code, error.message)
+			}
+			throw error
+		}
+	}
+
+	private async validateReferences(
+		db: DatabaseContext,
+		roles: readonly string[],
+		projects: readonly string[],
+		additionallyActiveRoles: ReadonlySet<string>,
+	): Promise<ResponseError<'INVALID_PERMISSION_CONFIGURATION'> | null> {
+		const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles)
+		if (invalidRole !== null) {
+			return new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced role ${invalidRole} does not exist or is not globally assignable`)
+		}
+		if (projects.length > 0) {
+			const existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map(project => project.slug))
+			const missingProject = projects.find(project => !existingProjects.has(project))
+			if (missingProject !== undefined) {
+				return new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced project ${missingProject} does not exist`)
+			}
+		}
+		return null
+	}
+
+	private toState(row: CustomRoleRow): CustomRoleState {
+		return {
+			slug: row.slug,
+			description: row.description,
+			grants: parsePersistedCustomRoleGrants(row.grants),
+		}
+	}
+}

package/src/model/service/EmailChangeManager.ts

@@ -57,10 +57,10 @@ export class EmailChangeManager {
 		// "confirm your new e-mail" mails. Keyed on the normalized NEW address so
 		// the `email_change_init` auth-log entries (written with the same
 		// normalized address) actually drive the backoff. Reuses login_* config.
-		const nextAllowed = await dbContext.queryHandler.fetch(
+		const retryAfter = await dbContext.queryHandler.fetch(
 			new NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),
 		)
-		if (nextAllowed > dbContext.providers.now()) {
+		if (retryAfter > 0) {
 			return new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')
 		}
 
@@ -95,7 +95,7 @@ export class EmailChangeManager {
 
 	public async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {
 		const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))
-		const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })
+		const validation = validateToken({ entry: tokenRow, token, validationType: 'token' })
 		if (!validation.ok) {
 			// Tie the failure to a person/token in the audit log when we can, even
 			// for an invalid/expired token (matches verifyEmail / password reset).

package/src/model/service/EmailOtpManager.ts

@@ -83,7 +83,6 @@ export class EmailOtpManager {
 		const validation = validateToken({
 			entry: tokenResult,
 			token: code,
-			now: this.providers.now(),
 			validationType: 'otp',
 		})
 		if (!validation.ok) {

package/src/model/service/EmailVerificationManager.ts

@@ -44,10 +44,10 @@ export class EmailVerificationManager {
 		// Per-email exponential backoff on outbound mails, so a resend button
 		// (or an attacker poking the endpoint) can't be used to flood the
 		// mailbox. Reuses the login_* backoff config against person_auth_log.
-		const nextAllowed = await dbContext.queryHandler.fetch(
+		const retryAfter = await dbContext.queryHandler.fetch(
 			new NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),
 		)
-		if (nextAllowed > dbContext.providers.now()) {
+		if (retryAfter > 0) {
 			return false
 		}
 
@@ -73,7 +73,7 @@ export class EmailVerificationManager {
 
 	public async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {
 		const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))
-		const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })
+		const validation = validateToken({ entry: tokenRow, token, validationType: 'token' })
 		if (!validation.ok) {
 			// Carry whatever we know about the subject so the audit log can tie the
 			// failure to a person/token even on an invalid/expired token (matches

package/src/model/service/GlobalRoleValidator.ts

@@ -0,0 +1,30 @@
+import { LockType } from '@contember/database'
+import { BUILTIN_TENANT_ROLES, GLOBALLY_ASSIGNABLE_BUILTIN_ROLES } from '../authorization/CustomRolePermissions.js'
+import { CustomRolesQuery } from '../queries/index.js'
+import { DatabaseContext } from '../utils/index.js'
+
+export class GlobalRoleValidator {
+	async findInvalidRole(
+		db: DatabaseContext,
+		roles: readonly string[],
+		additionallyActiveRoles: ReadonlySet<string> = new Set(),
+	): Promise<string | null> {
+		const invalidBuiltin = roles.find(role => BUILTIN_TENANT_ROLES.has(role) && !GLOBALLY_ASSIGNABLE_BUILTIN_ROLES.has(role))
+		if (invalidBuiltin !== undefined) {
+			return invalidBuiltin
+		}
+		const customCandidates = [
+			...new Set(
+				roles.filter(role => !BUILTIN_TENANT_ROLES.has(role) && !additionallyActiveRoles.has(role)),
+			),
+		].sort()
+		if (customCandidates.length === 0) {
+			return null
+		}
+		const customRoles = await db.queryHandler.fetch(
+			new CustomRolesQuery({ slugs: customCandidates, lock: LockType.forShare }),
+		)
+		const existingSlugs = new Set(customRoles.map(role => role.slug))
+		return customCandidates.find(role => !existingSlugs.has(role)) ?? null
+	}
+}