@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/model/service/IDPSignInManager.ts

@@ -11,11 +11,16 @@ import { TenantRole } from '../authorization/index.js'
 import { NoPassword } from '../dtos/index.js'
 import { IdentityProviderRow } from '../queries/idp/types.js'
 import { AuthLogService } from './AuthLogService.js'
+import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'
+import { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'
+import { Logger } from '@contember/logger'
 
 class IDPSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
 		private readonly idpRegistry: IDPHandlerRegistry,
+		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {}
 
 	async signInIDP(
@@ -85,6 +90,41 @@ class IDPSignInManager {
 				})
 			}
 
+			// A09 — map IdP claims to project memberships. Returns a `{ before, after }` delta only
+			// when something actually changed; the resolver emits the `idp_role_mapped` audit from it
+			// (audit stays at the resolver layer).
+			//
+			// Fail-open on a MALFORMED/out-of-band `claimMapping`: parsing is caught so a bad config can
+			// never lock the user out — sign-in proceeds without claim mapping and the resolver emits an
+			// `idp_role_mapping_failed` marker. A DB error during the apply itself is NOT caught: it
+			// propagates and rolls back the whole sign-in transaction, so a half-applied set of grants is
+			// never committed (failing sign-in on an infra error is the safe outcome).
+			let mapping: ClaimMapping | null = null
+			let claimMappingFailed = false
+			try {
+				mapping = parseClaimMapping(provider.configuration)
+			} catch (e) {
+				this.logger.warn(e, { message: 'IdP sign-in: claim mapping configuration is invalid', identityProviderId: provider.id })
+				claimMappingFailed = true
+			}
+			let claimMappingAudit: ClaimMappingAudit | null = null
+			if (mapping) {
+				const syncResult = await this.claimSyncService.sync(
+					db,
+					mapping,
+					claim,
+					{ id: personRow.identity_id },
+					resolved.isNewPerson === true,
+				)
+				claimMappingAudit = syncResult.audit
+				// The apply-time safety backstop dropped a configured rule (config-time validation was skipped, or
+				// the project's ACL drifted since): surface the same fail-open marker as a malformed config, so a
+				// silently-unapplied grant is visible to the operator. The resolver emits `idp_role_mapping_failed`.
+				if (syncResult.droppedUnsafeRules) {
+					claimMappingFailed = true
+				}
+			}
+
 			const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
 				db,
 				personRow.identity_id,
@@ -109,19 +149,28 @@ class IDPSignInManager {
 					// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)
 					// so the operator can see that a session they expected to be continuously
 					// re-validated is in fact not protected, instead of failing closed at sign-in.
-					await db.commandBus.execute(
-						new CreateAuthLogEntryCommand({
-							type: 'idp_session_revalidation_failed',
-							invokedById: personRow.identity_id,
-							personId: personRow.id,
-							identityProviderId: provider.id,
-							personTokenId: apiKeyId,
-							success: true,
-							errorCode: 'encryption_disabled',
-							ipAddress: requestInfo?.ip,
-							userAgent: requestInfo?.userAgent,
-						}),
-					)
+					// Best-effort, in a savepoint: a failed insert would otherwise abort the whole
+					// sign-in transaction, and a lost audit row must not block the sign-in.
+					try {
+						await db.commandBus.transaction(bus =>
+							bus.execute(
+								new CreateAuthLogEntryCommand({
+									type: 'idp_session_revalidation_failed',
+									invokedById: personRow.identity_id,
+									personId: personRow.id,
+									identityProviderId: provider.id,
+									success: true,
+									errorCode: 'encryption_disabled',
+									ipAddress: requestInfo?.ip,
+									userAgent: requestInfo?.userAgent,
+									eventData: { apiKeyId },
+								}),
+							)
+						)
+					} catch (e) {
+						this.logger.error(e, { message: 'IdP sign-in: writing the encryption_disabled audit entry failed', identityProviderId: provider.id })
+						// the savepoint is rolled back, the sign-in transaction stays usable
+					}
 				}
 			}
 
@@ -129,6 +178,9 @@ class IDPSignInManager {
 				person: personRow,
 				token: sessionToken,
 				idpResponse: claim,
+				claimMappingAudit,
+				claimMappingFailed,
+				identityProviderId: provider.id,
 				[AuthLogService.Key]: new AuthLogService.Bag({
 					personId: personRow.id,
 					identityProviderId: provider.id,
@@ -194,7 +246,7 @@ class IDPSignInManager {
 		if (provider.autoSignUp) {
 			const signedUpPerson = await this.signUp(db, claim, provider)
 			await this.saveIdpIdentifier(db, provider, claim, signedUpPerson)
-			return { person: signedUpPerson }
+			return { person: signedUpPerson, isNewPerson: true }
 		}
 
 		return { person: null }
@@ -229,6 +281,8 @@ namespace IDPSignInManager {
 		readonly person: PersonRow | null
 		readonly blockedReason?: 'idp_email_unverified'
 		readonly blockedPersonId?: string
+		/** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */
+		readonly isNewPerson?: boolean
 	}
 
 	export type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>
@@ -237,6 +291,12 @@ namespace IDPSignInManager {
 		readonly person: PersonRow
 		readonly token: string
 		readonly idpResponse?: Record<string, unknown>
+		/** Identity provider the sign-in went through (for the resolver's audit). */
+		readonly identityProviderId?: string
+		/** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */
+		readonly claimMappingAudit?: ClaimMappingAudit | null
+		/** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */
+		readonly claimMappingFailed?: boolean
 		[AuthLogService.Key]: AuthLogService.Bag
 	}
 

package/src/model/service/PanelAccessResolver.ts

@@ -0,0 +1,32 @@
+import { DatabaseContext } from '../utils/index.js'
+import { AllProjectRolesByIdentityQuery, ConfigurationQuery } from '../queries/index.js'
+import { Providers } from '../providers.js'
+
+/**
+ * Decides whether an identity may enter the management panel served by the engine.
+ *
+ * This is an **entry gate for the console, not an authorization system**: everything the panel shows
+ * still goes through the tenant ACL, and whoever gets in could equally call `/tenant` directly. Its
+ * job is to keep the console door shut for accounts that have no business there, so an admin surface
+ * on a public API port does not look like a leak.
+ *
+ * An identity is allowed when it holds one of `globalRoles`, or a membership with one of
+ * `projectRoles` in **any** project. Empty lists mean nobody.
+ */
+export class PanelAccessResolver {
+	constructor(private readonly providers: Providers) {}
+
+	async isAllowed(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<boolean> {
+		const config = await db.queryHandler.fetch(new ConfigurationQuery(this.providers))
+		const policy = config.panel
+
+		if (policy.globalRoles.some(role => globalRoles.includes(role))) {
+			return true
+		}
+		if (policy.projectRoles.length === 0) {
+			return false
+		}
+		const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))
+		return projectRoles.some(it => policy.projectRoles.includes(it.role))
+	}
+}

package/src/model/service/PasswordResetManager.ts

@@ -1,6 +1,6 @@
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
 import { UserMailer } from '../mailing/index.js'
-import { ConfigurationQuery, PersonRow } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonRow } from '../queries/index.js'
 import { PermissionContext } from '../authorization/index.js'
 import { ProjectManager } from './ProjectManager.js'
 import { DatabaseContext } from '../utils/index.js'
@@ -35,13 +35,21 @@ export class PasswordResetManager {
 			throw new ImplementationException()
 		}
 
+		// A person federated through a provider with `disableLocalAuthentication`
+		// cannot sign in with a password, so a reset mail would only offer them a
+		// credential the tenant refuses — and one more link worth phishing.
+		const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+		if (exclusiveIdps.length > 0) {
+			return
+		}
+
 		// Per-email exponential backoff on outbound mails — don't spam a real
 		// user with reset mails just because attackers keep poking the
 		// endpoint. Reuses login_* backoff config against person_auth_log.
-		const nextAllowed = await dbContext.queryHandler.fetch(
+		const retryAfter = await dbContext.queryHandler.fetch(
 			new NextMailAttemptQuery(person.email, 'password_reset_init', 'password_reset'),
 		)
-		if (nextAllowed > new Date()) {
+		if (retryAfter > 0) {
 			return
 		}
 

package/src/model/service/PasswordlessSignInManager.ts

@@ -1,5 +1,5 @@
 import { ApiKeyManager } from './apiKey/index.js'
-import { ConfigurationQuery, PersonQuery, PersonRow } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow } from '../queries/index.js'
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
 import {
 	ActivatePasswordlessOtpErrorCode,
@@ -62,6 +62,16 @@ class PasswordlessSignInManager {
 					}),
 				})
 			}
+			const exclusiveIdps = await db.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+			if (exclusiveIdps.length > 0) {
+				return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+						personId: person.id,
+					}),
+				})
+			}
+
 			if (!isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
 				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {
 					[AuthLogService.Key]: new AuthLogService.Bag({
@@ -74,11 +84,11 @@ class PasswordlessSignInManager {
 			// Per-email exponential backoff on outbound mails — bound the spam
 			// pressure on a real user even if attackers spray the endpoint.
 			// Reuses login_* backoff config against person_auth_log.
-			const nextAllowed = await db.queryHandler.fetch(
+			const retryAfter = await db.queryHandler.fetch(
 				new NextMailAttemptQuery(email, 'passwordless_login_init', 'passwordless_login'),
 			)
-			if (nextAllowed > new Date()) {
-				const retryAfterSeconds = Math.max(1, Math.ceil((nextAllowed.getTime() - Date.now()) / 1000))
+			if (retryAfter > 0) {
+				const retryAfterSeconds = Math.max(1, retryAfter)
 				return new ResponseError(
 					'RATE_LIMIT_EXCEEDED',
 					`Too many passwordless sign-in requests for this email. Retry after ${retryAfterSeconds}s.`,
@@ -154,7 +164,6 @@ class PasswordlessSignInManager {
 			const tokenValidationResult = validateToken({
 				entry: tokenResult,
 				token,
-				now: db.providers.now(),
 				validationType,
 			})
 			if (!tokenValidationResult.ok) {
@@ -185,6 +194,18 @@ class PasswordlessSignInManager {
 				})
 			}
 
+			// Re-checked here and not only at init: a link created while this magic link
+			// was in flight would otherwise still mint a locally authenticated session.
+			const exclusiveIdps = await db.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(personRow.id))
+			if (exclusiveIdps.length > 0) {
+				return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: personRow.id,
+						tokenId: tokenResult?.id,
+					}),
+				})
+			}
+
 			let usedBackupCode = false
 			if (personRow.otp_secret && personRow.otp_activated_at) {
 				if (mfaOtp) {
@@ -259,7 +280,6 @@ class PasswordlessSignInManager {
 			const tokenValidationResult = validateToken({
 				entry: tokenResult,
 				token,
-				now: db.providers.now(),
 				validationType: 'token',
 			})
 			if (!tokenValidationResult.ok) {

package/src/model/service/PersonAccessManager.ts

@@ -1,14 +1,18 @@
+import { Logger } from '@contember/logger'
 import { PersonQuery, PersonRow } from '../queries/index.js'
 import { DatabaseContext } from '../utils/index.js'
 import { DisablePersonCommand } from '../commands/person/DisablePersonCommand.js'
+import { EnablePersonCommand } from '../commands/person/EnablePersonCommand.js'
 import { ApiKeyManager } from './apiKey/index.js'
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
-import { DisablePersonErrorCode } from '../../schema/index.js'
+import { DisablePersonErrorCode, EnablePersonErrorCode } from '../../schema/index.js'
 
 class PersonAccessManager {
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
 
-	async disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {
+	async disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse> {
+		// Retried: the api_key update races the target's own background session tracking and loses with a 40001,
+		// which would otherwise leave the person enabled behind an internal error. Nothing here escapes the transaction.
 		return await dbContext.transaction(async trx => {
 			if (person.disabled_at !== null) {
 				return new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')
@@ -19,7 +23,18 @@ class PersonAccessManager {
 			await this.disableIdentityApiKeys(trx, person.identity_id)
 
 			return new ResponseOk(null)
-		})
+		}, { retry: { logger } })
+	}
+
+	async enablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonEnableAccessResponse> {
+		if (person.disabled_at === null) {
+			return new ResponseError('PERSON_ALREADY_ENABLED', 'Person is already enabled')
+		}
+
+		// Only clears the disabled flag — api keys revoked while disabling stay revoked, the person has to sign in again.
+		await dbContext.commandBus.execute(new EnablePersonCommand(person.id))
+
+		return new ResponseOk(null)
 	}
 
 	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {
@@ -32,5 +47,6 @@ class PersonAccessManager {
 }
 
 export type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>
+export type PersonEnableAccessResponse = Response<null, EnablePersonErrorCode>
 
 export { PersonAccessManager }

package/src/model/service/RateLimiter.ts

@@ -30,7 +30,7 @@ export interface RateLimitDecision {
  */
 export class RateLimiter {
 	constructor(
-		private readonly providers: Pick<Providers, 'hash' | 'now'>,
+		private readonly providers: Pick<Providers, 'hash'>,
 	) {}
 
 	private hashKey(key: string): Buffer {
@@ -64,8 +64,7 @@ export class RateLimiter {
 		if (limit <= 0 || windowSeconds <= 0) {
 			return { ok: true }
 		}
-		const windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1000)
-		const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowStart))
+		const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds))
 		if (count < limit) {
 			return { ok: true }
 		}

package/src/model/service/RolesManager.ts

@@ -1,13 +1,40 @@
 import { DatabaseContext } from '../utils/index.js'
 import { PatchIdentityGlobalRoles } from '../commands/index.js'
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
-import { TenantRole } from '../authorization/index.js'
+import { GlobalRoleValidator } from './GlobalRoleValidator.js'
+import { Connection } from '@contember/database'
 
 export class RolesManager {
+	constructor(
+		private readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),
+	) {
+	}
+
 	async addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+		return await dbContext.transaction(async db => {
+			const validation = await this.validateAddedGlobalRoles(db, roles)
+			if (!validation.ok) {
+				return validation
+			}
+			return await this.addValidatedGlobalRoles(db, identityId, roles)
+		}, { isolation: 'readCommitted' })
+	}
+
+	async addValidatedGlobalRoles(
+		dbContext: DatabaseContext<Connection.TransactionLike>,
+		identityId: string,
+		roles: readonly string[],
+	): Promise<Response<null, GlobalRolesErrorCode>> {
 		return this.patchGlobalRoles(dbContext, identityId, roles, [])
 	}
 
+	async validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
+		const invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles)
+		return invalidRole === null
+			? new ResponseOk(null)
+			: new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)
+	}
+
 	async removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {
 		return this.patchGlobalRoles(dbContext, identityId, [], roles)
 	}
@@ -18,25 +45,12 @@ export class RolesManager {
 		addRoles: readonly string[],
 		removeRoles: readonly string[],
 	): Promise<Response<null, GlobalRolesErrorCode>> {
-		const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])
-		if (rolesValidationError) {
-			return rolesValidationError
-		}
 		const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))
 		if (!result) {
 			return new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)
 		}
 		return new ResponseOk(null)
 	}
-
-	private validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {
-		for (const role of roles) {
-			if (!Object.values(TenantRole).includes(role as TenantRole)) {
-				return new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)
-			}
-		}
-		return null
-	}
 }
 
 type GlobalRolesErrorCode =

package/src/model/service/SignInManager.ts

@@ -1,6 +1,6 @@
 import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'
 import { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'
-import { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'
 import { Config } from '../type/Config.js'
 import { Providers } from '../providers.js'
 import { DatabaseContext } from '../utils/index.js'
@@ -51,6 +51,14 @@ class SignInManager {
 				personId: person.id,
 			}),
 		}
+		// Refused before the password is even looked at: for a person federated
+		// through a provider with `disableLocalAuthentication`, a password is not a
+		// credential this tenant accepts, however it got set.
+		const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+		if (exclusiveIdps.length > 0) {
+			return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, authLogData)
+		}
+
 		if (!person.password_hash) {
 			return new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)
 		}
@@ -323,8 +331,6 @@ class SignInManager {
 			return null
 		}
 
-		const now = this.providers.now()
-
 		// Resolve the effective grace duration (seconds). A per-policy override
 		// wins; otherwise we fall back to the global config default. Only fetch the
 		// config when the override is absent, to keep query shapes minimal.
@@ -337,17 +343,19 @@ class SignInManager {
 		}
 
 		// Grace handling. Default grace duration is 0 (immediate enforcement), so
-		// by default neither branch below opens a window.
+		// by default neither branch below opens a window. Whether we're still inside
+		// an open window is decided on the DB clock (PersonRow.is_in_grace, evaluated
+		// against now()); the null check below only distinguishes "never opened" from
+		// "opened (and possibly expired)". See engine-tenant-api/CLAUDE.md.
 		if (person.mfa_grace_until !== null) {
-			if (person.mfa_grace_until.getTime() > now.getTime()) {
+			if (person.is_in_grace) {
 				// Still inside an open grace window — allow sign-in.
 				return null
 			}
 			// Grace expired → fall through to enforcement.
 		} else if (graceSeconds > 0) {
-			// Open the grace window now and allow this sign-in.
-			const graceUntil = new Date(now.getTime() + graceSeconds * 1000)
-			await dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil))
+			// Open the grace window (now() + graceSeconds on the DB clock) and allow this sign-in.
+			await dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceSeconds))
 			return null
 		}
 

package/src/model/service/SignUpManager.ts

@@ -9,6 +9,7 @@ import { EmailValidator } from './EmailValidator.js'
 import { PasswordStrengthValidator } from './PasswordStrengthValidator.js'
 import { validateEmail as isEmailFormatValid } from '../utils/email.js'
 import { Config } from '../type/Config.js'
+import { GlobalRoleValidator } from './GlobalRoleValidator.js'
 
 type SignUpUser = {
 	email: string
@@ -22,6 +23,7 @@ export class SignUpManager {
 	constructor(
 		private readonly emailValidator: EmailValidator,
 		private readonly passwordStrengthValidator: PasswordStrengthValidator,
+		private readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),
 	) {
 	}
 
@@ -59,11 +61,17 @@ export class SignUpManager {
 		// were created while verification was optional.
 		const emailVerificationRequired = config.signup.requireEmailVerification
 
-		const person = await dbContext.transaction(async db => {
+		// Validating inside the transaction holds the FOR SHARE lock on the custom roles until the
+		// identity is written, so a concurrent deleteCustomRole cannot leave it a dangling slug.
+		return await dbContext.transaction(async (db): Promise<SignUpResponse> => {
+			const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles)
+			if (invalidRole !== null) {
+				return new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)
+			}
 			const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))
-			return await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))
-		})
-		return new ResponseOk(new SignUpResult(person, emailVerificationRequired))
+			const person = await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))
+			return new ResponseOk(new SignUpResult(person, emailVerificationRequired))
+		}, { isolation: 'readCommitted' })
 	}
 }