@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/unit/apiKey/verifyAndProlongIdle.test.ts

@@ -14,8 +14,9 @@ import PostgresInterval from 'postgres-interval'
 
 const TOKEN = '0000000000000000000000000000000000000000'
 const TOKEN_HASH = computeTokenHash(TOKEN)
-// verifyAndProlong now reads providers.now() (single injectable clock), so fixtures
-// are anchored relative to that fixed clock rather than the real wall clock.
+// The expiry/idle/max gates are now computed on the DB clock (is_expired /
+// is_max_expired / is_idle_expired), so each case drives the gate via those booleans
+// on the canned row. The dates below are kept for realism and for the prolong throttle.
 const NOW = new Date('2026-05-21T12:00:00Z')
 const minutesAgo = (m: number) => new Date(NOW.getTime() - m * 60_000)
 const minutesAhead = (m: number) => new Date(NOW.getTime() + m * 60_000)
@@ -52,6 +53,9 @@ type Row = {
 	issued_at: Date | null
 	idle_timeout: ReturnType<typeof PostgresInterval> | null
 	max_expires_at: Date | null
+	is_expired: boolean
+	is_max_expired: boolean
+	is_idle_expired: boolean
 }
 
 const defaultRow = (overrides: Partial<Row>): Row => ({
@@ -70,13 +74,16 @@ const defaultRow = (overrides: Partial<Row>): Row => ({
 	issued_at: null,
 	idle_timeout: null,
 	max_expires_at: null,
+	is_expired: false,
+	is_max_expired: false,
+	is_idle_expired: false,
 	...overrides,
 })
 
 const selectByToken = (row: Row | null): ExpectedQuery => ({
 	sql:
-		`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?`,
-	parameters: [TOKEN_HASH],
+		`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at", "api_key"."expires_at" is not null and "api_key"."expires_at" <= now() as "is_expired", "api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now() as "is_max_expired", "api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?) as "is_idle_expired" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?`,
+	parameters: [60, TOKEN_HASH],
 	response: { rows: row ? [row] : [] },
 })
 
@@ -89,8 +96,8 @@ const disableUpdate: ExpectedQuery = {
 // The background prolong UPDATE fires in setImmediate on the allowed path
 // (no requestInfo → only expires_at is touched). We allow but don't assert it.
 const prolongUpdate: ExpectedQuery = {
-	sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
-	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+	parameters: [(val: unknown) => typeof val === 'number', 'api-key-id'],
 	response: { rowCount: 1 },
 }
 
@@ -131,6 +138,7 @@ test('A19: idle-expired key (last_used_at older than idle_timeout) is rejected a
 	const row = defaultRow({
 		idle_timeout: PostgresInterval('00:15:00'),
 		last_used_at: minutesAgo(20), // 20 min ago > 15 min idle timeout
+		is_idle_expired: true, // the DB-clock gate
 	})
 	const authLog: { type?: string } = {}
 	const response = await run(row, [disableUpdate, authLogInsert(authLog)])
@@ -155,6 +163,7 @@ test('A19: idle beyond idle_timeout + slack is still expired (small idle_timeout
 	const row = defaultRow({
 		idle_timeout: PostgresInterval('00:01:00'),
 		last_used_at: new Date(NOW.getTime() - 150_000), // 150s > 60s + 60s slack
+		is_idle_expired: true, // the DB-clock gate
 	})
 	const response = await run(row, [disableUpdate, authLogInsert({})])
 	expect(response.ok).toBe(false)
@@ -191,6 +200,7 @@ test('A19: no idle_timeout behaves as today (allowed regardless of last_used_at)
 test('A19: absolute cap (now >= max_expires_at) rejects and disables', async () => {
 	const row = defaultRow({
 		max_expires_at: minutesAgo(60), // already past
+		is_max_expired: true, // the DB-clock gate
 	})
 	const response = await run(row, [disableUpdate])
 	expect(response.ok).toBe(false)

package/tests/cases/unit/apiKey/verifyAndProlongReplica.test.ts

@@ -0,0 +1,173 @@
+import { expect, test } from 'bun:test'
+import {
+	ApiKey,
+	ApiKeyManager,
+	ApiKeyService,
+	AuthLogService,
+	AuthPolicyResolver,
+	computeTokenHash,
+	DatabaseContext,
+	IDPClaimSyncService,
+	IDPHandlerRegistry,
+	IdpSessionRevalidator,
+	Providers,
+	VerifyErrorCode,
+} from '../../../../src/index.js'
+import { Connection } from '@contember/database'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { createLogger, TestLoggerHandler } from '@contember/logger'
+import { emptySchema } from '@contember/schema-utils'
+
+const TOKEN = '0000000000000000000000000000000000000000'
+const NOW = new Date('2026-05-21T12:00:00Z')
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+const apiKeyRow = {
+	id: 'api-key-id',
+	type: ApiKey.Type.SESSION,
+	identity_id: 'identity-id',
+	disabled_at: null,
+	expires_at: new Date(NOW.getTime() + 30 * 60_000),
+	roles: ['editor'],
+	expiration: 30,
+	person_id: 'person-id',
+	last_ip: null,
+	last_user_agent: null,
+	last_used_at: null,
+	trust_forwarded_info: false,
+	issued_at: null,
+	idle_timeout: null,
+	max_expires_at: null,
+	is_expired: false,
+	is_max_expired: false,
+	is_idle_expired: false,
+}
+
+const selectByToken = (rows: (typeof apiKeyRow)[]): ExpectedQuery => ({
+	sql:
+		`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at", "api_key"."expires_at" is not null and "api_key"."expires_at" <= now() as "is_expired", "api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now() as "is_max_expired", "api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?) as "is_idle_expired" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?`,
+	parameters: [60, computeTokenHash(TOKEN)],
+	response: { rows },
+})
+
+// The prolong UPDATE runs detached on the primary once a key is accepted.
+const prolongUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "expires_at" = LEAST(now() + make_interval(secs => ?), "max_expires_at") where "id" = ?`,
+	parameters: [(val: unknown) => typeof val === 'number', 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+const selectIdpSession = (rows: Record<string, unknown>[]): ExpectedQuery => ({
+	sql:
+		`select "idp_session"."id", "idp_session"."identity_provider_id", "idp_session"."idp_session_id", "idp_session"."tokens", "idp_session"."tokens_version", "idp_session"."idp_expires_at", "idp_session"."token_obtained_at", "idp_session"."last_validated_at", "idp_session"."created_at", "identity_provider"."type" as "provider_type", "identity_provider"."configuration" as "provider_configuration", "identity_provider"."disabled_at" as "provider_disabled_at" from "tenant"."idp_session" inner join "tenant"."identity_provider" as "identity_provider" on "idp_session"."identity_provider_id" = "identity_provider"."id" where "api_key_id" = ?`,
+	parameters: ['api-key-id'],
+	response: { rows },
+})
+
+const disableUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "disabled_at" = ? where "id" = ?`,
+	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+const authLogInsert: ExpectedQuery = {
+	sql:
+		`insert into "tenant"."person_auth_log" ("id", "invoked_by_id", "person_id", "type", "success", "error_code", "identity_provider_id", "metadata", "event_data") values (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+	response: { rowCount: 1 },
+}
+
+const createDbContext = (connection: Connection.ConnectionType) =>
+	new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+
+const verify = async (primary: Connection.ConnectionType, replica: Connection.ConnectionType, idpSessionRevalidator?: IdpSessionRevalidator) => {
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), undefined, idpSessionRevalidator)
+	const response = await manager.verifyAndProlong(createDbContext(primary), createDbContext(replica), TOKEN)
+	// Let the setImmediate-scheduled prolong run before the connection mocks are torn down.
+	await new Promise(resolve => setImmediate(resolve))
+	return response
+}
+
+test('a key not yet replicated is found on the primary', async () => {
+	const primary = createConnectionMock([selectByToken([apiKeyRow]), prolongUpdate])
+	const replica = createConnectionMock([selectByToken([])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(true)
+	if (response.ok) {
+		expect(response.result.apiKeyId).toBe('api-key-id')
+	}
+})
+
+test('a key found on the replica does not query the primary', async () => {
+	const primary = createConnectionMock([prolongUpdate])
+	const replica = createConnectionMock([selectByToken([apiKeyRow])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(true)
+})
+
+test('a key missing on both the replica and the primary is not found', async () => {
+	const primary = createConnectionMock([selectByToken([])])
+	const replica = createConnectionMock([selectByToken([])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(false)
+	if (!response.ok) {
+		expect(response.error).toBe(VerifyErrorCode.NOT_FOUND)
+	}
+})
+
+test('without a replica, a missing key is looked up only once', async () => {
+	const connection = createConnectionMock([selectByToken([])])
+
+	const response = await verify(connection, connection)
+	expect(response.ok).toBe(false)
+})
+
+test('a key found only on the primary reads its IdP session from the primary', async () => {
+	const disabledIdpSession = {
+		id: 'idp-session-id',
+		identity_provider_id: 'idp-id',
+		idp_session_id: null,
+		tokens: null,
+		tokens_version: null,
+		idp_expires_at: null,
+		token_obtained_at: NOW,
+		last_validated_at: NOW,
+		created_at: NOW,
+		provider_type: 'oidc',
+		provider_configuration: { revalidation: { enabled: true } },
+		provider_disabled_at: NOW,
+	}
+	const primary = createConnectionMock([selectByToken([apiKeyRow]), selectIdpSession([disabledIdpSession]), disableUpdate, authLogInsert])
+	const replica = createConnectionMock([selectByToken([]), selectIdpSession([])])
+	const logHandler = new TestLoggerHandler()
+	const idpSessionRevalidator = new IdpSessionRevalidator(
+		new IDPHandlerRegistry(),
+		new IDPClaimSyncService({ getSchema: () => Promise.resolve(emptySchema) }),
+		createLogger(logHandler),
+	)
+
+	const response = await verify(primary, replica, idpSessionRevalidator)
+	expect(response.ok).toBe(false)
+	if (!response.ok) {
+		expect(response.error).toBe(VerifyErrorCode.DISABLED)
+	}
+	// The revocation audit entry is best-effort and only logged on failure.
+	expect(logHandler.messages).toEqual([])
+})

package/tests/cases/unit/authLogBaselineWrite.test.ts

@@ -1,6 +1,6 @@
 import { expect, test } from 'bun:test'
 import crypto from 'node:crypto'
-import { AuthLogService, DatabaseContext, LoginRiskAnalyzer, TenantResolverContextFactory } from '../../../src/index.js'
+import { AuthLogService, DatabaseContext, LoginRiskAnalyzer, TenantResolverContextFactory, UNPERSISTED_ROOT_IDENTITY_ID } from '../../../src/index.js'
 import { ResponseOk } from '../../../src/model/utils/Response.js'
 import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
 import { createLogger, JsonStreamLoggerHandler } from '@contember/logger'
@@ -89,13 +89,36 @@ test('an absent country / user-agent stamps NULL (column omitted), never an empt
 	})
 })
 
+test('an unpersisted root actor is audited without a dangling identity foreign key', async () => {
+	await runWithQuery({
+		sql: `insert into  "tenant"."person_auth_log" ("id", "type", "success", "error_code", "metadata") values  (?, ?, ?, ?, ?)`,
+		parameters: [
+			() => true,
+			'custom_role_change',
+			true,
+			null,
+			(value: unknown) => {
+				expect(value).toEqual({ invokedByUnpersistedIdentityId: UNPERSISTED_ROOT_IDENTITY_ID })
+				return true
+			},
+		],
+		response: { rowCount: 1 },
+	}, async db => {
+		await new AuthLogService().logAuthAction(
+			db,
+			{ identityId: UNPERSISTED_ROOT_IDENTITY_ID },
+			{ type: 'custom_role_change', response: new ResponseOk({}) },
+		)
+	})
+})
+
 test('TenantResolverContextFactory stamps device_fingerprint = analyzer.fingerprint(UA) and the geo country', async () => {
 	// The end-to-end stamping: the factory computes the fingerprint via the SAME
 	// LoginRiskAnalyzer.fingerprint that score() later compares history against, so a
 	// "same browser" sign-in is recognised. This is the link a regression would break.
 	const analyzer = new LoginRiskAnalyzer(hash)
 	const permissionContextFactory = {
-		create: () => ({
+		createPreloaded: async () => ({
 			identity: { id: 'identity-1', roles: [] },
 			isAllowed: () => Promise.resolve(true),
 			requireAccess: () => Promise.resolve(),
@@ -105,7 +128,7 @@ test('TenantResolverContextFactory stamps device_fingerprint = analyzer.fingerpr
 
 	const captured: { geo?: unknown; fp?: unknown } = {}
 	await runWithQuery(insertCapturing(captured), async db => {
-		const context = factory.create(
+		const context = await factory.create(
 			{ apiKeyId: 'api-key-1', identityId: 'identity-1', roles: [] },
 			{ ip: '203.0.113.5', userAgent: UA, geoCountry: 'US' },
 			db,

package/tests/cases/unit/backupCodeManager.test.ts

@@ -65,6 +65,7 @@ const person = (overrides: Partial<PersonRow> = {}): PersonRow => ({
 	disabled_at: null,
 	passwordless_enabled: null,
 	mfa_grace_until: null,
+	is_in_grace: false,
 	email_verified_at: null,
 	email_verification_required: false,
 	...overrides,

package/tests/cases/unit/customRoleAuthorizator.test.ts

@@ -0,0 +1,149 @@
+import { expect, test } from 'bun:test'
+import { AccessNode, AuthorizationScope, Authorizator, Permissions } from '@contember/authorization'
+import { CustomRoleAuthorizator } from '../../../src/model/authorization/CustomRoleAuthorizator.js'
+import { Identity } from '../../../src/model/authorization/Identity.js'
+import { IdentityScope } from '../../../src/model/authorization/IdentityScope.js'
+import { buildCustomRolePermissions } from '../../../src/model/authorization/CustomRolePermissions.js'
+import { PermissionActions } from '../../../src/model/authorization/PermissionActions.js'
+import { TenantRole } from '../../../src/model/authorization/Roles.js'
+import { CustomRoleRow } from '../../../src/model/type/index.js'
+import { DatabaseContext } from '../../../src/model/utils/index.js'
+
+const identity = (roles: readonly string[]): Identity => ({ id: 'identity-1', roles } as unknown as Identity)
+
+const scope = new AuthorizationScope.Global()
+
+const row = (slug: string, grants: readonly object[]): CustomRoleRow => ({
+	id: 'role-1',
+	slug,
+	description: null,
+	grants,
+	created_at: new Date(),
+	updated_at: new Date(),
+})
+
+/** Counts real `custom_role` reads, so the per-request query budget is observable. */
+const countingDb = (rows: readonly CustomRoleRow[]) => {
+	let queries = 0
+	const db = {
+		queryHandler: {
+			fetch: async () => {
+				queries++
+				return [...rows]
+			},
+		},
+	} as unknown as DatabaseContext
+	return { db, queries: () => queries }
+}
+
+const innerAuthorizator = (allowed: boolean): Authorizator<Identity> => ({
+	isAllowed: async () => allowed,
+})
+
+const listAction = PermissionActions.PERSON_LIST
+const supportRole = () => row('support', [{ permission: 'person:list', config: null }])
+
+test('an inner allow short-circuits before any custom-role lookup', async () => {
+	const { db, queries } = countingDb([supportRole()])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(true), db)
+
+	expect(await authorizator.isAllowed(identity(['support']), scope, listAction)).toBe(true)
+	// the "at most one query per request, and only when the static check denied" claim
+	expect(queries()).toBe(0)
+})
+
+test('an identity carrying only built-in roles never queries for definitions', async () => {
+	const { db, queries } = countingDb([supportRole()])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+
+	expect(await authorizator.isAllowed(identity([TenantRole.PROJECT_ADMIN, TenantRole.PERSON]), scope, listAction)).toBe(false)
+	expect(queries()).toBe(0)
+})
+
+test('a non-builtin slug grants exactly what its definition carries, and queries once', async () => {
+	const { db, queries } = countingDb([supportRole()])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+
+	expect(await authorizator.isAllowed(identity(['support']), scope, listAction)).toBe(true)
+	expect(await authorizator.isAllowed(identity(['support']), scope, PermissionActions.API_KEY_LIST)).toBe(false)
+	expect(await authorizator.isAllowed(identity(['other']), scope, listAction)).toBe(false)
+	expect(queries()).toBe(1)
+})
+
+test('a row whose slug collides with a built-in role grants nothing', async () => {
+	// Backstop for the write-time slug check: a project_admin identity must not pick up a
+	// bundle from a `project_admin` row, however that row got into the table.
+	const { db, queries } = countingDb([row(TenantRole.PROJECT_ADMIN, [{ permission: 'person:list', config: null }])])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+
+	expect(await authorizator.isAllowed(identity([TenantRole.PROJECT_ADMIN]), scope, listAction)).toBe(false)
+	expect(queries()).toBe(0)
+})
+
+test('preload resolves definitions only for identities that carry a custom role', async () => {
+	const builtinOnly = countingDb([supportRole()])
+	await new CustomRoleAuthorizator(innerAuthorizator(false), builtinOnly.db).preload([TenantRole.PROJECT_ADMIN])
+	expect(builtinOnly.queries()).toBe(0)
+
+	const withCustom = countingDb([supportRole()])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), withCustom.db)
+	await authorizator.preload(['support'])
+	expect(withCustom.queries()).toBe(1)
+
+	// the preloaded result is what the later check uses — no second lookup mid-request
+	expect(await authorizator.isAllowed(identity(['support']), scope, listAction)).toBe(true)
+	expect(withCustom.queries()).toBe(1)
+})
+
+test('a definition that no longer parses leaves the role inert', async () => {
+	const { db } = countingDb([row('support', [{ permission: 'no:such:permission', config: null }])])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+
+	expect(await authorizator.isAllowed(identity(['support']), scope, listAction)).toBe(false)
+})
+
+test('compiled grants are keyed by slug alone, so no identity state can leak between roles', () => {
+	const permissions: Permissions = buildCustomRolePermissions([supportRole()])
+
+	expect(permissions.isAllowed('support', listAction.resource, listAction.privilege, listAction.meta)).toBe(true)
+	expect(permissions.isAllowed('other', listAction.resource, listAction.privilege, listAction.meta)).toBe(false)
+})
+
+test('a tenant-global grant cannot answer a project-scoped check', async () => {
+	// `Permissions.isAllowed` never sees the scope, so a grant that satisfied a project-scoped
+	// check would satisfy it on EVERY project — while the equivalent static project_admin grant
+	// is bounded by ProjectScope. Only grants carrying their own project filter may try.
+	const projectScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())
+	const { db } = countingDb([supportRole()])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+
+	expect(await authorizator.isAllowed(identity(['support']), scope, listAction)).toBe(true)
+	expect(await authorizator.isAllowed(identity(['support']), projectScope, listAction)).toBe(false)
+})
+
+test('a mail-template grant still answers a project-scoped check, on its own exact filter', async () => {
+	const projectScope = new AuthorizationScope.Fixed(AccessNode.Fixed.denied())
+	const { db } = countingDb([row('editor', [{
+		permission: 'mailTemplate:add',
+		config: { global: false, projects: ['project-a'], types: ['RESET_PASSWORD_REQUEST'] },
+	}])])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+	const forProject = (projectSlug: string) => PermissionActions.MAIL_TEMPLATE_ADD({ kind: 'project', projectSlug, type: 'RESET_PASSWORD_REQUEST' })
+
+	expect(await authorizator.isAllowed(identity(['editor']), projectScope, forProject('project-a'))).toBe(true)
+	expect(await authorizator.isAllowed(identity(['editor']), projectScope, forProject('project-b'))).toBe(false)
+})
+
+test('an IdentityScope does not restrict a tenant-global grant', async () => {
+	// `changeProfile` and `changePassword` are checked under an IdentityScope, which only *widens*
+	// (it adds `self` when the target is the caller) rather than bounding what a grant may reach.
+	// Treating it like a project scope silently broke every target-identity grant.
+	const { db } = countingDb([row('support', [{
+		permission: 'person:changePassword',
+		config: { target: { globalRoles: { allowed: ['person'] }, projectMemberships: 'any' } },
+	}])])
+	const authorizator = new CustomRoleAuthorizator(innerAuthorizator(false), db)
+	const action = PermissionActions.PERSON_CHANGE_PASSWORD({ id: 'target', globalRoles: ['person'], hasProjectMemberships: false })
+
+	expect(await authorizator.isAllowed(identity(['support']), new IdentityScope('someone-else'), action)).toBe(true)
+})