@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/src/resolvers/mutation/person/DisablePersonMutationResolver.ts

@@ -1,6 +1,6 @@
 import { DisablePersonResponse, MutationDisablePersonArgs, MutationResolvers } from '../../../schema/index.js'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { PermissionActions, PersonAccessManager } from '../../../model/index.js'
+import { createPersonPermissionTarget, PermissionActions, PersonAccessManager } from '../../../model/index.js'
 import { PersonManager } from '../../../model/service/PersonManager.js'
 import { createErrorResponse } from '../../errorUtils.js'
 
@@ -11,7 +11,7 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 	) {}
 
 	async disablePerson(
-		parent: any,
+		parent: unknown,
 		args: MutationDisablePersonArgs,
 		context: TenantResolverContext,
 	): Promise<DisablePersonResponse> {
@@ -28,15 +28,15 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 		}
 
 		await context.requireAccess({
-			action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
+			action: PermissionActions.PERSON_DISABLE(await createPersonPermissionTarget(context.db, targetPerson)),
 			message: 'You are not allowed to disable person account',
 		})
 
-		const result = await this.personAccessManager.disablePerson(context.db, targetPerson)
+		const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)
 		await context.logAuthAction({
 			type: 'person_disable',
 			response: result,
-			personId: targetPerson.id,
+			targetPersonId: targetPerson.id,
 		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)

package/src/resolvers/mutation/person/EmailVerificationMutationResolver.ts

@@ -67,7 +67,7 @@ export class EmailVerificationMutationResolver implements Pick<MutationResolvers
 			const permissionContext = await this.permissionContextFactory.create(context.db, {
 				id: person.identity_id,
 				roles: person.roles,
-			})
+			}, context.permissionContext.authorizator)
 			const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, person, {
 				mailVariant: args.options?.mailVariant || undefined,
 				project: args.options?.mailProject || undefined,

package/src/resolvers/mutation/person/EnablePersonMutationResolver.ts

@@ -0,0 +1,50 @@
+import { EnablePersonResponse, MutationEnablePersonArgs, MutationResolvers } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { createPersonPermissionTarget, PermissionActions, PersonAccessManager } from '../../../model/index.js'
+import { PersonManager } from '../../../model/service/PersonManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+
+export class EnablePersonMutationResolver implements MutationResolvers {
+	constructor(
+		private readonly personAccessManager: PersonAccessManager,
+		private readonly personManager: PersonManager,
+	) {}
+
+	async enablePerson(
+		parent: unknown,
+		args: MutationEnablePersonArgs,
+		context: TenantResolverContext,
+	): Promise<EnablePersonResponse> {
+		const targetPerson = await this.personManager.findPersonById(context.db, args.personId)
+
+		if (targetPerson === null) {
+			return {
+				ok: false,
+				error: {
+					code: 'PERSON_NOT_FOUND',
+					developerMessage: `Person <${args.personId}> was not found`,
+				},
+			}
+		}
+
+		// Enabling is the inverse of disabling, so it is the same privilege — a separate resource/privilege pair would need an ACL change everywhere.
+		await context.requireAccess({
+			action: PermissionActions.PERSON_DISABLE(await createPersonPermissionTarget(context.db, targetPerson)),
+			message: 'You are not allowed to enable person account',
+		})
+
+		const result = await this.personAccessManager.enablePerson(context.db, targetPerson)
+		await context.logAuthAction({
+			type: 'person_enable',
+			response: result,
+			targetPersonId: targetPerson.id,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return {
+			ok: true,
+		}
+	}
+}

package/src/resolvers/mutation/person/ForceSignOutMutationResolver.ts

@@ -1,6 +1,6 @@
 import { ForceSignOutPersonResponse, MutationForceSignOutPersonArgs, MutationResolvers } from '../../../schema/index.js'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { ApiKeyManager, PermissionActions } from '../../../model/index.js'
+import { ApiKeyManager, createPersonPermissionTarget, PermissionActions } from '../../../model/index.js'
 import { PersonManager } from '../../../model/service/PersonManager.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { ResponseError, ResponseOk } from '../../../model/utils/Response.js'
@@ -22,7 +22,7 @@ export class ForceSignOutMutationResolver implements Pick<MutationResolvers, 'fo
 		const reason = args.reason ?? null
 
 		await context.requireAccess({
-			action: PermissionActions.PERSON_FORCE_SIGN_OUT(targetPerson?.roles ?? []),
+			action: PermissionActions.PERSON_FORCE_SIGN_OUT(await createPersonPermissionTarget(context.db, targetPerson)),
 			message: 'You are not allowed to force sign out this person',
 		})
 

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -9,6 +9,7 @@ import { TenantResolverContext } from '../../TenantResolverContext.js'
 import { IDPSignInManager, PermissionActions } from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class IDPMutationResolver implements MutationResolvers {
 	constructor(
@@ -59,6 +60,36 @@ export class IDPMutationResolver implements MutationResolvers {
 			type: 'idp_login',
 			response: signIn,
 		})
+		// A09 — audit claim-mapping membership sync separately from the login itself, with a plain
+		// `{ before, after }` diff. Emitted only when the mapping actually changed grants on this
+		// sign-in (the manager returns null otherwise).
+		if (signIn.ok && signIn.result.claimMappingAudit) {
+			const audit = signIn.result.claimMappingAudit
+			await context.logAuthAction({
+				type: 'idp_role_mapped',
+				response: new ResponseOk(null),
+				personId: signIn.result.person.id,
+				// the membership change affects the signing-in person — record it as the target too, so it
+				// surfaces in target_person_id audit queries like the other project_membership_* events.
+				targetPersonId: signIn.result.person.id,
+				identityProviderId: signIn.result.identityProviderId,
+				// the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it
+				// whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).
+				eventData: audit,
+			})
+		}
+		// A09 fail-open marker: the mapping was configured but its evaluation/apply failed and was
+		// skipped so sign-in could proceed. Audited (no claim values in the payload) so a broken
+		// mapping is visible to the operator instead of silently never applying.
+		if (signIn.ok && signIn.result.claimMappingFailed) {
+			await context.logAuthAction({
+				type: 'idp_role_mapping_failed',
+				response: new ResponseOk(null),
+				personId: signIn.result.person.id,
+				targetPersonId: signIn.result.person.id,
+				identityProviderId: signIn.result.identityProviderId,
+			})
+		}
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -68,6 +68,13 @@ export class PasswordlessMutationResolver
 				// If the user does not exist, we don't want to reveal that
 				return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
 			}
+			// Naming the provider tells the caller both that the person exists and how
+			// they authenticate, so it needs both reveal flags. PASSWORDLESS_DISABLED is
+			// the neutral answer this endpoint already gives for an unknown address.
+			const { revealUserExists, revealLoginMethod } = configuration.login
+			if (result.error === 'IDP_REQUIRED' && !(revealUserExists && revealLoginMethod)) {
+				return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+			}
 
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/ResetPasswordMutationResolver.ts

@@ -77,7 +77,7 @@ export class ResetPasswordMutationResolver implements MutationResolvers {
 		const permissionContext = await this.permissionContextFactory.create(context.db, {
 			id: person.identity_id,
 			roles: person.roles,
-		})
+		}, context.permissionContext.authorizator)
 		await this.passwordResetManager.createPasswordResetRequest(context.db, permissionContext, person, {
 			mailVariant: args.options?.mailVariant || undefined,
 			project: args.options?.mailProject || undefined,

package/src/resolvers/mutation/person/ResetPersonMfaMutationResolver.ts

@@ -1,6 +1,6 @@
 import { MutationResetPersonMfaArgs, MutationResolvers, ResetPersonMfaResponse } from '../../../schema/index.js'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { BackupCodeManager, PermissionActions } from '../../../model/index.js'
+import { BackupCodeManager, createPersonPermissionTarget, PermissionActions } from '../../../model/index.js'
 import { PersonManager } from '../../../model/service/PersonManager.js'
 import { ResetPersonMfaCommand } from '../../../model/commands/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
@@ -23,7 +23,7 @@ export class ResetPersonMfaMutationResolver implements Pick<MutationResolvers, '
 		const targetPerson = await this.personManager.findPersonById(context.db, args.personId)
 
 		await context.requireAccess({
-			action: PermissionActions.PERSON_RESET_MFA(targetPerson?.roles ?? []),
+			action: PermissionActions.PERSON_RESET_MFA(await createPersonPermissionTarget(context.db, targetPerson)),
 			message: 'You are not allowed to reset MFA for this person',
 		})
 

package/src/resolvers/mutation/person/SignInMutationResolver.ts

@@ -6,7 +6,14 @@ import {
 	SignInResponse,
 } from '../../../schema/index.js'
 import { TenantResolverContext } from '../../TenantResolverContext.js'
-import { ConfigurationQuery, PermissionActions, PersonUniqueIdentifier, RateLimiter, SignInManager } from '../../../model/index.js'
+import {
+	ConfigurationQuery,
+	createPersonPermissionTarget,
+	PermissionActions,
+	PersonUniqueIdentifier,
+	RateLimiter,
+	SignInManager,
+} from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'
 import { UserInputError } from '@contember/graphql-utils'
@@ -37,11 +44,11 @@ export class SignInMutationResolver implements MutationResolvers {
 			)
 		}
 
-		const nextAllowedSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))
-		if (nextAllowedSignIn > new Date()) {
+		const retryAfterSignIn = await context.db.queryHandler.fetch(new NextLoginAttemptQuery(args.email))
+		if (retryAfterSignIn > 0) {
 			return createErrorResponse(
 				new ResponseError('RATE_LIMIT_EXCEEDED', `Too many attempts, please try again later.`, {
-					retryAfter: Math.ceil((nextAllowedSignIn.getTime() - Date.now()) / 1000),
+					retryAfter: retryAfterSignIn,
 				}),
 			)
 		}
@@ -108,10 +115,10 @@ export class SignInMutationResolver implements MutationResolvers {
 		if (!response.ok) {
 			const { revealUserExists, revealLoginMethod } = configuration.login
 			const collapseAll = !revealUserExists
-				&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)
+				&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL', 'IDP_REQUIRED'].includes(response.error)
 			const collapseMethodOnly = revealUserExists
 				&& !revealLoginMethod
-				&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)
+				&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD', 'IDP_REQUIRED'].includes(response.error)
 			if (collapseAll || collapseMethodOnly) {
 				return createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')
 			}
@@ -136,7 +143,7 @@ export class SignInMutationResolver implements MutationResolvers {
 
 	async createSessionToken(parent: any, args: MutationCreateSessionTokenArgs, context: TenantResolverContext): Promise<CreateSessionTokenResponse> {
 		await context.requireAccess({
-			action: PermissionActions.PERSON_CREATE_SESSION_KEY(),
+			action: PermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),
 			message: 'You are not allowed to create a session key',
 		})
 		let identifier: PersonUniqueIdentifier
@@ -148,17 +155,23 @@ export class SignInMutationResolver implements MutationResolvers {
 			throw new UserInputError(`Please provide either email or personId`)
 		}
 
+		const trustForwardedClientInfo = args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo
 		const response = await this.signInManager.createSessionToken(
 			context.db,
 			identifier,
 			args.expiration || undefined,
 			async person =>
 				await context.requireAccess({
-					action: PermissionActions.PERSON_CREATE_SESSION_KEY(person.roles),
+					action: PermissionActions.PERSON_CREATE_SESSION_KEY({
+						phase: 'target',
+						target: await createPersonPermissionTarget(context.db, person) ?? undefined,
+						requestedExpirationMinutes: args.expiration ?? null,
+						trustForwardedClientInfo,
+					}),
 					message: 'You are not allowed to create a session key for this person.',
 				}),
 			context.httpInfo,
-			args.options?.trustForwardedClientInfo === true && context.trustForwardedInfo,
+			trustForwardedClientInfo,
 		)
 		await context.logAuthAction({
 			type: 'create_session_token',

package/src/resolvers/mutation/person/SignUpMutationResolver.ts

@@ -92,7 +92,7 @@ export class SignUpMutationResolver implements MutationResolvers {
 				const permissionContext = await this.permissionContextFactory.create(context.db, {
 					id: personRow.identity_id,
 					roles: personRow.roles,
-				})
+				}, context.permissionContext.authorizator)
 				const sent = await this.emailVerificationManager.sendVerificationEmail(context.db, permissionContext, personRow)
 				if (sent) {
 					await context.logAuthAction({

package/src/resolvers/query/CustomRoleQueryResolver.ts

@@ -0,0 +1,41 @@
+import { CustomRole, CustomRolePermissionDefinition, QueryResolvers } from '../../schema/index.js'
+import { CustomRoleManager, PermissionActions } from '../../model/index.js'
+import { getGrantablePermissions, isConfigurationRequired } from '../../model/authorization/CustomRolePermissions.js'
+import { TenantResolverContext } from '../TenantResolverContext.js'
+
+/** Lists custom roles and the grantable permission vocabulary. Gated by `customRole:view`. */
+export class CustomRoleQueryResolver implements Pick<QueryResolvers, 'customRoles' | 'customRolePermissions'> {
+	constructor(
+		private readonly customRoleManager: CustomRoleManager,
+	) {}
+
+	async customRoles(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRole[]> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_VIEW,
+			message: 'You are not allowed to view custom roles',
+		})
+
+		const rows = await this.customRoleManager.listRoles(context.db)
+		return rows.map((row): CustomRole => ({
+			slug: row.slug,
+			description: row.description,
+			grants: row.grants,
+		}))
+	}
+
+	async customRolePermissions(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly CustomRolePermissionDefinition[]> {
+		await context.requireAccess({
+			action: PermissionActions.CUSTOM_ROLE_VIEW,
+			message: 'You are not allowed to view custom role permissions',
+		})
+
+		return [...getGrantablePermissions().values()]
+			.sort((left, right) => left.name.localeCompare(right.name))
+			.map(definition => ({
+				name: definition.name,
+				configurationKind: definition.configurationKind,
+				configurationRequired: isConfigurationRequired(definition),
+				defaultConfig: definition.defaultConfig,
+			}))
+	}
+}

package/src/resolvers/query/MailTemplateQueryResolver.ts

@@ -3,15 +3,20 @@ import { MailTemplateListQuery, mailTypeFromDbToSchema, PermissionActions } from
 import { TenantResolverContext } from '../TenantResolverContext.js'
 
 export class MailTemplateQueryResolver implements QueryResolvers {
+	/** Filters per row rather than throwing, like the other tenant read fields. */
 	async mailTemplates(parent: unknown, args: unknown, context: TenantResolverContext): Promise<MailTemplateData[]> {
-		await context.requireAccess({
-			action: PermissionActions.MAIL_TEMPLATE_LIST,
-			message: 'You are not allowed to list mail templates',
-		})
-		return (await context.db.queryHandler.fetch(new MailTemplateListQuery())).map(it => ({
-			...it,
-			variant: it.variant || null,
-			type: mailTypeFromDbToSchema(it.type),
+		const rows = await context.db.queryHandler.fetch(new MailTemplateListQuery())
+		const visible = await Promise.all(rows.map(async row => {
+			const type = mailTypeFromDbToSchema(row.type)
+			const allowed = await context.isAllowed({
+				action: PermissionActions.MAIL_TEMPLATE_LIST({
+					kind: row.projectSlug === null ? 'global' : 'project',
+					projectSlug: row.projectSlug,
+					type,
+				}),
+			})
+			return allowed ? { ...row, variant: row.variant || null, type } : null
 		}))
+		return visible.filter(row => row !== null)
 	}
 }

package/src/resolvers/query/PersonQueryResolver.ts

@@ -34,7 +34,9 @@ export class PersonQueryResolver implements QueryResolvers {
 			identityId: args.filter?.identityId,
 		}
 
-		// SUPER_ADMIN (global wildcard) may list every person.
+		// SUPER_ADMIN and PROJECT_ADMIN hold person:list and see every person; so does
+		// a custom role granted it. The check carries no scope, so a *global* project_admin
+		// lists the whole tenant, not just their projects' members.
 		if (await context.isAllowed({ action: PermissionActions.PERSON_LIST })) {
 			const rows = await this.personManager.listPersons(context.db, filter, args.limit, args.offset)
 			return rows.map(row => PersonResponseFactory.createPersonResponse(row))

package/src/resolvers/query/ProjectQueryResolver.ts

@@ -1,13 +1,14 @@
 import { Maybe, Project, QueryProjectBySlugArgs, QueryResolvers } from '../../schema/index.js'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 import { PermissionActions, ProjectManager } from '../../model/index.js'
+import { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'
 
 export class ProjectQueryResolver implements QueryResolvers {
 	constructor(private readonly projectManager: ProjectManager) {}
 
 	async projects(parent: unknown, args: unknown, context: TenantResolverContext): Promise<readonly Project[]> {
 		return (await this.projectManager.getProjectsByIdentity(context.db, context.identity.id, context.permissionContext)).map(
-			it => ({ ...it, members: [], roles: [], apiKeys: [], secrets: [] }),
+			ProjectResponseFactory.createProjectResponse,
 		)
 	}
 
@@ -27,6 +28,6 @@ export class ProjectQueryResolver implements QueryResolvers {
 			return null
 		}
 
-		return { ...project, members: [], roles: [], apiKeys: [], secrets: [] }
+		return ProjectResponseFactory.createProjectResponse(project)
 	}
 }

package/src/resolvers/responseHelpers/PersonResponseFactory.ts

@@ -14,6 +14,11 @@ export class PersonResponseFactory {
 			emailVerified: !!personRow.email_verified_at,
 			name: personRow.name,
 			passwordlessEnabled: personRow.passwordless_enabled,
+			// resolved by PersonTypeResolver, which needs the tenant policy; placeholders keep the
+			// non-nullable field types complete
+			passwordlessAvailable: false,
+			passwordlessSelfManaged: false,
+			disabledAt: personRow.disabled_at,
 			identity: {
 				id: personRow.identity_id,
 				projects,

package/src/resolvers/responseHelpers/ProjectResponseFactory.ts

@@ -0,0 +1,24 @@
+import { Project as ProjectDto } from '../../model/index.js'
+import { Project } from '../../schema/index.js'
+
+/** Placeholder for `Project.permissions`; `ProjectTypeResolver.permissions` always replaces it. */
+const unresolvedPermissions = {
+	canViewMembers: false,
+	canAddMember: false,
+	canUpdateMember: false,
+	canRemoveMember: false,
+	canViewSecrets: false,
+	canSetSecret: false,
+	canCreateApiKey: false,
+	canUpdate: false,
+}
+
+export class ProjectResponseFactory {
+	/**
+	 * The row plus placeholders for everything `ProjectTypeResolver` resolves per caller — members,
+	 * roles, api keys, secrets and permissions all need the project scope, which is not known here.
+	 */
+	public static createProjectResponse(project: ProjectDto): Project {
+		return { ...project, members: [], roles: [], apiKeys: [], secrets: [], permissions: unresolvedPermissions }
+	}
+}

package/src/resolvers/responseHelpers/SignInResponseFactory.ts

@@ -18,7 +18,7 @@ export class SignInResponseFactory {
 		const permissionContext = this.permissionContextFactory.create(context.db, {
 			id: identityId,
 			roles: signInResult.person.roles,
-		})
+		}, context.permissionContext.authorizator)
 		const projects = await this.identityTypeResolver.projects(
 			{ id: identityId, projects: [] },
 			{},

package/src/resolvers/types/IdentityTypeResolver.ts

@@ -1,5 +1,6 @@
 import { Identity, IdentityGlobalPermissions, IdentityProjectRelation, IdentityResolvers, Maybe, Person, SessionInfo } from '../../schema/index.js'
 import {
+	createTargetIdentityPermissionTarget,
 	IdentityQuery,
 	PermissionActions,
 	PermissionContextFactory,
@@ -7,12 +8,14 @@ import {
 	PersonRow,
 	ProjectManager,
 	ProjectMemberManager,
+	targetIdentityLoader,
 } from '../../model/index.js'
 import { ApiKeySessionsByIdentityQuery } from '../../model/queries/apiKey/index.js'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 import { notEmpty } from '../../utils/array.js'
 import { batchLoader } from '../../utils/batchQuery.js'
 import { PersonResponseFactory } from '../responseHelpers/PersonResponseFactory.js'
+import { ProjectResponseFactory } from '../responseHelpers/ProjectResponseFactory.js'
 
 export class IdentityTypeResolver implements IdentityResolvers {
 	private personLoader = batchLoader<string, Record<string, PersonRow>, PersonRow>(
@@ -75,7 +78,7 @@ export class IdentityTypeResolver implements IdentityResolvers {
 						return null
 					}
 					return {
-						project: { ...it, members: [], roles: [], apiKeys: [], secrets: [] },
+						project: ProjectResponseFactory.createProjectResponse(it),
 						memberships: memberships,
 					}
 				}),
@@ -121,16 +124,51 @@ export class IdentityTypeResolver implements IdentityResolvers {
 			if (roles === null) {
 				return null
 			}
-			return this.permissionContextFactory.create(context.db, { id: parent.id, roles })
+			return this.permissionContextFactory.create(context.db, { id: parent.id, roles }, context.permissionContext.authorizator)
 		})()
 
 		if (!permissionsContext) {
 			return null
 		}
 
+		// Advisory only — every one of these is checked again where it is used. It exists so a UI can
+		// stop offering what it cannot deliver: the operations behind these flags fail in three
+		// different ways (empty list, thrown query, thrown mutation), so probing is not an option.
+		const [
+			canCreateProject,
+			canDeployEntrypoint,
+			canViewConfiguration,
+			canListIdentityProviders,
+			canListMailTemplates,
+			canManageConfiguration,
+			canViewAuthLog,
+			canListPersons,
+			canListGlobalApiKeys,
+			canCreateGlobalApiKey,
+		] = await Promise.all([
+			permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
+			permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+			permissionsContext.isAllowed({ action: PermissionActions.CONFIG_VIEW }),
+			permissionsContext.isAllowed({ action: PermissionActions.IDP_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.MAIL_TEMPLATE_LIST() }),
+			permissionsContext.isAllowed({ action: PermissionActions.CONFIGURE }),
+			permissionsContext.isAllowed({ action: PermissionActions.AUTH_LOG_VIEW }),
+			permissionsContext.isAllowed({ action: PermissionActions.PERSON_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.API_KEY_LIST }),
+			permissionsContext.isAllowed({ action: PermissionActions.API_KEY_CREATE_GLOBAL() }),
+		])
+
 		return {
-			canCreateProject: await permissionsContext.isAllowed({ action: PermissionActions.PROJECT_CREATE }),
-			canDeployEntrypoint: await permissionsContext.isAllowed({ action: PermissionActions.ENTRYPOINT_DEPLOY }),
+			canCreateProject,
+			canDeployEntrypoint,
+			canViewConfiguration,
+			canListIdentityProviders,
+			canListMailTemplates,
+			canManageConfiguration,
+			canViewAuthLog,
+			canListPersons,
+			canListGlobalApiKeys,
+			canCreateGlobalApiKey,
 		}
 	}
 
@@ -140,24 +178,22 @@ export class IdentityTypeResolver implements IdentityResolvers {
 		context: TenantResolverContext,
 	): Promise<SessionInfo[]> {
 		// Self: always allowed. Other identities: gated by PERSON_VIEW_SESSIONS
-		// against the target's roles, so PROJECT_ADMIN can peek at members but
-		// not at SUPER_ADMIN sessions (projectAdminUseRolesVerifier rule).
-		// Return [] instead of throwing — listing many identities should not
-		// abort just because the viewer lacks visibility for one of them.
+		// against the target, so PROJECT_ADMIN can peek at members but not at a
+		// super_admin's sessions. Return [] instead of throwing — listing many
+		// identities should not abort just because the viewer lacks visibility
+		// for one of them.
 		if (parent.id !== context.identity.id) {
-			const targetRoles = await this.roles(parent, {}, context)
-			if (targetRoles === null) {
-				return []
-			}
+			const identity = await context.db.batchLoad(targetIdentityLoader, parent.id)
+			const target = identity === undefined ? null : await createTargetIdentityPermissionTarget(context.db, identity)
 			const canView = await context.permissionContext.isAllowed({
-				action: PermissionActions.PERSON_VIEW_SESSIONS(targetRoles),
+				action: PermissionActions.PERSON_VIEW_SESSIONS(target),
 			})
 			if (!canView) {
 				return []
 			}
 		}
 		const rows = await context.db.queryHandler.fetch(
-			new ApiKeySessionsByIdentityQuery(parent.id, { now: context.db.providers.now() }),
+			new ApiKeySessionsByIdentityQuery(parent.id),
 		)
 		return rows.map(row => ({
 			id: row.id,

package/src/resolvers/types/PersonTypeResolver.ts

@@ -1,22 +1,63 @@
 import { Person, PersonIdentityProvider, PersonResolvers } from '../../schema/index.js'
-import { IdentityQuery, PermissionActions, PersonIdentityProviderManager } from '../../model/index.js'
+import {
+	type Config,
+	ConfigurationQuery,
+	createTargetIdentityPermissionTarget,
+	PermissionActions,
+	PersonIdentityProviderManager,
+	targetIdentityLoader,
+} from '../../model/index.js'
+import { isPasswordlessEnabled } from '../../model/service/helpers/isPasswordlessEnabled.js'
 import { TenantResolverContext } from '../TenantResolverContext.js'
 
-export class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders'> {
+export class PersonTypeResolver implements Pick<PersonResolvers, 'identityProviders' | 'passwordlessAvailable' | 'passwordlessSelfManaged'> {
+	/**
+	 * One configuration read per request rather than per person: `person$$` selects every scalar, so
+	 * listing N people would otherwise issue N identical config queries. Keyed on the resolver context,
+	 * which is built once per operation and collected with it.
+	 */
+	private readonly configurationByRequest = new WeakMap<TenantResolverContext, Promise<Config>>()
+
 	constructor(
 		private readonly personIdentityProviderManager: PersonIdentityProviderManager,
 	) {
 	}
 
+	/**
+	 * The tenant policy resolved against the person's own flag — the same call `signIn` makes, so a
+	 * client never has to reimplement it (and could not: reading `configuration` needs `system:viewConfig`,
+	 * which an ordinary person does not have).
+	 */
+	async passwordlessAvailable(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {
+		const config = await this.configuration(context)
+		return isPasswordlessEnabled(config.passwordless.enabled, parent.passwordlessEnabled ?? null)
+	}
+
+	async passwordlessSelfManaged(parent: Person, args: unknown, context: TenantResolverContext): Promise<boolean> {
+		const config = await this.configuration(context)
+		return config.passwordless.enabled === 'optIn' || config.passwordless.enabled === 'optOut'
+	}
+
+	private configuration(context: TenantResolverContext): Promise<Config> {
+		const cached = this.configurationByRequest.get(context)
+		if (cached) {
+			return cached
+		}
+		const pending = context.db.queryHandler.fetch(new ConfigurationQuery(context.db.providers))
+		this.configurationByRequest.set(context, pending)
+		return pending
+	}
+
 	async identityProviders(parent: Person, args: unknown, context: TenantResolverContext): Promise<PersonIdentityProvider[]> {
 		// Self: always allowed. Other persons: gated by PERSON_VIEW_IDP against the
 		// target's roles, so PROJECT_ADMIN can inspect members but not SUPER_ADMINs.
 		// Return [] instead of throwing so listing many persons does not abort on a
 		// single forbidden target — mirrors `Identity.sessions`.
 		if (parent.identity.id !== context.identity.id) {
-			const [identity] = await context.db.queryHandler.fetch(new IdentityQuery([parent.identity.id]))
+			const identity = await context.db.batchLoad(targetIdentityLoader, parent.identity.id)
+			const target = identity === undefined ? null : await createTargetIdentityPermissionTarget(context.db, identity)
 			const canView = await context.permissionContext.isAllowed({
-				action: PermissionActions.PERSON_VIEW_IDP(identity?.roles ?? []),
+				action: PermissionActions.PERSON_VIEW_IDP(target),
 			})
 			if (!canView) {
 				return []