@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/signInMfaEnforcement.test.ts

@@ -3,6 +3,7 @@ import { SQL } from '../../../src/tags.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
@@ -10,6 +11,7 @@ import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { getAllProjectRolesByIdentitySql, getAuthPoliciesSql } from './sql/authPolicySql.js'
 import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getCustomRolesSql } from './sql/getCustomRolesSql.js'
 import { generateBackupCodesSql } from './sql/generateBackupCodesSql.js'
 import { expect, test } from 'bun:test'
 import { Buffer } from 'buffer'
@@ -48,6 +50,7 @@ test('MFA required + no factor + no code → MFA_ENROLLMENT_REQUIRED with pendin
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration: the matched policy has no
@@ -113,6 +116,7 @@ test('MFA required + valid pending code → enrolls (pending→active), returns
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration from the global config default.
@@ -146,6 +150,8 @@ test('MFA required + valid pending code → enrolls (pending→active), returns
 				],
 				response: { rowCount: 1 },
 			},
+			// the signed-in identity carries a non-builtin global role -> custom-role lookup
+			getCustomRolesSql(),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
 		],
@@ -173,6 +179,7 @@ test('MFA required + invalid pending code → INVALID_OTP_TOKEN', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: pendingUri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration from the global config default.
@@ -206,6 +213,7 @@ test('active TOTP + requiring policy → existing OTP_REQUIRED path (policy not
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpUri } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -241,13 +249,14 @@ test('MFA required + per-policy grace → opens grace window, sets mfa_grace_unt
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			gracePolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Per-policy grace override is present → the global config is NOT read here.
 			{
-				// Grace window opened: now (12:00) + 1h.
-				sql: SQL`update "tenant"."person" set "mfa_grace_until" = ? where "id" = ?`,
-				parameters: [new Date('2019-09-04 13:00'), personId],
+				// Grace window opened on the DB clock: now() + 1h (3600s).
+				sql: SQL`update "tenant"."person" set "mfa_grace_until" = now() + make_interval(secs => ?) where "id" = ?`,
+				parameters: [3600, personId],
 				response: { rowCount: 1 },
 			},
 			getConfigSql(),
@@ -261,6 +270,8 @@ test('MFA required + per-policy grace → opens grace window, sets mfa_grace_unt
 				parameters: [() => true, identityId, 'session_policy_applied', true, () => true, () => true],
 				response: { rowCount: 1 },
 			},
+			// the signed-in identity carries a non-builtin global role -> custom-role lookup
+			getCustomRolesSql(),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
 		],
@@ -288,14 +299,16 @@ test('MFA required + no policy grace override → global config default opens th
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// No per-policy override → the global config default is read; here it is
 			// non-zero (2h), so a grace window opens instead of forcing enrollment.
 			getConfigSql({ login_mfa_grace_duration: PostgresInterval('02:00:00') }),
 			{
-				sql: SQL`update "tenant"."person" set "mfa_grace_until" = ? where "id" = ?`,
-				parameters: [new Date('2019-09-04 14:00'), personId],
+				// Grace window opened on the DB clock: now() + 2h (7200s).
+				sql: SQL`update "tenant"."person" set "mfa_grace_until" = now() + make_interval(secs => ?) where "id" = ?`,
+				parameters: [7200, personId],
 				response: { rowCount: 1 },
 			},
 			getConfigSql(),
@@ -308,6 +321,8 @@ test('MFA required + no policy grace override → global config default opens th
 				parameters: [() => true, identityId, 'session_policy_applied', true, () => true, () => true],
 				response: { rowCount: 1 },
 			},
+			// the signed-in identity carries a non-builtin global role -> custom-role lookup
+			getCustomRolesSql(),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
 		],

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -4,6 +4,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { SignInErrorCode } from '../../../../src/schema/index.js'
 import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src/index.js'
@@ -31,6 +32,7 @@ test('signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -94,6 +96,7 @@ test('signs in - normalize email', async () => {
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -137,6 +140,7 @@ test('sign in - invalid password', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -170,6 +174,7 @@ test('sign in - email not verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: null },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -205,6 +210,7 @@ test('sign in - email verification required but already verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: now },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -253,6 +259,7 @@ test('otp token not provided', async () => {
 					otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember',
 				},
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -290,6 +297,7 @@ test('sign in - invalid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -327,6 +335,7 @@ test('sign in - valid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
 			getAuthPoliciesSql(),
@@ -380,6 +389,7 @@ test('sign in - valid backup code (when OTP is required)', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: true }),
 			countUnusedBackupCodesSql({ personId, count: 4 }),
 			getConfigSql(),
@@ -432,6 +442,7 @@ test('sign in - email OTP enabled, no code provided: dispatches a code and retur
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// signIn lazily re-fetches the config to resolve the email-OTP send rate limit.
 			getConfigSql(),
 			...sendEmailOtpSql({ personId, rateLimitEventId: testUuid(1), tokenId: testUuid(2) }),
@@ -475,6 +486,7 @@ test('sign in - email OTP enabled, valid code: signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 			consumeEmailOtpTokenSql({ tokenId }),
@@ -515,6 +527,7 @@ test('sign in - email OTP enabled, invalid code: INVALID_OTP_TOKEN', async () =>
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 		],
@@ -550,6 +563,7 @@ test('sign in - already-used backup code is rejected', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: false }),
 		],
 		return: {

package/tests/cases/integration/mocked/signInPasswordlessMutation.test.ts

@@ -6,6 +6,7 @@ import { signInPasswordlessMutation } from './gql/passwordless.js'
 import { computeTokenHash } from '../../../../src/index.js'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -19,7 +20,7 @@ const personTokenByIdSql = (args: {
 	personId: string
 	token: string
 }) => ({
-	sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "id" = ? AND "type" = ?`,
+	sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "id" = ? AND "type" = ?`,
 	parameters: [args.requestId, 'passwordless'],
 	response: {
 		rows: [
@@ -29,6 +30,7 @@ const personTokenByIdSql = (args: {
 				person_id: args.personId,
 				created_at: now,
 				expires_at: new Date(now.getTime() + 60 * 60 * 1000),
+				is_expired: false,
 				used_at: null,
 				otp_hash: null,
 				otp_attempts: 0,
@@ -54,6 +56,7 @@ test('signInPasswordless - marks an unverified email verified before issuing the
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: null },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -110,6 +113,7 @@ test('signInPasswordless - skips the email-verified update when already verified
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -144,3 +148,36 @@ test('signInPasswordless - skips the email-verified update when already verified
 		},
 	})
 })
+
+test('signInPasswordless - a link created while the magic link was in flight still refuses the session', async () => {
+	const requestId = testUuid(1)
+	const personId = testUuid(2)
+	const identityId = testUuid(3)
+	const token = 'passwordless-token'
+	await executeTenantTest({
+		query: signInPasswordlessMutation({ requestId, token, validationType: 'token' }),
+		executes: [
+			...sqlTransaction(
+				personTokenByIdSql({ requestId, personId, token }),
+				getPersonByIdSql({
+					personId,
+					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
+				}),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				signInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/signUpMutation.test.ts

@@ -1,11 +1,11 @@
 import { executeTenantTest } from '../../../src/testTenant.js'
 import { signUpMutation } from './gql/signUp.js'
-import { SQL } from '../../../src/tags.js'
+import { GQL, SQL } from '../../../src/tags.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { createPersonSql } from './sql/createPersonSql.js'
 import { createIdentitySql } from './sql/createIdentitySql.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
-import { sqlTransaction } from './sql/sqlTransaction.js'
+import { sqlReadCommittedTransaction } from './sql/sqlTransaction.js'
 import { disableOneOffKeySql } from './sql/disableOneOffKeySql.js'
 import { test } from 'bun:test'
 import { getConfigSql } from './sql/getConfigSql.js'
@@ -21,7 +21,7 @@ test('signs up a new user', async () => {
 		executes: [
 			getConfigSql(),
 			getPersonByEmailSql({ email, response: null }),
-			...sqlTransaction(
+			...sqlReadCommittedTransaction(
 				createIdentitySql({ identityId, roles: ['person'] }),
 				createPersonSql({ personId, email, password, identityId }),
 			),
@@ -52,6 +52,65 @@ test('signs up a new user', async () => {
 	})
 })
 
+const signUpWithRolesMutation = (variables: { email: string; password: string; roles: string[] }) => ({
+	query: GQL`mutation($email: String!, $password: String!, $roles: [String!]) {
+		signUp(email: $email, password: $password, roles: $roles) {
+			ok
+			errors { code }
+		}
+	}`,
+	variables,
+})
+
+const customRoleForShareSql = (slug: string, exists: boolean) => ({
+	sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for share`,
+	parameters: [slug],
+	response: {
+		rows: exists ? [{ id: testUuid(50), slug, description: null, grants: [], created_at: new Date(), updated_at: new Date() }] : [],
+	},
+})
+
+// The FOR SHARE lock must be held until the identity is written, or a concurrent
+// deleteCustomRole can commit in between and leave the new identity a dangling slug.
+test('signs up a new user with a custom role, validating it inside the creating transaction', async () => {
+	const email = 'john@doe.com'
+	const password = 'Ab1Cd23456'
+	const identityId = testUuid(1)
+	const personId = testUuid(2)
+	await executeTenantTest({
+		query: signUpWithRolesMutation({ email, password, roles: ['support'] }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: null }),
+			...sqlReadCommittedTransaction(
+				customRoleForShareSql('support', true),
+				createIdentitySql({ identityId, roles: ['support', 'person'] }),
+				createPersonSql({ personId, email, password, identityId }),
+			),
+			disableOneOffKeySql({ id: testUuid(998) }),
+		],
+		return: {
+			data: { signUp: { ok: true, errors: [] } },
+		},
+	})
+})
+
+test('refuses sign-up with an unknown custom role inside the transaction', async () => {
+	const email = 'john@doe.com'
+	const password = 'Ab1Cd23456'
+	await executeTenantTest({
+		query: signUpWithRolesMutation({ email, password, roles: ['ghost'] }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: null }),
+			...sqlReadCommittedTransaction(customRoleForShareSql('ghost', false)),
+		],
+		return: {
+			data: { signUp: { ok: false, errors: [{ code: 'INVALID_ROLE' }] } },
+		},
+	})
+})
+
 test('not sign up user with existing email — returns EMAIL_ALREADY_EXISTS with recommended action', async () => {
 	const personId = testUuid(1)
 	const email = 'john@doe.com'

package/tests/cases/integration/mocked/sql/createPersonTokenSql.ts

@@ -1,5 +1,6 @@
 import { SQL } from '../../../../src/tags.js'
 import { ExpectedQuery } from '@contember/database-tester'
+import { now } from '../../../../src/testTenant.js'
 
 export const createPersonTokenSql = (args: {
 	resetId: string
@@ -9,16 +10,16 @@ export const createPersonTokenSql = (args: {
 	meta?: unknown
 }): ExpectedQuery => ({
 	sql: SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta")
-	         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+	         VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) RETURNING "expires_at"`,
 	parameters: [
 		args.resetId,
 		args.tokenHash,
 		args.personId,
-		(val: any) => val instanceof Date,
+		(val: any) => typeof val === 'number', // expires_at: ttl seconds for the DB-clock now()+interval
 		(val: any) => val instanceof Date,
 		null,
 		args.type,
 		args.meta ?? null,
 	],
-	response: { rowCount: 1 },
+	response: { rows: [{ expires_at: now }] },
 })

package/tests/cases/integration/mocked/sql/createSessionKeySql.ts

@@ -11,14 +11,14 @@ export const createSessionKeySql = function({ apiKeyId, identityId, ip, userAgen
 		sql: SQL`INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at",
 												 "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info",
 												 "issued_at", "idle_timeout", "max_expires_at")
-				 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+				 VALUES (?, ?, ?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?, ?, ?, ?, ?)`,
 		parameters: [
 			apiKeyId,
 			'9692e67b8378a6f6753f97782d458aa757e947eab2fbdf6b5c187b74561eb78f',
 			'session',
 			identityId,
 			null,
-			new Date('2019-09-04 12:30'),
+			1800,
 			30,
 			new Date('2019-09-04 12:00'),
 			ip ?? null,

package/tests/cases/integration/mocked/sql/emailOtpSql.ts

@@ -21,14 +21,14 @@ const RANDOM_TOKEN_HASH = sha256('0'.repeat(40))
 export const sendEmailOtpSql = (args: { personId: string; rateLimitEventId: string; tokenId: string }): ExpectedQuery[] => [
 	{
 		sql: SQL`select count(*)::text as count from "tenant"."rate_limit_event"
-		where "scope" = ? and "key_hash" = ? and "occurred_at" >= ?`,
-		// mocked hash provider stores the key verbatim; window 10min → now - 600s.
-		parameters: ['email_otp_per_person', Buffer.from(args.personId), new Date(now.getTime() - 10 * 60 * 1000)],
+		where "scope" = ? and "key_hash" = ? and occurred_at >= NOW() - make_interval(secs => ?)`,
+		// mocked hash provider stores the key verbatim; window 10min → 600s.
+		parameters: ['email_otp_per_person', Buffer.from(args.personId), 600],
 		response: { rows: [{ count: '0' }] },
 	},
 	{
-		sql: SQL`insert into "tenant"."rate_limit_event" ("id", "scope", "key_hash", "occurred_at") values (?, ?, ?, ?)`,
-		parameters: [args.rateLimitEventId, 'email_otp_per_person', Buffer.from(args.personId), now],
+		sql: SQL`insert into "tenant"."rate_limit_event" ("id", "scope", "key_hash") values (?, ?, ?)`,
+		parameters: [args.rateLimitEventId, 'email_otp_per_person', Buffer.from(args.personId)],
 		response: { rowCount: 1 },
 	},
 	{
@@ -38,12 +38,12 @@ export const sendEmailOtpSql = (args: { personId: string; rateLimitEventId: stri
 	},
 	{
 		sql:
-			SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "otp_hash") VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+			SQL`INSERT INTO "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "otp_hash") VALUES (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?)`,
 		parameters: [
 			args.tokenId,
 			RANDOM_TOKEN_HASH,
 			args.personId,
-			(v: any) => v instanceof Date,
+			(v: any) => typeof v === 'number', // expires_at: ttl seconds for the DB-clock now()+interval
 			now,
 			null,
 			'mfa_email_otp',
@@ -55,7 +55,8 @@ export const sendEmailOtpSql = (args: { personId: string; rateLimitEventId: stri
 
 /** Mocks the lookup of the latest unused email-OTP token for a person. */
 export const getLatestEmailOtpTokenSql = (args: { personId: string; tokenId: string | null }): ExpectedQuery => ({
-	sql: SQL`select * from "tenant"."person_token" where "person_id" = ? and "type" = ? and "used_at" is null order by "created_at" desc limit 1`,
+	sql:
+		SQL`select *, "expires_at" <= now() as "is_expired" from "tenant"."person_token" where "person_id" = ? and "type" = ? and "used_at" is null order by "created_at" desc limit 1`,
 	parameters: [args.personId, 'mfa_email_otp'],
 	response: {
 		rows: args.tokenId
@@ -66,6 +67,7 @@ export const getLatestEmailOtpTokenSql = (args: { personId: string; tokenId: str
 					token_hash: RANDOM_TOKEN_HASH,
 					used_at: null,
 					expires_at: new Date(now.getTime() + 10 * 60 * 1000),
+					is_expired: false,
 					person_id: args.personId,
 					otp_hash: EMAIL_OTP_CODE_HASH,
 					otp_attempts: 0,

package/tests/cases/integration/mocked/sql/getApiKeySql.ts

@@ -7,13 +7,13 @@ export const getApiKeySql = (args: {
 	response: { identityId: string; personId: string; apiKeyType: ApiKey.Type; trustForwardedInfo?: boolean }
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at"
+		SQL`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at", "api_key"."expires_at" is not null and "api_key"."expires_at" <= now() as "is_expired", "api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now() as "is_max_expired", "api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?) as "is_idle_expired"
 		from "tenant"."api_key"
     	inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id"
     	left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id"
 		where "api_key"."id" = ?
 	`,
-	parameters: [args.apiKeyId],
+	parameters: [60, args.apiKeyId],
 	response: {
 		rows: args.response
 			? [

package/tests/cases/integration/mocked/sql/getConfigSql.ts

@@ -59,6 +59,9 @@ export const getConfigSql = (overrides: Record<string, unknown> = {}): ExpectedQ
 				captcha_protect_password_reset: true,
 				captcha_protect_passwordless_init: true,
 				captcha_protect_email_verification: false,
+				// Management panel entry gate — matches the column defaults.
+				panel_global_roles: ['super_admin', 'project_admin'],
+				panel_project_roles: ['admin'],
 				...overrides,
 			},
 		],

package/tests/cases/integration/mocked/sql/getCustomRolesSql.ts

@@ -0,0 +1,25 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+type CustomRoleRow = {
+	id: string
+	slug: string
+	description: string | null
+	grants: unknown
+	created_at: Date
+	updated_at: Date
+}
+
+/** Request-scoped lookup used when a custom role participates in authorization. */
+export const getCustomRolesSql = (response: CustomRoleRow[] = []): ExpectedQuery => ({
+	sql: SQL`select *  from "tenant"."custom_role"  order by "slug" asc`,
+	parameters: [],
+	response: { rows: response },
+})
+
+/** Locked role lookup used before assigning or referencing a custom role. */
+export const getCustomRolesForValidationSql = (args: { slugs: string[]; response?: CustomRoleRow[] }): ExpectedQuery => ({
+	sql: SQL`select *  from "tenant"."custom_role" where "slug" in (?)  order by "slug" asc for share`,
+	parameters: args.slugs,
+	response: { rows: args.response ?? [] },
+})

package/tests/cases/integration/mocked/sql/getIdentityProjectMembershipPresenceSql.ts

@@ -0,0 +1,11 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+export const getIdentityProjectMembershipPresenceSql = (
+	identityId: string,
+	hasProjectMemberships = false,
+): ExpectedQuery => ({
+	sql: SQL`select  distinct on ("identity_id") "identity_id"  from "tenant"."project_membership"  where "identity_id" in (?)`,
+	parameters: [identityId],
+	response: { rows: hasProjectMemberships ? [{ identity_id: identityId }] : [] },
+})

package/tests/cases/integration/mocked/sql/getIdpBySlugSql.ts

@@ -7,7 +7,7 @@ export const getIdpBySlugSql = (args: {
 	response: null | IdentityProviderRow
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"
+		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"
 		from "tenant"."identity_provider"
 		where "slug" = ?`,
 	parameters: [args.slug],

package/tests/cases/integration/mocked/sql/getNextLoginAttemptSql.ts

@@ -2,18 +2,22 @@ import { ExpectedQuery } from '@contember/database-tester'
 
 export const getNextLoginAttemptSql = (email: string): ExpectedQuery => ({
 	sql:
-		`with "cfg" as (select *  from "tenant"."config"), "last_successful_reset" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select
-                                        GREATEST(
-                                                COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
-                                                NOW() - cfg.login_attempt_window
-                                        ) as "start_time"  from "cfg", "last_successful_reset"), "failed_logins" as (select COUNT(*) as "fails", MAX(person_auth_log.created_at) as "last_fail"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select
-                                CASE WHEN failed_logins.fails = 0
-                                THEN NOW()
-                                ELSE LEAST(
-                                        failed_logins.last_fail + cfg.login_max_backoff,
-                                        failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
-                                ) END as "next_allowed_login"  from "failed_logins", "cfg"`,
+		`with "cfg" as (select *  from "tenant"."config"), "last_successful_reset" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select 
+					GREATEST(
+						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
+						NOW() - cfg.login_attempt_window
+					) as "start_time"  from "cfg", "last_successful_reset"), "failed_logins" as (select COUNT(*) as "fails", MAX(person_auth_log.created_at) as "last_fail"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select 
+				CASE WHEN failed_logins.fails = 0
+				THEN 0
+				ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+					LEAST(
+						failed_logins.last_fail + cfg.login_max_backoff,
+						failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+					) - NOW()
+				)))) END as "retry_after_seconds"  from "failed_logins", "cfg"`,
 	parameters: ['password_reset', true, email, email, 'login', false],
+	// Default = "not rate-limited": no failed logins in the window, so the
+	// DB-computed backoff returns 0 seconds to wait.
 	response: {
 		rows: [],
 	},

package/tests/cases/integration/mocked/sql/getNextMailAttemptSql.ts

@@ -1,5 +1,4 @@
 import { ExpectedQuery } from '@contember/database-tester'
-import { now } from '../../../../src/testTenant.js'
 
 export const getNextMailAttemptSql = (args: {
 	email: string
@@ -8,23 +7,23 @@ export const getNextMailAttemptSql = (args: {
 	response?: ExpectedQuery['response']
 }): ExpectedQuery => ({
 	sql:
-		`with "cfg" as (select *  from "tenant"."config"), "last_completion" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select
+		`with "cfg" as (select *  from "tenant"."config"), "last_completion" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select 
 						GREATEST(
 							COALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),
 							NOW() - cfg.login_attempt_window
-						) as "start_time"  from "cfg", "last_completion"), "attempts" as (select COUNT(*) as "attempts", MAX(person_auth_log.created_at) as "last_attempt"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select
+						) as "start_time"  from "cfg", "last_completion"), "attempts" as (select COUNT(*) as "attempts", MAX(person_auth_log.created_at) as "last_attempt"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select 
 					CASE WHEN attempts.attempts = 0
-					THEN NOW()
-					ELSE LEAST(
-						attempts.last_attempt + cfg.login_max_backoff,
-						attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
-					) END as "next_allowed_attempt"  from "attempts", "cfg"`,
+					THEN 0
+					ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+						LEAST(
+							attempts.last_attempt + cfg.login_max_backoff,
+							attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+						) - NOW()
+					)))) END as "retry_after_seconds"  from "attempts", "cfg"`,
 	parameters: [args.completionType, true, args.email, args.email, args.initType, true],
-	// Default = "not rate-limited": a `next_allowed_attempt` at the mocked `now`,
-	// so the manager's `nextAllowed > providers.now()` check is false. (An empty
-	// result set would make the query fall back to a real `new Date()`, which is
-	// in the future relative to the mocked clock and would read as rate-limited.)
+	// Default = "not rate-limited": the DB-computed backoff returns 0 seconds to
+	// wait, so the manager's retryAfter > 0 check is false.
 	response: args.response ?? {
-		rows: [{ next_allowed_attempt: now }],
+		rows: [{ retry_after_seconds: 0 }],
 	},
 })