@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/integration/mocked/sql/getPersonByEmailSql.ts

@@ -17,10 +17,11 @@ export const getPersonByEmailSql = (args: {
 			mfaGraceUntil?: Date | null
 			emailVerifiedAt?: Date | null
 			emailVerificationRequired?: boolean
+			disabledAt?: Date | null
 		}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
@@ -41,9 +42,11 @@ export const getPersonByEmailSql = (args: {
 					otp_pending_secret: args.response.otpPendingUri ? Buffer.from(args.response.otpPendingUri, 'utf8') : null,
 					otp_pending_version: args.response.otpPendingUri ? 0 : null,
 					email_otp_enabled: args.response.emailOtpEnabled ?? false,
-					disabled_at: null,
+					disabled_at: args.response.disabledAt ?? null,
 					passwordless_enabled: null,
 					mfa_grace_until: args.response.mfaGraceUntil ?? null,
+					// Mirrors the DB-clock `mfa_grace_until > now()` computed column.
+					is_in_grace: args.response.mfaGraceUntil != null && args.response.mfaGraceUntil.getTime() > Date.now(),
 					email_verified_at: args.response.emailVerifiedAt ?? null,
 					email_verification_required: args.response.emailVerificationRequired ?? false,
 				},

package/tests/cases/integration/mocked/sql/getPersonByIdSql.ts

@@ -19,7 +19,7 @@ export const getPersonByIdSql = (args: {
 	}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"

package/tests/cases/integration/mocked/sql/getPersonByIdentity.ts

@@ -20,7 +20,7 @@ export const getPersonByIdentity = (args: {
 		}
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"

package/tests/cases/integration/mocked/sql/getPersonByIdpSql.ts

@@ -8,7 +8,7 @@ export const getPersonByIdpSql = (args: {
 	response: null | { personId: string; password?: string; identityId: string; email: string; roles: string[]; otpUri?: string }
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		        INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		        LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"

package/tests/cases/integration/mocked/sql/getPersonsByIdentitySql.ts

@@ -6,7 +6,7 @@ export const getPersonsByIdentitySql = (args: {
 	response: readonly { personId: string; identityId: string; email: string; password?: string; roles?: readonly string[] }[]
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"

package/tests/cases/integration/mocked/sql/getProjectBySlugSql.ts

@@ -2,7 +2,7 @@ import { ExpectedQuery } from '@contember/database-tester'
 import { SQL } from '../../../../src/tags.js'
 import { Project } from '../../../../../src/index.js'
 
-export const getProjectBySlugSql = (args: { projectSlug: string; response: Project }): ExpectedQuery => ({
+export const getProjectBySlugSql = (args: { projectSlug: string; response: Project | null }): ExpectedQuery => ({
 	sql: SQL`select "id", "name", "slug", "config", "updated_at" as "updatedAt"
 	         FROM "tenant"."project"
 	         WHERE "slug" = ?`,

package/tests/cases/integration/mocked/sql/listPersonsSql.ts

@@ -7,10 +7,12 @@ export interface ListPersonsResponseRow {
 	email: string
 	name?: string
 	emailOtpEnabled?: boolean
+	passwordlessEnabled?: boolean | null
+	disabledAt?: Date | null
 }
 
 const COLUMNS =
-	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at"'
+	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at", "person"."disabled_at"'
 
 const FROM = `FROM "tenant"."person"
 	LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"`
@@ -47,8 +49,9 @@ export const listPersonsSql = (args: {
 				name: row.name ?? null,
 				otp_activated_at: null,
 				email_otp_enabled: row.emailOtpEnabled ?? false,
-				passwordless_enabled: null,
+				passwordless_enabled: row.passwordlessEnabled ?? null,
 				email_verified_at: null,
+				disabled_at: row.disabledAt ?? null,
 			})),
 		},
 	}

package/tests/cases/integration/mocked/sql/listSessionsSql.ts

@@ -15,7 +15,7 @@ export interface SessionRow {
 
 export const listSessionsSql = (args: {
 	identityId: string
-	now: Date
+	now?: Date
 	rows: SessionRow[]
 }): ExpectedQuery => ({
 	sql: SQL`select "api_key"."id",
@@ -31,8 +31,8 @@ export const listSessionsSql = (args: {
 			where "api_key"."identity_id" = ?
 			  and "api_key"."type" = ?
 			  and "api_key"."disabled_at" is null
-			  and ("api_key"."expires_at" is null or "api_key"."expires_at" > ?)
+			  and ("api_key"."expires_at" is null or "api_key"."expires_at" > now())
 			order by "api_key"."created_at" desc`,
-	parameters: [args.identityId, 'session', args.now],
+	parameters: [args.identityId, 'session'],
 	response: { rows: args.rows },
 })

package/tests/cases/integration/mocked/sql/localAuthDisablingIdpsSql.ts

@@ -0,0 +1,21 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+/**
+ * The `LocalAuthDisablingIdpsQuery` lookup every local authentication path runs.
+ * `slugs` defaults to none, i.e. local authentication stays available.
+ */
+export const localAuthDisablingIdpsSql = (args: {
+	personId: string
+	slugs?: string[]
+}): ExpectedQuery => ({
+	sql: SQL`SELECT "identity_provider"."slug" AS "slug"
+	         FROM "tenant"."person_identity_provider"
+		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
+	         WHERE "person_identity_provider"."person_id" = ? AND "identity_provider"."disable_local_authentication" = ? AND "identity_provider"."disabled_at" IS NULL
+	         ORDER BY "identity_provider"."slug" ASC`,
+	parameters: [args.personId, true],
+	response: {
+		rows: (args.slugs ?? []).map(slug => ({ slug })),
+	},
+})

package/tests/cases/integration/mocked/sql/personIdentityProvidersSql.ts

@@ -8,6 +8,7 @@ export interface PersonIdpConnectionRow {
 	slug: string
 	type: string
 	disabledAt?: Date | null
+	disableLocalAuthentication?: boolean
 }
 
 export const getPersonIdentityProvidersSql = (args: {
@@ -15,7 +16,7 @@ export const getPersonIdentityProvidersSql = (args: {
 	response: PersonIdpConnectionRow[]
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt"
+		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt", "identity_provider"."disable_local_authentication" as "identityProviderDisableLocalAuthentication"
 	         FROM "tenant"."person_identity_provider"
 		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
 	         WHERE "person_id" = ?
@@ -29,6 +30,7 @@ export const getPersonIdentityProvidersSql = (args: {
 			identityProviderSlug: it.slug,
 			identityProviderType: it.type,
 			identityProviderDisabledAt: it.disabledAt ?? null,
+			identityProviderDisableLocalAuthentication: it.disableLocalAuthentication ?? false,
 		})),
 	},
 })
@@ -46,7 +48,7 @@ export const getPersonByIdentityForIdp = (args: {
 	passwordlessEnabled?: boolean | null
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+		SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now() AS "is_in_grace", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
 	         FROM "tenant"."person"
 		              INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
 		              LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"

package/tests/cases/integration/mocked/sql/removeMembershipSql.ts

@@ -0,0 +1,14 @@
+import { SQL } from '../../../../src/tags.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+/** RemoveProjectMembershipCommand — delete a single (project, identity, role) membership. */
+export const removeMembershipSql = (args: {
+	projectId: string
+	identityId: string
+	role: string
+}): ExpectedQuery => ({
+	sql: SQL`DELETE FROM "tenant"."project_membership"
+	         WHERE "project_id" = ? AND "identity_id" = ? AND "role" = ?`,
+	parameters: [args.projectId, args.identityId, args.role],
+	response: { rowCount: 1 },
+})

package/tests/cases/integration/mocked/sql/sqlTransaction.ts

@@ -15,3 +15,31 @@ export const sqlTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] =>
 		response: { rowCount: 1 },
 	},
 ]
+
+/**
+ * A nested `client.transaction()` inside an open transaction. Postgres runs it as a savepoint; the
+ * connection mock renders every transaction as BEGIN/COMMIT and sets no isolation level for it.
+ */
+export const sqlNestedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]
+
+export const sqlReadCommittedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]

package/tests/cases/integration/mocked/trustForwardedClientInfo.test.ts

@@ -3,6 +3,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { expect, test } from 'bun:test'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -10,8 +11,8 @@ import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { getAuthPoliciesSql } from './sql/authPolicySql.js'
 import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
-import { GQL } from '../../../src/tags.js'
-import { sqlTransaction } from './sql/sqlTransaction.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { sqlReadCommittedTransaction } from './sql/sqlTransaction.js'
 import { createIdentitySql } from './sql/createIdentitySql.js'
 import { createApiKeySql } from './sql/createApiKeySql.js'
 
@@ -29,6 +30,7 @@ test('signIn: trustForwardedClientInfo=true is propagated when caller has the fl
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -68,6 +70,7 @@ test('signIn: trustForwardedClientInfo=true is silently dropped when caller has
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -109,7 +112,8 @@ test('createGlobalApiKey: trustForwardedClientInfo=true creates permanent key wi
 			variables: { description: 'backend service', roles: [], options: { trustForwardedClientInfo: true } },
 		},
 		executes: [
-			...sqlTransaction(
+			// read committed: the global-role validator takes a FOR SHARE lock on custom_role
+			...sqlReadCommittedTransaction(
 				createIdentitySql({ identityId, description: 'backend service' }),
 				createApiKeySql({ identityId, apiKeyId, trustForwardedInfo: true }),
 			),
@@ -126,3 +130,56 @@ test('createGlobalApiKey: trustForwardedClientInfo=true creates permanent key wi
 		expectedAuthLog: expect.objectContaining({ type: 'api_key_create' }),
 	})
 })
+
+// Through the real authorization stack: project_admin may not mint a trusted-forwarding key, so a
+// custom role (bounded by its surface) may not either — even from a row persisted with the flag on.
+const integrationManagerPreloadSql = (allowTrustForwardedClientInfo: boolean) => ({
+	sql: SQL`select *  from "tenant"."custom_role"  order by "slug" asc`,
+	parameters: [],
+	response: {
+		rows: [{
+			id: testUuid(50),
+			slug: 'integration_manager',
+			description: null,
+			grants: [{ permission: 'apiKey:createGlobal', config: { roles: { allowed: [] }, allowTrustForwardedClientInfo } }],
+			created_at: new Date(),
+			updated_at: new Date(),
+		}],
+	},
+})
+
+const createGlobalApiKeyMutation = GQL`mutation($options: CreateApiKeyOptions) {
+	createGlobalApiKey(description: "backend service", roles: [], options: $options) { ok }
+}`
+
+test('createGlobalApiKey: a custom role may create a key that does not trust forwarded client info', async () => {
+	const identityId = testUuid(1)
+	await executeTenantTest({
+		identityRoles: ['integration_manager'],
+		query: { query: createGlobalApiKeyMutation, variables: { options: { trustForwardedClientInfo: false } } },
+		executes: [
+			integrationManagerPreloadSql(false),
+			...sqlReadCommittedTransaction(
+				createIdentitySql({ identityId, description: 'backend service' }),
+				createApiKeySql({ identityId, apiKeyId: testUuid(2) }),
+			),
+		],
+		return: { data: { createGlobalApiKey: { ok: true } } },
+		expectedAuthLog: expect.objectContaining({ type: 'api_key_create' }),
+	})
+})
+
+test.each([false, true])(
+	'createGlobalApiKey: a custom role (persisted allowTrustForwardedClientInfo=%p) may not create a key trusting forwarded client info',
+	async allowTrustForwardedClientInfo => {
+		await executeTenantTest({
+			identityRoles: ['integration_manager'],
+			query: { query: createGlobalApiKeyMutation, variables: { options: { trustForwardedClientInfo: true } } },
+			executes: [integrationManagerPreloadSql(allowTrustForwardedClientInfo)],
+			return: {
+				data: { createGlobalApiKey: null },
+				errors: [{ message: 'You are not allowed to create a global API key' }],
+			},
+		})
+	},
+)

package/tests/cases/integration/mocked/verifyEmailMutation.test.ts

@@ -19,7 +19,7 @@ test('verifyEmail - marks the email verified and consumes the token', async () =
 		query: verifyEmailMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_verification'],
 				response: {
 					rows: [
@@ -29,6 +29,7 @@ test('verifyEmail - marks the email verified and consumes the token', async () =
 							person_id: personId,
 							created_at: now,
 							expires_at: new Date(now.getTime() + 60 * 60 * 1000),
+							is_expired: false,
 							used_at: null,
 							otp_hash: null,
 							otp_attempts: 0,
@@ -77,7 +78,7 @@ test('verifyEmail - rejects a token issued for a different e-mail address', asyn
 		query: verifyEmailMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_verification'],
 				response: {
 					rows: [
@@ -87,6 +88,7 @@ test('verifyEmail - rejects a token issued for a different e-mail address', asyn
 							person_id: personId,
 							created_at: now,
 							expires_at: new Date(now.getTime() + 60 * 60 * 1000),
+							is_expired: false,
 							used_at: null,
 							otp_hash: null,
 							otp_attempts: 0,
@@ -122,7 +124,7 @@ test('verifyEmail - token expired', async () => {
 		query: verifyEmailMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_verification'],
 				response: {
 					rows: [
@@ -133,6 +135,7 @@ test('verifyEmail - token expired', async () => {
 							created_at: now,
 							// Expired an hour before the mocked clock — no consume/verify follows.
 							expires_at: new Date(now.getTime() - 60 * 60 * 1000),
+							is_expired: true,
 							used_at: null,
 							otp_hash: null,
 							otp_attempts: 0,
@@ -165,7 +168,7 @@ test('verifyEmail - token already used', async () => {
 		query: verifyEmailMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_verification'],
 				response: {
 					rows: [
@@ -175,6 +178,7 @@ test('verifyEmail - token already used', async () => {
 							person_id: personId,
 							created_at: now,
 							expires_at: new Date(now.getTime() + 60 * 60 * 1000),
+							is_expired: false,
 							// Already consumed — a replay must not re-verify or re-consume.
 							used_at: new Date(now.getTime() - 60 * 1000),
 							otp_hash: null,
@@ -206,7 +210,7 @@ test('verifyEmail - token not found', async () => {
 		query: verifyEmailMutation({ token }),
 		executes: [
 			{
-				sql: SQL`SELECT * FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
+				sql: SQL`SELECT *, "expires_at" <= now() as "is_expired" FROM "tenant"."person_token" WHERE "token_hash" = ? AND "type" = ?`,
 				parameters: [anyString, 'email_verification'],
 				response: { rows: [] },
 			},

package/tests/cases/unit/apiKey/createSessionApiKeyPolicy.test.ts

@@ -151,10 +151,13 @@ const run = async (args: {
 	if (policies.length > 0) {
 		queries.push(projectRolesQuery)
 	}
+	const hasComputedMaxExpiry = (args.policies ?? []).some(p => p.token_expiration !== null)
+	const insertSql = hasComputedMaxExpiry
+		? `INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at", "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info", "issued_at", "idle_timeout", "max_expires_at") VALUES (?, ?, ?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?, ?, ?, ?, now() + make_interval(secs => ?))`
+		: `INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at", "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info", "issued_at", "idle_timeout", "max_expires_at") VALUES (?, ?, ?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?, ?, ?, ?, ?)`
 	const insertParams: any[] = new Array(14)
 	queries.push({
-		sql:
-			`INSERT INTO "tenant"."api_key" ("id", "token_hash", "type", "identity_id", "disabled_at", "expires_at", "expiration", "created_at", "created_ip", "created_user_agent", "trust_forwarded_info", "issued_at", "idle_timeout", "max_expires_at") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		sql: insertSql,
 		// Each positional matcher records the value and always matches.
 		parameters: Array.from({ length: 14 }, (_, i) => (value: any) => {
 			insertParams[i] = value
@@ -186,7 +189,7 @@ const MAX_EXPIRES_AT = 13
 test('A19: no policy → identical to today (no idle_timeout / max_expires_at, default 30m window)', async () => {
 	const { insertParams: params, authLog } = await run({})
 	expect(params[EXPIRATION]).toBe(30)
-	expect(params[EXPIRES_AT]).toEqual(new Date('2026-05-21T12:30:00Z'))
+	expect(params[EXPIRES_AT]).toBe(1800)
 	expect(params[IDLE_TIMEOUT]).toBeNull()
 	expect(params[MAX_EXPIRES_AT]).toBeNull()
 	// issued_at is always set for session keys.
@@ -202,8 +205,8 @@ test('A19: tokenExpiration policy → max_expires_at set and initial expiry capp
 		policies: [policy({ token_expiration: PostgresInterval('00:10:00') })],
 	})
 	expect(params[EXPIRATION]).toBe(10)
-	expect(params[EXPIRES_AT]).toEqual(new Date('2026-05-21T12:10:00Z'))
-	expect(params[MAX_EXPIRES_AT]).toEqual(new Date('2026-05-21T12:10:00Z'))
+	expect(params[EXPIRES_AT]).toBe(600)
+	expect(params[MAX_EXPIRES_AT]).toBe(600)
 	// Non-inert policy applied → session_policy_applied audit fires.
 	expect(authLog.type).toBe('session_policy_applied')
 })
@@ -225,6 +228,6 @@ test('A19: rememberMeAllowed=false → client longer expiration is ignored, forc
 		policies: [policy({ remember_me_allowed: false })],
 	})
 	expect(params[EXPIRATION]).toBe(30)
-	expect(params[EXPIRES_AT]).toEqual(new Date('2026-05-21T12:30:00Z'))
+	expect(params[EXPIRES_AT]).toBe(1800)
 	expect(authLog.type).toBe('session_policy_applied')
 })

package/tests/cases/unit/apiKey/prolongApiKeyCommand.test.ts

@@ -57,8 +57,8 @@ test('updates expires_at when prolongation is significant', async () => {
 		currentExpiration,
 		expectedQueries: [
 			{
-				sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
-				parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
 				response: { rowCount: 1 },
 			},
 		],
@@ -75,8 +75,8 @@ test('updates last_* on first usage', async () => {
 		tracking: { lastIp: null, lastUserAgent: null, lastUsedAt: null },
 		expectedQueries: [
 			{
-				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
-				parameters: ['203.0.113.5', 'curl', now, 'api-key-id'],
+				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = now() where "id" = ?`,
+				parameters: ['203.0.113.5', 'curl', 'api-key-id'],
 				response: { rowCount: 1 },
 			},
 		],
@@ -99,7 +99,7 @@ test('throttles last_* within window for same IP+UA', async () => {
 	})
 })
 
-test('bypasses throttle when IP changes', async () => {
+test('throttles last_* within window when IP changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -111,10 +111,26 @@ test('bypasses throttle when IP changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
+		expectedQueries: [],
+	})
+})
+
+test('writes changed IP once the window has passed', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '198.51.100.7', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:58:59Z'),
+		},
 		expectedQueries: [
 			{
-				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
-				parameters: ['198.51.100.7', 'curl', now, 'api-key-id'],
+				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = now() where "id" = ?`,
+				parameters: ['198.51.100.7', 'curl', 'api-key-id'],
 				response: { rowCount: 1 },
 			},
 		],
@@ -132,8 +148,8 @@ test('A19: clamps expires_at at max_expires_at when the sliding window would exc
 		maxExpiresAt,
 		expectedQueries: [
 			{
-				sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
-				parameters: [maxExpiresAt, 'api-key-id'],
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
 				response: { rowCount: 1 },
 			},
 		],
@@ -149,15 +165,15 @@ test('A19: unaffected when max_expires_at is null (today behavior)', async () =>
 		maxExpiresAt: null,
 		expectedQueries: [
 			{
-				sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
-				parameters: [new Date('2026-05-12T12:30:00Z'), 'api-key-id'],
+				sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+				parameters: [1800, 'api-key-id'],
 				response: { rowCount: 1 },
 			},
 		],
 	})
 })
 
-test('bypasses throttle when User-Agent changes', async () => {
+test('throttles last_* within window when User-Agent changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -169,12 +185,6 @@ test('bypasses throttle when User-Agent changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
-		expectedQueries: [
-			{
-				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
-				parameters: ['203.0.113.5', 'browser/2', now, 'api-key-id'],
-				response: { rowCount: 1 },
-			},
-		],
+		expectedQueries: [],
 	})
 })

package/tests/cases/unit/apiKey/unpersistedApiKeyManager.test.ts

@@ -122,16 +122,15 @@ test('verifyAndProlong falls through to the database for a non-matching token',
 	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), unpersisted)
 
 	const tokenHash = computeTokenHash('some-db-token')
-	const readDbContext = createDbContext([
+	const dbContext = createDbContext([
 		{
 			sql:
-				'select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?',
-			parameters: [tokenHash],
+				'select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at", "api_key"."expires_at" is not null and "api_key"."expires_at" <= now() as "is_expired", "api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now() as "is_max_expired", "api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?) as "is_idle_expired" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?',
+			parameters: [60, tokenHash],
 			response: { rows: [] },
 		},
 	])
-	const dbContext = createDbContext([])
 
-	const response = await manager.verifyAndProlong(dbContext, readDbContext, 'some-db-token')
+	const response = await manager.verifyAndProlong(dbContext, dbContext, 'some-db-token')
 	expect(response.ok).toBe(false)
 })