@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/localAuthenticationDisabled.test.ts

@@ -0,0 +1,182 @@
+import { expect, test } from 'bun:test'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { signInMutation } from './gql/signIn.js'
+import { initSignInPasswordlessMutation } from './gql/passwordless.js'
+import { createResetPasswordRequestMutation } from './gql/createResetPasswordRequest.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+
+const email = 'john@doe.com'
+const password = '123'
+const personId = testUuid(7)
+const identityId = testUuid(2)
+
+test('signIn - a provider that disables local authentication refuses the password', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - the wrong password is not even consulted, so the answer cannot double as a password oracle', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password: 'not-the-password' }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - revealLoginMethod off collapses it into INVALID_CREDENTIALS', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql({ login_reveal_login_method: false }),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_CREDENTIALS' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - a person with no such link signs in as before', async () => {
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			// The asserted SQL carries `disabled_at IS NULL`, so a DISABLED provider never
+			// reaches this list — turning the provider off is the break-glass.
+			localAuthDisablingIdpsSql({ personId }),
+			getAuthPoliciesSql(),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: { token: '0000000000000000000000000000000000000000' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('initSignInPasswordless - the magic link is refused as well, so no second door stays open', async () => {
+	await executeTenantTest({
+		query: initSignInPasswordlessMutation({ email }),
+		executes: [
+			getConfigSql({ passwordless_enabled: 'always' }),
+			...sqlTransaction(
+				getConfigSql({ passwordless_enabled: 'always' }),
+				getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				initSignInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login_init',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('createResetPasswordRequest - reports ok but sends nothing, because the password it would set is unusable', async () => {
+	await executeTenantTest({
+		query: createResetPasswordRequestMutation({ email }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				createResetPasswordRequest: {
+					ok: true,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'password_reset_init',
+			personInput: email,
+			personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})

package/tests/cases/integration/mocked/mailTemplateScope.test.ts

@@ -0,0 +1,95 @@
+import { test } from 'bun:test'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+
+test('mailTemplates filters mixed global and project rows through exact scope metadata', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			mailTemplates { projectSlug type variant subject }
+		}`,
+		executes: [
+			{
+				sql:
+					SQL`select "mail_template"."id", "subject", "content", "use_layout" as "useLayout", "reply_to" as "replyTo", "project_id" as "projectId", "mail_type" as "type", "variant", "project"."slug" as "projectSlug"  from "tenant"."mail_template" left join  "tenant"."project" on  "project"."id" = "mail_template"."project_id"`,
+				parameters: [],
+				response: {
+					rows: [
+						{
+							id: 'global-forced',
+							subject: 'Global forced',
+							content: 'content',
+							useLayout: true,
+							replyTo: null,
+							projectId: null,
+							type: 'forcedSignOut',
+							variant: '',
+							projectSlug: null,
+						},
+						{
+							id: 'blog-forced',
+							subject: 'Blog forced',
+							content: 'content',
+							useLayout: true,
+							replyTo: null,
+							projectId: 'blog-id',
+							type: 'forcedSignOut',
+							variant: '',
+							projectSlug: 'blog',
+						},
+						{
+							id: 'shop-forced',
+							subject: 'Shop forced',
+							content: 'content',
+							useLayout: true,
+							replyTo: null,
+							projectId: 'shop-id',
+							type: 'forcedSignOut',
+							variant: '',
+							projectSlug: 'shop',
+						},
+						{
+							id: 'blog-password',
+							subject: 'Blog password',
+							content: 'content',
+							useLayout: true,
+							replyTo: null,
+							projectId: 'blog-id',
+							type: 'passwordReset',
+							variant: '',
+							projectSlug: 'blog',
+						},
+					],
+				},
+			},
+		],
+		authorizator: {
+			isAllowed: (_identity, _scope, action) => {
+				if (action.resource !== 'mailTemplate' || action.privilege !== 'list') {
+					return Promise.resolve(false)
+				}
+				const meta = action.meta
+				if (meta === undefined || !('kind' in meta)) {
+					return Promise.resolve(false)
+				}
+				if (meta.kind === 'any') {
+					return Promise.resolve(true)
+				}
+				return Promise.resolve(
+					meta.kind === 'project'
+						&& meta.projectSlug === 'blog'
+						&& meta.type === 'FORCED_SIGN_OUT',
+				)
+			},
+		},
+		return: {
+			data: {
+				mailTemplates: [{
+					projectSlug: 'blog',
+					type: 'FORCED_SIGN_OUT',
+					variant: null,
+					subject: 'Blog forced',
+				}],
+			},
+		},
+	})
+})

package/tests/cases/integration/mocked/permissionsQuery.test.ts

@@ -0,0 +1,153 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { test } from 'bun:test'
+import { getProjectBySlugSql } from './sql/getProjectBySlugSql.js'
+
+const globalPermissionsQuery = GQL`query {
+	me {
+		permissions {
+			canCreateProject
+			canDeployEntrypoint
+			canViewConfiguration
+			canListIdentityProviders
+			canListMailTemplates
+			canManageConfiguration
+			canViewAuthLog
+			canListPersons
+			canListGlobalApiKeys
+			canCreateGlobalApiKey
+		}
+	}
+}`
+
+const projectPermissionsQuery = GQL`query {
+	projectBySlug(slug: "sandbox") {
+		permissions {
+			canViewMembers
+			canAddMember
+			canUpdateMember
+			canRemoveMember
+			canViewSecrets
+			canSetSecret
+			canCreateApiKey
+			canUpdate
+		}
+	}
+}`
+
+test('me.permissions reports every tenant-wide capability', async () => {
+	await executeTenantTest({
+		query: globalPermissionsQuery,
+		executes: [],
+		return: {
+			data: {
+				me: {
+					permissions: {
+						canCreateProject: true,
+						canDeployEntrypoint: true,
+						canViewConfiguration: true,
+						canListIdentityProviders: true,
+						canListMailTemplates: true,
+						canManageConfiguration: true,
+						canViewAuthLog: true,
+						canListPersons: true,
+						canListGlobalApiKeys: true,
+						canCreateGlobalApiKey: true,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('me.permissions answers false for what the ACL denies', async () => {
+	await executeTenantTest({
+		query: globalPermissionsQuery,
+		// Reading the config is allowed, writing it is not — the pair a read-only admin holds.
+		authorizator: {
+			isAllowed: async (identity, scope, action) => action.resource === 'system' && action.privilege === 'viewConfig',
+		},
+		executes: [],
+		return: {
+			data: {
+				me: {
+					permissions: {
+						canCreateProject: false,
+						canDeployEntrypoint: false,
+						canViewConfiguration: true,
+						canListIdentityProviders: false,
+						canListMailTemplates: false,
+						canManageConfiguration: false,
+						canViewAuthLog: false,
+						canListPersons: false,
+						canListGlobalApiKeys: false,
+						canCreateGlobalApiKey: false,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('project.permissions reports every project-scoped capability', async () => {
+	await executeTenantTest({
+		query: projectPermissionsQuery,
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					permissions: {
+						canViewMembers: true,
+						canAddMember: true,
+						canUpdateMember: true,
+						canRemoveMember: true,
+						canViewSecrets: true,
+						canSetSecret: true,
+						canCreateApiKey: true,
+						canUpdate: true,
+					},
+				},
+			},
+		},
+	})
+})
+
+test('project.permissions separates viewing secrets from setting them', async () => {
+	await executeTenantTest({
+		query: projectPermissionsQuery,
+		// The real shape of a project admin: it may read which secrets exist but not write one,
+		// which is exactly the case a UI cannot discover by asking the listing query.
+		authorizator: {
+			isAllowed: async (identity, scope, action) =>
+				action.resource === 'project' && (action.privilege === 'view' || action.privilege === 'viewSecrets' || action.privilege === 'viewMembers'),
+		},
+		executes: [
+			getProjectBySlugSql({
+				projectSlug: 'sandbox',
+				response: { id: testUuid(1), name: 'sandbox', slug: 'sandbox', config: {} },
+			}),
+		],
+		return: {
+			data: {
+				projectBySlug: {
+					permissions: {
+						canViewMembers: true,
+						canAddMember: false,
+						canUpdateMember: false,
+						canRemoveMember: false,
+						canViewSecrets: true,
+						canSetSecret: false,
+						canCreateApiKey: false,
+						canUpdate: false,
+					},
+				},
+			},
+		},
+	})
+})

package/tests/cases/integration/mocked/personByIdQuery.test.ts

@@ -1,8 +1,11 @@
-import { executeTenantTest } from '../../../src/testTenant.js'
+import { executeTenantTest, now } from '../../../src/testTenant.js'
 import { GQL } from '../../../src/tags.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { test } from 'bun:test'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getIdentityProjectMembershipPresenceSql } from './sql/getIdentityProjectMembershipPresenceSql.js'
+import { listSessionsSql } from './sql/listSessionsSql.js'
 
 test('get person by id query', async () => {
 	const name = 'John Doe'
@@ -80,3 +83,58 @@ query personById($id: String!) {
 		},
 	})
 })
+
+test('person viewSessions permission does not require exposing identity roles', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+	const sessionId = testUuid(3)
+
+	await executeTenantTest({
+		query: {
+			query: GQL`
+query personById($id: String!) {
+	personById(id: $id) {
+		identity {
+			sessions { id }
+		}
+	}
+}`,
+			variables: { id: personId },
+		},
+		authorizator: {
+			isAllowed: async (identity, scope, action) => action.resource === 'person' && (action.privilege === 'view' || action.privilege === 'viewSessions'),
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, email: 'person@example.com', roles: ['person'], password: '123', identityId },
+			}),
+			getIdentityByIdSql({ identityId, roles: ['person'] }),
+			getIdentityProjectMembershipPresenceSql(identityId),
+			listSessionsSql({
+				identityId,
+				now,
+				rows: [{
+					id: sessionId,
+					created_at: now,
+					expires_at: null,
+					last_used_at: null,
+					last_ip: null,
+					last_user_agent: null,
+					created_ip: null,
+					created_user_agent: null,
+					trust_forwarded_info: false,
+				}],
+			}),
+		],
+		return: {
+			data: {
+				personById: {
+					identity: {
+						sessions: [{ id: sessionId }],
+					},
+				},
+			},
+		},
+	})
+})

package/tests/cases/integration/mocked/personIdentityProviders.test.ts

@@ -278,6 +278,73 @@ test('refuses to disconnect when the only other connection is to a disabled prov
 	})
 })
 
+test('refuses to disconnect a provider that disables local authentication, even though a password remains', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			// the password would be usable again the moment the link is gone, which is exactly the escape to close
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{ id: connectionId, createdAt, externalIdentifier: 'ext-1', slug: 'corporateSso', type: 'oidc', disableLocalAuthentication: true },
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
+test('still refuses while that provider is disabled: break-glass reopens local sign-in, not self-unlinking', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{
+							id: connectionId,
+							createdAt,
+							externalIdentifier: 'ext-1',
+							slug: 'corporateSso',
+							type: 'oidc',
+							disabledAt: new Date('2021-01-01T00:00:00.000Z'),
+							disableLocalAuthentication: true,
+						},
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
 test('returns NOT_FOUND when the person is not connected to the given connection', async () => {
 	const personId = testUuid(1)
 	await executeTenantTest({

package/tests/cases/integration/mocked/personsQuery.test.ts

@@ -5,12 +5,14 @@ import { test } from 'bun:test'
 import { listPersonsSql } from './sql/listPersonsSql.js'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
 
 test('persons query lists all persons (SUPER_ADMIN path, no filter)', async () => {
 	const person1 = testUuid(1)
 	const identity1 = testUuid(2)
 	const person2 = testUuid(3)
 	const identity2 = testUuid(4)
+	const disabledAt = new Date('2019-09-04T12:00:00.000Z')
 
 	await executeTenantTest({
 		query: {
@@ -21,6 +23,9 @@ query {
 		email
 		name
 		emailOtpEnabled
+		disabledAt
+		passwordlessAvailable
+		passwordlessSelfManaged
 		identity {
 			id
 		}
@@ -31,16 +36,43 @@ query {
 		executes: [
 			listPersonsSql({
 				rows: [
-					{ personId: person1, identityId: identity1, email: 'alice@example.com', name: 'Alice', emailOtpEnabled: true },
-					{ personId: person2, identityId: identity2, email: 'bob@example.com', name: 'Bob' },
+					{
+						personId: person1,
+						identityId: identity1,
+						email: 'alice@example.com',
+						name: 'Alice',
+						emailOtpEnabled: true,
+						passwordlessEnabled: true,
+						disabledAt,
+					},
+					{ personId: person2, identityId: identity2, email: 'bob@example.com', name: 'Bob', passwordlessEnabled: false },
 				],
 			}),
+			getConfigSql({ passwordless_enabled: 'optIn' }),
 		],
 		return: {
 			data: {
 				persons: [
-					{ id: person1, email: 'alice@example.com', name: 'Alice', emailOtpEnabled: true, identity: { id: identity1 } },
-					{ id: person2, email: 'bob@example.com', name: 'Bob', emailOtpEnabled: false, identity: { id: identity2 } },
+					{
+						id: person1,
+						email: 'alice@example.com',
+						name: 'Alice',
+						emailOtpEnabled: true,
+						disabledAt: disabledAt.toISOString(),
+						passwordlessAvailable: true,
+						passwordlessSelfManaged: true,
+						identity: { id: identity1 },
+					},
+					{
+						id: person2,
+						email: 'bob@example.com',
+						name: 'Bob',
+						emailOtpEnabled: false,
+						disabledAt: null,
+						passwordlessAvailable: false,
+						passwordlessSelfManaged: true,
+						identity: { id: identity2 },
+					},
 				],
 			},
 		},
@@ -124,7 +156,8 @@ query {
 					// ProjectMembersQuery (filter {}) — every member identity of the project
 					sql: SQL`select "id", "description" from "tenant"."identity"
 						where exists (select ?::int from "tenant"."project_membership"
-							where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?)`,
+							where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?)
+						order by "identity"."id" asc`,
 					parameters: [1, projectId],
 					response: {
 						rows: [

package/tests/cases/integration/mocked/requestEmailVerificationMutation.test.ts

@@ -1,4 +1,4 @@
-import { executeTenantTest } from '../../../src/testTenant.js'
+import { executeTenantTest, now } from '../../../src/testTenant.js'
 import { SQL } from '../../../src/tags.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { expect, test } from 'bun:test'
@@ -16,8 +16,8 @@ const isDate = (val: unknown) => val instanceof Date
 // Mirrors RateLimitCountQuery — whitespace/case are normalised by the matcher.
 const rateLimitCountSql = (args: { scope: string; keyHash: Buffer; count: number }): ExpectedQuery => ({
 	sql: `select count(*)::text as count from "tenant"."rate_limit_event"
-		where "scope" = ? and "key_hash" = ? and "occurred_at" >= ?`,
-	parameters: [args.scope, args.keyHash, (val: unknown) => val instanceof Date],
+		where "scope" = ? and "key_hash" = ? and occurred_at >= NOW() - make_interval(secs => ?)`,
+	parameters: [args.scope, args.keyHash, (val: unknown) => typeof val === 'number'],
 	response: { rows: [{ count: String(args.count) }] },
 })
 
@@ -62,9 +62,18 @@ test('requestEmailVerification - sends a verification mail for an unverified per
 			getNextMailAttemptSql({ email, initType: 'email_verify_init', completionType: 'email_verify_complete' }),
 			{
 				sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
-				         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-				parameters: [anyString, anyString, personId, isDate, isDate, null, 'email_verification', (val: any) => !!val && val.email === email],
-				response: { rowCount: 1 },
+				         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
+				parameters: [
+					anyString,
+					anyString,
+					personId,
+					(val: any) => typeof val === 'number',
+					isDate,
+					null,
+					'email_verification',
+					(val: any) => !!val && val.email === email,
+				],
+				response: { rows: [{ expires_at: now }] },
 			},
 			getIdentityProjectsSql({ identityId, projectId }),
 			getMailTemplateSql({ type: 'emailVerification', projectId }),