@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/customRoleCrud.test.ts

@@ -0,0 +1,442 @@
+import { expect, test } from 'bun:test'
+import { executeTenantTest, now } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { sqlReadCommittedTransaction } from './sql/sqlTransaction.js'
+
+const listGrantInput = [{ permission: 'person:list' }]
+const listGrant = [{ permission: 'person:list', config: null }]
+
+const customRoleRow = (
+	slug: string,
+	grants: readonly object[],
+	description: string | null = null,
+) => ({
+	id: testUuid(50),
+	slug,
+	description,
+	grants,
+	created_at: now,
+	updated_at: now,
+})
+
+const identitiesHoldingRoleQuery = (role: string, count: number) => ({
+	sql: SQL`select count(*)::int as "count"  from "tenant"."identity" where roles \\? ?`,
+	parameters: [role],
+	response: { rows: [{ count }] },
+})
+
+test('createCustomRole stores canonical grants and audits the full role state', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+					parameters: ['support'],
+					response: { rows: [] },
+				},
+				identitiesHoldingRoleQuery('support', 0),
+				{
+					sql: SQL`insert into  "tenant"."custom_role" ("id", "slug", "description", "grants", "created_at", "updated_at")
+						values  (?, ?, ?, ?, ?, ?)`,
+					parameters: [testUuid(1), 'support', null, JSON.stringify(listGrant), now, now],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: { createCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'create',
+				after: { slug: 'support', description: null, grants: listGrant },
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects invalid and duplicate grant definitions', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{ permission: 'person:list' }, { permission: 'person:list' }],
+			},
+		},
+		executes: [...sqlReadCommittedTransaction()],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'DUPLICATE_PERMISSION' },
+				},
+			},
+		},
+	})
+
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{ permission: 'identity:addGlobalRoles' }],
+			},
+		},
+		executes: [...sqlReadCommittedTransaction()],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects nonexistent role references', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: {
+				slug: 'support',
+				grants: [{
+					permission: 'person:signUp',
+					config: { roles: { allowed: ['ghost'] } },
+				}],
+			},
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for share`,
+				parameters: ['ghost'],
+				response: { rows: [] },
+			}),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole refuses a slug that identities already hold as a free-form role string', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'deployer', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+					parameters: ['deployer'],
+					response: { rows: [] },
+				},
+				identitiesHoldingRoleQuery('deployer', 2),
+			),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'SLUG_ALREADY_ASSIGNED' },
+				},
+			},
+		},
+	})
+})
+
+test('createCustomRole rejects a slug that is already taken', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]!) {
+				createCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: listGrantInput },
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc`,
+				parameters: ['support'],
+				response: { rows: [customRoleRow('support', listGrant)] },
+			}),
+		],
+		return: {
+			data: {
+				createCustomRole: {
+					ok: false,
+					error: { code: 'SLUG_ALREADY_EXISTS' },
+				},
+			},
+		},
+	})
+})
+
+test('updateCustomRole stores canonical grants and audits before and after state', async () => {
+	const forceSignOutGrant = [{
+		permission: 'person:forceSignOut',
+		config: {
+			target: {
+				globalRoles: { allowed: ['person'] },
+				projectMemberships: 'none',
+			},
+		},
+	}]
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]) {
+				updateCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: forceSignOutGrant },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					sql: SQL`update "tenant"."custom_role" set "grants" = ?, "updated_at" = ? where "slug" = ?`,
+					parameters: [JSON.stringify(forceSignOutGrant), now, 'support'],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: { updateCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'update',
+				before: { slug: 'support', description: 'Support team', grants: listGrant },
+				after: { slug: 'support', description: 'Support team', grants: forceSignOutGrant },
+			},
+		},
+	})
+})
+
+test('updateCustomRole rejects an explicit null grants value', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!, $grants: [CustomRoleGrantInput!]) {
+				updateCustomRole(slug: $slug, grants: $grants) { ok error { code } }
+			}`,
+			variables: { slug: 'support', grants: null },
+		},
+		executes: [
+			...sqlReadCommittedTransaction({
+				sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+				parameters: ['support'],
+				response: { rows: [customRoleRow('support', listGrant)] },
+			}),
+		],
+		return: {
+			data: {
+				updateCustomRole: {
+					ok: false,
+					error: { code: 'INVALID_PERMISSION_CONFIGURATION' },
+				},
+			},
+		},
+	})
+})
+
+test('deleteCustomRole removes the role and every stale assignment atomically', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!) {
+				deleteCustomRole(slug: $slug) { ok error { code } }
+			}`,
+			variables: { slug: 'support' },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					// no FK can reach a reference buried in another role's grants jsonb, so it is scanned
+					sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+					parameters: [],
+					response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+				},
+				{
+					sql: SQL`delete from  "tenant"."custom_role"  where "slug" = ?`,
+					parameters: ['support'],
+					response: { rowCount: 1 },
+				},
+				{
+					sql: SQL`update  "tenant"."identity" set  "roles" =  roles - ?  where roles \\? ?  returning "id"`,
+					parameters: ['support', 'support'],
+					response: { rows: [{ id: testUuid(60) }, { id: testUuid(61) }] },
+				},
+			),
+		],
+		return: {
+			data: { deleteCustomRole: { ok: true, error: null } },
+		},
+		expectedAuthLog: {
+			type: 'custom_role_change',
+			response: { ok: true, result: null },
+			eventData: {
+				operation: 'delete',
+				before: { slug: 'support', description: 'Support team', grants: listGrant },
+				removedAssignments: 2,
+				removedAssignmentIdentityIds: [testUuid(60), testUuid(61)],
+			},
+		},
+	})
+})
+
+test('deleteCustomRole refuses a role another role references and leaves both intact', async () => {
+	const referencingGrant = [{
+		permission: 'identity:addGlobalRoles',
+		config: {
+			roles: { allowed: ['support'] },
+			target: { globalRoles: { allowed: ['person'] }, projectMemberships: 'any' },
+			allowSelf: false,
+		},
+	}]
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($slug: String!) {
+				deleteCustomRole(slug: $slug) { ok error { code developerMessage } }
+			}`,
+			variables: { slug: 'support' },
+		},
+		executes: [
+			...sqlReadCommittedTransaction(
+				{
+					sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for update`,
+					parameters: ['support'],
+					response: { rows: [customRoleRow('support', listGrant)] },
+				},
+				{
+					sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+					parameters: [],
+					response: {
+						rows: [customRoleRow('manager', referencingGrant), customRoleRow('support', listGrant)],
+					},
+				},
+			),
+		],
+		// no DELETE and no identity UPDATE follow — the guard runs before either
+		return: {
+			data: {
+				deleteCustomRole: {
+					ok: false,
+					error: {
+						code: 'ROLE_IN_USE',
+						developerMessage: 'Custom role support is referenced by the grant configuration of manager',
+					},
+				},
+			},
+		},
+	})
+})
+
+test('customRoles returns full grants and the catalog describes configuration requirements', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`query {
+				customRoles { slug description grants { permission config } }
+				customRolePermissions { name configurationKind configurationRequired defaultConfig }
+			}`,
+			variables: {},
+		},
+		executes: [
+			{
+				sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+				parameters: [],
+				response: { rows: [customRoleRow('support', listGrant, 'Support team')] },
+			},
+		],
+		return: (response: object) => {
+			expect(response).toHaveProperty('data.customRoles', [
+				{ slug: 'support', description: 'Support team', grants: listGrant },
+			])
+			expect(response).toHaveProperty('data.customRolePermissions')
+			const serialized = JSON.stringify(response)
+			expect(serialized).toContain('"name":"identity:addGlobalRoles"')
+			expect(serialized).toContain('"configurationKind":"ROLE_MUTATION"')
+			expect(serialized).not.toContain('"name":"project:addMember"')
+		},
+	})
+})
+
+test('customRoles reports a persisted-invalid role as inert', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			customRoles { slug grants { permission config } }
+		}`,
+		executes: [{
+			sql: SQL`select *  from "tenant"."custom_role" order by "slug" asc`,
+			parameters: [],
+			response: {
+				rows: [customRoleRow('support', [
+					...listGrant,
+					{ permission: 'person:changePassword', config: { target: 'invalid' } },
+				])],
+			},
+		}],
+		return: {
+			data: {
+				customRoles: [{ slug: 'support', grants: [] }],
+			},
+		},
+	})
+})
+
+// `customRole:manage` is the single rail stopping a delegated principal from writing its own
+// permission bundle. These run through the REAL authorization stack (`identityRoles`), so
+// dropping any of the three `requireAccess` calls in CustomRoleMutationResolver turns them red.
+test.each([
+	[
+		'createCustomRole',
+		GQL`mutation { createCustomRole(slug: "escalated", grants: [{ permission: "person:list" }]) { ok } }`,
+	],
+	[
+		'updateCustomRole',
+		GQL`mutation { updateCustomRole(slug: "support", grants: [{ permission: "person:list" }]) { ok } }`,
+	],
+	['deleteCustomRole', GQL`mutation { deleteCustomRole(slug: "support") { ok } }`],
+])('%s is refused to project_admin and touches no data', async (field, query) => {
+	await executeTenantTest({
+		identityRoles: ['project_admin'],
+		query,
+		// project_admin is builtin-only, so the request-scoped custom_role preload is skipped too
+		executes: [],
+		return: {
+			data: { [field]: null },
+			errors: [{ message: 'You are not allowed to manage custom roles' }],
+		},
+	})
+})

package/tests/cases/integration/mocked/disablePersonMutation.test.ts

@@ -0,0 +1,92 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
+import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+import { expect, test } from 'bun:test'
+
+const disablePersonQuery = GQL`mutation($id: String!) {
+	disablePerson(personId: $id) {
+		ok
+		error { code }
+	}
+}`
+
+test('disablePerson revokes the account and its api keys', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: disablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: null },
+			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
+			...sqlTransaction(
+				{
+					sql: SQL`update "tenant"."person" set "disabled_at" = ? where "id" = ?`,
+					parameters: [(value: unknown) => value instanceof Date, personId],
+					response: { rowCount: 1 },
+				},
+				{
+					sql: SQL`update "tenant"."api_key" set "disabled_at" = ? where "identity_id" = ?`,
+					parameters: [(value: unknown) => value instanceof Date, identityId],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: {
+				disablePerson: { ok: true, error: null },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_disable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('disablePerson returns PERSON_ALREADY_DISABLED', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: disablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: {
+					personId,
+					identityId,
+					password: '123',
+					roles: [],
+					email: 'jane@doe.com',
+					disabledAt: new Date('2019-09-04 12:00'),
+				},
+			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
+			...sqlTransaction(),
+		],
+		return: {
+			data: {
+				disablePerson: { ok: false, error: { code: 'PERSON_ALREADY_DISABLED' } },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_disable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/enablePersonMutation.test.ts

@@ -0,0 +1,137 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
+import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { expect, test } from 'bun:test'
+
+const enablePersonQuery = GQL`mutation($id: String!) {
+	enablePerson(personId: $id) {
+		ok
+		error { code }
+	}
+}`
+
+test('enablePerson clears the disabled flag', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: new Date('2019-09-04 12:00') },
+			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
+			{
+				sql: SQL`update "tenant"."person" set "disabled_at" = ? where "id" = ?`,
+				parameters: [null, personId],
+				response: { rowCount: 1 },
+			},
+		],
+		return: {
+			data: {
+				enablePerson: { ok: true, error: null },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_enable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('enablePerson checks permission against the target roles', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+	const targetRoles = ['super_admin']
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		authorizator: {
+			isAllowed: async (identity, scope, action) => {
+				expect(action).toEqual({
+					resource: 'person',
+					privilege: 'disable',
+					meta: { target: { id: identityId, globalRoles: targetRoles, hasProjectMemberships: true } },
+				})
+				return false
+			},
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: targetRoles, email: 'jane@doe.com', disabledAt: new Date('2019-09-04 12:00') },
+			}),
+		],
+		return: {
+			data: { enablePerson: null },
+			errors: [{ message: 'You are not allowed to enable person account' }],
+		},
+	})
+})
+
+test('enablePerson returns PERSON_NOT_FOUND', async () => {
+	const personId = testUuid(1)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			{
+				sql:
+					SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+					FROM "tenant"."person"
+						INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+						LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
+					WHERE "person"."id" = ?`,
+				parameters: [personId],
+				response: { rows: [] },
+			},
+		],
+		return: {
+			data: {
+				enablePerson: { ok: false, error: { code: 'PERSON_NOT_FOUND' } },
+			},
+		},
+	})
+})
+
+test('enablePerson returns PERSON_ALREADY_ENABLED', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: null },
+			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
+		],
+		return: {
+			data: {
+				enablePerson: { ok: false, error: { code: 'PERSON_ALREADY_ENABLED' } },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_enable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/forceSignOutPersonMutation.test.ts

@@ -4,6 +4,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
 import { getMailTemplateSql } from './sql/getMailTemplateSql.js'
 import { expect, test } from 'bun:test'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
 
 const disableIdentityApiKeysSql = (identityId: string) => ({
 	sql: SQL`update "tenant"."api_key" set "disabled_at" = ? where "identity_id" = ?`,
@@ -30,6 +31,7 @@ test('force sign-out – success with reason and mail', async () => {
 				personId,
 				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com' },
 			}),
+			getIdentityProjectMembershipPresenceSql(identityId),
 			disableIdentityApiKeysSql(identityId),
 			getMailTemplateSql({ type: 'forcedSignOut', projectId: null }),
 			getMailTemplateSql({ type: 'forcedSignOut', projectId: null }),
@@ -69,7 +71,7 @@ test('force sign-out – PERSON_NOT_FOUND', async () => {
 		executes: [
 			{
 				sql:
-					SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+					SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 					FROM "tenant"."person"
 						INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 						LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"