@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/changeMyProfileEmailVerificationMutation.test.ts

@@ -36,18 +36,18 @@ test('changeMyProfile - email change is deferred when verification is required',
 			...sqlTransaction(
 				{
 					sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
-					         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+					         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
 					parameters: [
 						anyString,
 						anyString,
 						personId,
-						isDate,
+						(val: any) => typeof val === 'number',
 						isDate,
 						null,
 						'email_change',
 						(val: any) => !!val && val.email === newEmail,
 					],
-					response: { rowCount: 1 },
+					response: { rows: [{ expires_at: now }] },
 				},
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId }),
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId: null }),
@@ -108,18 +108,18 @@ test('changeMyProfile - email change is deferred for a verification-required acc
 			...sqlTransaction(
 				{
 					sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
-					         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+					         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
 					parameters: [
 						anyString,
 						anyString,
 						personId,
-						isDate,
+						(val: any) => typeof val === 'number',
 						isDate,
 						null,
 						'email_change',
 						(val: any) => !!val && val.email === newEmail,
 					],
-					response: { rowCount: 1 },
+					response: { rows: [{ expires_at: now }] },
 				},
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId }),
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId: null }),
@@ -152,7 +152,6 @@ test('changeMyProfile - email change is rate-limited per recipient', async () =>
 	const personId = testUuid(1)
 	const identityId = authenticatedIdentityId
 	const newEmail = 'jane@doe.com'
-	const future = new Date(now.getTime() + 60 * 1000)
 	await executeTenantTest({
 		query: changeMyProfileMutation({ email: newEmail }),
 		executes: [
@@ -166,7 +165,7 @@ test('changeMyProfile - email change is rate-limited per recipient', async () =>
 				email: newEmail,
 				initType: 'email_change_init',
 				completionType: 'email_change_complete',
-				response: { rows: [{ next_allowed_attempt: future }] },
+				response: { rows: [{ retry_after_seconds: 60 }] },
 			}),
 		],
 		return: {
@@ -211,18 +210,18 @@ test('changeMyProfile - name change is applied atomically within the email-chang
 				updatePersonProfileNameSql({ personId, name: newName }),
 				{
 					sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
-					         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+					         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
 					parameters: [
 						anyString,
 						anyString,
 						personId,
-						isDate,
+						(val: any) => typeof val === 'number',
 						isDate,
 						null,
 						'email_change',
 						(val: any) => !!val && val.email === newEmail,
 					],
-					response: { rowCount: 1 },
+					response: { rows: [{ expires_at: now }] },
 				},
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId }),
 				getMailTemplateSql({ type: 'emailChangeVerify', projectId: null }),

package/tests/cases/integration/mocked/changePasswordMutation.test.ts

@@ -5,6 +5,7 @@ import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
 import { updatePersonPasswordSql } from './sql/updatePesonPasswordSql.js'
 import { expect, test } from 'bun:test'
 import { getConfigSql } from './sql/getConfigSql.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
 
 test('changes a password', async () => {
 	const personId = testUuid(1)
@@ -17,6 +18,7 @@ test('changes a password', async () => {
 				personId,
 				response: { personId, email: 'john@doe.com', roles: [], password: '123', identityId },
 			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
 			getConfigSql(),
 			updatePersonPasswordSql({ personId, password }),
 		],
@@ -35,3 +37,44 @@ test('changes a password', async () => {
 		}),
 	})
 })
+
+test('treats a global project admin as having project memberships', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+	const password = 'AbcDeg123'
+	await executeTenantTest({
+		query: changePasswordMutation({ personId, password }),
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, email: 'john@doe.com', roles: ['project_admin'], password: '123', identityId },
+			}),
+			getConfigSql(),
+			updatePersonPasswordSql({ personId, password }),
+		],
+		authorizator: {
+			isAllowed: (_identity, _scope, action) => {
+				const target = action.meta?.target
+				return Promise.resolve(
+					typeof target === 'object'
+						&& target !== null
+						&& 'hasProjectMemberships' in target
+						&& target.hasProjectMemberships === true,
+				)
+			},
+		},
+		return: {
+			data: {
+				changePassword: {
+					ok: true,
+				},
+			},
+		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'password_change',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
+	})
+})

package/tests/cases/integration/mocked/changeProfileMutation.test.ts

@@ -7,6 +7,7 @@ import { authenticatedIdentityId } from '../../../src/testTenant.js'
 import { getPersonByIdentity } from './sql/getPersonByIdentity.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
 
 test('changes my name and email', async () => {
 	const personId = testUuid(1)
@@ -20,6 +21,7 @@ test('changes my name and email', async () => {
 				personId,
 				response: { personId, email: 'john.doe@example.com', name: 'John Doe', roles: [], password: '123456', identityId },
 			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
 			getPersonByEmailSql({ email, response: null }),
 			updatePersonProfileNameAndEmailSql({ personId, email, name }),
 		],

package/tests/cases/integration/mocked/configurationPanel.test.ts

@@ -0,0 +1,105 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { expect, test } from 'bun:test'
+
+test('configuration exposes the panel access lists', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			configuration { panel { globalRoles projectRoles } }
+		}`,
+		executes: [
+			getConfigSql({ panel_global_roles: ['super_admin', 'ops'], panel_project_roles: [] }),
+		],
+		return: {
+			data: {
+				configuration: {
+					panel: {
+						globalRoles: ['super_admin', 'ops'],
+						projectRoles: [],
+					},
+				},
+			},
+		},
+	})
+})
+
+test('configuration returns the panel defaults', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			configuration { panel { globalRoles projectRoles } }
+		}`,
+		executes: [getConfigSql()],
+		return: {
+			data: {
+				configuration: {
+					panel: {
+						globalRoles: ['super_admin', 'project_admin'],
+						projectRoles: ['admin'],
+					},
+				},
+			},
+		},
+	})
+})
+
+test('configure writes both panel role lists', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { panel: { globalRoles: ['super_admin', 'ops'], projectRoles: ['admin', 'editor'] } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "panel_global_roles" = ?, "panel_project_roles" = ? where "id" = ?`,
+				parameters: [['super_admin', 'ops'], ['admin', 'editor'], 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})
+
+test('configure writes an empty panel list (closes the panel)', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { panel: { globalRoles: [] } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "panel_global_roles" = ? where "id" = ?`,
+				parameters: [[], 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})
+
+// An omitted section must not touch the panel columns — the update is a partial merge.
+test('configure without a panel section leaves the columns alone', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { password: { minLength: 12 } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "password_min_length" = ? where "id" = ?`,
+				parameters: [12, 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})

package/tests/cases/integration/mocked/confirmEmailChangeMutation.test.ts

@@ -26,7 +26,7 @@ test('confirmEmailChange - swaps the email, verifies it and signs out sessions',
 		query: confirmEmailChangeMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_change'],
 				response: {
 					rows: [
@@ -36,6 +36,7 @@ test('confirmEmailChange - swaps the email, verifies it and signs out sessions',
 							person_id: personId,
 							created_at: now,
 							expires_at: new Date(now.getTime() + 24 * 60 * 60 * 1000),
+							is_expired: false,
 							used_at: null,
 							otp_hash: null,
 							otp_attempts: 0,
@@ -109,7 +110,7 @@ test('confirmEmailChange - new email taken in the meantime', async () => {
 		query: confirmEmailChangeMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_change'],
 				response: {
 					rows: [
@@ -119,6 +120,7 @@ test('confirmEmailChange - new email taken in the meantime', async () => {
 							person_id: personId,
 							created_at: now,
 							expires_at: new Date(now.getTime() + 24 * 60 * 60 * 1000),
+							is_expired: false,
 							used_at: null,
 							otp_hash: null,
 							otp_attempts: 0,

package/tests/cases/integration/mocked/createSessionKeyMutation.test.ts

@@ -10,6 +10,7 @@ import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
 import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
 
 test('create session key', async () => {
 	const email = 'john@doe.com'
@@ -21,6 +22,7 @@ test('create session key', async () => {
 		query: createSessionTokenMutation({ email }, { withData: true }),
 		executes: [
 			getPersonByEmailSql({ email, response: { personId, identityId, password: 'aaa', roles: [] } }),
+			getIdentityProjectMembershipPresenceSql(identityId),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
 			getAuthPoliciesSql(),
@@ -68,3 +70,34 @@ test('create session key', async () => {
 		}),
 	})
 })
+
+test('create session key is refused for a disabled person', async () => {
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	await executeTenantTest({
+		query: createSessionTokenMutation({ email }),
+		executes: [
+			getPersonByEmailSql({
+				email,
+				response: { personId, identityId, password: 'aaa', roles: [], disabledAt: new Date() },
+			}),
+		],
+		return: {
+			data: {
+				createSessionToken: {
+					ok: false,
+					error: { code: 'PERSON_DISABLED' },
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'create_session_token',
+			response: expect.objectContaining({
+				ok: false,
+				error: 'PERSON_DISABLED',
+			}),
+		}),
+	})
+})