@contember/engine-tenant-api 2.2.0-alpha.2 → 2.2.0-alpha.5

package/src/model/service/idp/IdpSessionRevalidator.ts

@@ -9,6 +9,9 @@ import { DisableApiKeyCommand } from '../../commands/index.js'
 import { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'
 import { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'
 import { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'
+import { IDPClaimSyncService } from './IDPClaimSyncService.js'
+import { parseClaimMapping } from './ClaimMapping.js'
+import { JSONValue } from '@contember/schema'
 
 export type RevalidationOutcome = 'valid' | 'revoked'
 
@@ -42,6 +45,7 @@ type Decision = null | { blocking: boolean; claimInterval: string }
 export class IdpSessionRevalidator {
 	constructor(
 		private readonly idpRegistry: IDPHandlerRegistry,
+		private readonly claimSyncService: IDPClaimSyncService,
 	) {
 	}
 
@@ -185,9 +189,95 @@ export class IdpSessionRevalidator {
 				// fall through — session stays valid, persist retried on a later request
 			}
 		}
+
+		// A09 — re-apply the IdP's claim mapping when the refresh returned fresh claims, so an `always`
+		// mapping keeps an established session's project memberships in sync with the IdP's current claims
+		// without requiring a full re-login. `sticky` mappings self-skip (the sync passes isNewPerson=false).
+		// `claimsComplete` tells the sync whether the refresh rebuilt sign-in's full claim surface, so it can
+		// reconcile (incl. `unmatched: "remove"`) exactly like sign-in. Strictly fail-open — see `syncClaims`.
+		if (result.claims) {
+			await this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo)
+		}
 		return 'valid'
 	}
 
+	/**
+	 * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of
+	 * the membership changes) and never throws: the IdP has already vouched for the session, so a
+	 * malformed mapping or a transient apply error must not revoke or fail it. A real membership change
+	 * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open
+	 * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's
+	 * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.
+	 */
+	private async syncClaims(
+		dbContext: DatabaseContext,
+		row: IdpSessionRow,
+		apiKeyRow: ApiKeyRow,
+		claims: Record<string, unknown>,
+		claimsComplete: boolean,
+		requestInfo?: ApiKeyRequestInfo,
+	): Promise<void> {
+		try {
+			const mapping = parseClaimMapping(row.providerConfiguration)
+			if (!mapping) {
+				return
+			}
+			// Atomic apply in its own transaction (the verify path has no surrounding one). `always`-only:
+			// the sync passes isNewPerson=false, so a `sticky` mapping self-skips and returns a null audit.
+			// Refresh mirrors sign-in as closely as the claim surface allows: when the provider returned its
+			// COMPLETE surface (`claimsComplete` — `method: "refresh"` rebuilding sign-in's id-token + userinfo
+			// merge), `unmatched: "remove"` reconciliation runs here too. A partial surface (a userinfo-only
+			// probe, or a refresh whose userinfo fetch failed) passes `allowRemoval: false`, so refresh stays
+			// additive-only and a membership the IdP still asserts is never stripped off an incomplete surface.
+			const { audit, droppedUnsafeRules } = await dbContext.transaction(db =>
+				this.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })
+			)
+			if (audit) {
+				await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapped', audit, requestInfo)
+			}
+			// The apply-time safety backstop dropped a configured rule — emit the fail-open marker so a broken
+			// mapping is visible on the refresh path too, mirroring sign-in (the marker carries no claim values).
+			if (droppedUnsafeRules) {
+				await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
+			}
+		} catch {
+			// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or
+			// fail an already-vouched-for session. The transaction rolls back any partial apply.
+			await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
+		}
+	}
+
+	private async logRoleMapping(
+		dbContext: DatabaseContext,
+		apiKeyRow: ApiKeyRow,
+		row: IdpSessionRow,
+		type: 'idp_role_mapped' | 'idp_role_mapping_failed',
+		eventData: JSONValue | undefined,
+		requestInfo?: ApiKeyRequestInfo,
+	): Promise<void> {
+		try {
+			await dbContext.commandBus.execute(
+				new CreateAuthLogEntryCommand({
+					type,
+					invokedById: apiKeyRow.identity_id,
+					personId: apiKeyRow.person_id ?? undefined,
+					// The membership change affects this session's own person — record it as the target too,
+					// so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes
+					// (consistent with the project_membership_* audit events).
+					targetPersonId: apiKeyRow.person_id ?? undefined,
+					identityProviderId: row.identityProviderId,
+					personTokenId: apiKeyRow.id,
+					success: true,
+					eventData,
+					ipAddress: requestInfo?.ip,
+					userAgent: requestInfo?.userAgent,
+				}),
+			)
+		} catch {
+			// best-effort audit — never fail the request because the audit write failed
+		}
+	}
+
 	private async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {
 		await dbContext.commandBus.execute(
 			new CreateAuthLogEntryCommand({

package/src/model/service/idp/index.ts

@@ -6,6 +6,10 @@ export * from './BackchannelLogoutManager.js'
 export * from './IDPRevalidation.js'
 export * from './IDPManager.js'
 export * from './PersonIdentityProviderManager.js'
+export * from './ClaimMapping.js'
+export * from './ClaimMappingEvaluator.js'
+export * from './ClaimMappingValidation.js'
+export * from './IDPClaimSyncService.js'
 export * from './IDPResponseError.js'
 export * from './IDPValidationError.js'
 export * from './InvalidIDPConfigurationError.js'

package/src/model/service/idp/providers/OIDCHelpers.ts

@@ -63,13 +63,136 @@ export type HandleOIDCResponseOptions = {
 	claimMapping?: OIDCClaimMapping
 }
 
-/** Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). */
+/**
+ * Read a claim by name, supporting dot-paths into nested objects (`a.b.c`). Own-property only at every
+ * segment (mirrors `ClaimMappingEvaluator.resolvePath`): a configured path must never descend into an
+ * inherited member, so a `__proto__` / `constructor` segment cannot surface an `Object.prototype` value
+ * as the externalIdentifier / email / name.
+ */
 const getClaim = (source: Record<string, unknown>, path: string): unknown =>
 	path.split('.').reduce<unknown>(
-		(acc, key) => (acc != null && typeof acc === 'object' ? (acc as Record<string, unknown>)[key] : undefined),
+		(
+			acc,
+			key,
+		) => (acc != null && typeof acc === 'object' && Object.prototype.hasOwnProperty.call(acc, key) ? (acc as Record<string, unknown>)[key] : undefined),
 		source,
 	)
 
+/**
+ * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the
+ * top level so providers that nest their claims map without a code change. The nested attributes are
+ * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an
+ * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the
+ * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an
+ * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.
+ */
+export const liftNestedClaims = (source: Record<string, unknown>, attributesKey: string | undefined): Record<string, unknown> => {
+	if (!attributesKey) {
+		return source
+	}
+	const nested = Object.prototype.hasOwnProperty.call(source, attributesKey) ? source[attributesKey] : undefined
+	if (nested !== null && typeof nested === 'object' && !Array.isArray(nested)) {
+		return { ...nested, ...source }
+	}
+	return source
+}
+
+type NormalizedClaims = Record<string, unknown> & {
+	externalIdentifier: string
+	email: string | undefined
+	name: string | undefined
+	emailVerified: boolean
+}
+
+/**
+ * Build the normalized claim surface shared by sign-in ({@link handleOIDCResponse}) and session refresh
+ * ({@link revalidateOIDC}): lift any configured nested attributes object to the top level, then layer the
+ * mapped identity fields (`externalIdentifier` / `email` / `name` / `emailVerified`) over the raw claims.
+ * BOTH paths run this SAME normalization so an A09 claim-mapping rule resolves identically whether it
+ * targets a raw provider claim or one of the normalized identity fields — without it the two surfaces
+ * diverged (refresh saw the raw claim, sign-in the mapped value).
+ *
+ * `subFallback` is the signature-verified ID-token `sub`, used when a custom `externalIdentifier` mapping
+ * resolves to nothing: at sign-in it is guaranteed present; on refresh it is the refreshed id-token's `sub`
+ * (or, for the userinfo method, the userinfo `sub`). Throws (account-takeover guard) when the mapped
+ * subject is a non-scalar or resolves empty — the refresh caller catches this and skips the sync.
+ */
+const normalizeClaims = (
+	rawSource: Record<string, unknown>,
+	claimMapping: OIDCClaimMapping | undefined,
+	subFallback: string | undefined,
+): NormalizedClaims => {
+	const source = liftNestedClaims(rawSource, claimMapping?.attributesKey)
+
+	// The OIDC `email_verified` claim is a boolean per spec, but some providers send the
+	// string "true". userInfo (and any unwrapped attributes) take precedence over the ID token.
+	const rawEmailVerified = source.email_verified
+	const emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'
+
+	// `externalIdentifier` is the federation key persisted in `person_identity_provider` and
+	// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed
+	// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /
+	// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail
+	// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).
+	const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')
+	let externalIdentifier: string
+	if (mappedSubject === undefined || mappedSubject === null) {
+		externalIdentifier = subFallback ?? ''
+	} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {
+		externalIdentifier = String(mappedSubject)
+	} else {
+		throw new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)
+	}
+	if (externalIdentifier === '') {
+		throw new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)
+	}
+
+	// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail
+	// account lookup (which crashes on a non-string). `...source` already placed the raw claim
+	// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is
+	// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.
+	const email = getClaim(source, claimMapping?.email ?? 'email')
+	const name = resolveName(source, claimMapping)
+
+	return {
+		...source,
+		externalIdentifier,
+		email: typeof email === 'string' ? email : undefined,
+		name,
+		emailVerified,
+	}
+}
+
+/**
+ * Resolve the display name, falling back to `given_name` + `family_name` when there is no usable
+ * `name` claim.
+ *
+ * `name` is optional in OIDC core and plenty of providers omit it while sending the parts — Apereo
+ * CAS and Entra ID do, and so does Keycloak under its default mappers. Without the fallback,
+ * `CreatePersonCommand` lands on its own last-resort default and a federated person ends up named
+ * after the local part of their e-mail (`jan.novak`) despite the IdP having reported "Jan Novák".
+ * A single-path `claimMapping.name` cannot express this: the value has to be composed from two
+ * claims, not selected from one.
+ *
+ * An explicitly configured `claimMapping.name` is honoured as-is, fallback included — mapping a
+ * claim is a statement about where the name lives, and quietly substituting a different source
+ * would defeat it. A blank claim counts as absent: an empty string is not a display name, and
+ * treating it as one would keep the fallback (and `CreatePersonCommand`'s) from ever running.
+ */
+const resolveName = (source: Record<string, unknown>, claimMapping: OIDCClaimMapping | undefined): string | undefined => {
+	const mapped = getClaim(source, claimMapping?.name ?? 'name')
+	if (typeof mapped === 'string' && mapped.trim() !== '') {
+		return mapped
+	}
+	if (claimMapping?.name !== undefined) {
+		return undefined
+	}
+	const parts = [getClaim(source, 'given_name'), getClaim(source, 'family_name')]
+		.filter((part): part is string => typeof part === 'string' && part.trim() !== '')
+		.map(part => part.trim())
+	return parts.length > 0 ? parts.join(' ') : undefined
+}
+
 export const handleOIDCResponse = async (
 	client: Client,
 	{ sessionData, redirectUrl, ...otherData }: OIDCResponseData,
@@ -87,58 +210,15 @@ export const handleOIDCResponse = async (
 		const oidcResult = returnOIDCResult ? result : {}
 		const idpSession = captureSession ? tokenSetToSessionState(result, typeof claims.sid === 'string' ? claims.sid : undefined) : undefined
 
-		// Merge ID-token claims with userInfo (userInfo wins, per spec). Then optionally lift a
-		// nested attributes object to the top level so providers that nest their claims (notably
-		// Apereo CAS userinfo, which returns them under `attributes`) map without a code change.
-		// The nested attributes are UNSIGNED, so they must not override a claim already present in
-		// the (signature-verified) ID-token / userInfo merge — spread them UNDER `source`, not over
-		// it, so a signed `sub` / `email_verified` keeps precedence over an attributes-level value.
-		let source: Record<string, unknown> = { ...claimsWithoutHashes, ...userInfo }
-		const attributesKey = claimMapping?.attributesKey
-		if (attributesKey) {
-			const nested = source[attributesKey]
-			if (nested && typeof nested === 'object' && !Array.isArray(nested)) {
-				source = { ...(nested as Record<string, unknown>), ...source }
-			}
-		}
-
-		// The OIDC `email_verified` claim is a boolean per spec, but some providers send the
-		// string "true". userInfo (and any unwrapped attributes) take precedence over the ID token.
-		const rawEmailVerified = source.email_verified
-		const emailVerified = rawEmailVerified === true || rawEmailVerified === 'true'
-
-		// `externalIdentifier` is the federation key persisted in `person_identity_provider` and
-		// matched on the next sign-in, so it must be a stable scalar. A `claimMapping` that pointed
-		// it at an object/array would otherwise be coerced by `String(...)` to `'[object Object]'` /
-		// a comma-join — collapsing every user of the provider onto one key (account takeover). Fail
-		// closed instead. The default `sub` path is safe (openid-client guarantees `sub` is a string).
-		const mappedSubject = getClaim(source, claimMapping?.externalIdentifier ?? 'sub')
-		let externalIdentifier: string
-		if (mappedSubject === undefined || mappedSubject === null) {
-			externalIdentifier = claims.sub
-		} else if (typeof mappedSubject === 'string' || typeof mappedSubject === 'number') {
-			externalIdentifier = String(mappedSubject)
-		} else {
-			throw new IDPValidationError(`The mapped externalIdentifier claim is not a scalar value`)
-		}
-		if (externalIdentifier === '') {
-			throw new IDPValidationError(`The mapped externalIdentifier claim resolved to an empty value`)
-		}
-
-		// `email` / `name` are typed `string | undefined` on IDPResponse and feed the by-e-mail
-		// account lookup (which crashes on a non-string). `...source` already placed the raw claim
-		// of whatever type, so OVERWRITE (don't conditionally add) with the mapped value when it is
-		// a string, otherwise `undefined` — a non-string claim must not leak through `...source`.
-		const email = getClaim(source, claimMapping?.email ?? 'email')
-		const name = getClaim(source, claimMapping?.name ?? 'name')
+		// Merge ID-token claims with userInfo (userInfo wins, per spec), then normalize the surface (lift
+		// nested attributes + map the identity fields). The refresh path runs the SAME normalization, so a
+		// claim mapping resolves identically at sign-in and on refresh. The default `sub` fallback is safe —
+		// openid-client guarantees `sub` is a string.
+		const normalized = normalizeClaims({ ...claimsWithoutHashes, ...userInfo }, claimMapping, claims.sub)
 
 		return {
 			...oidcResult,
-			...source,
-			externalIdentifier,
-			email: typeof email === 'string' ? email : undefined,
-			name: typeof name === 'string' ? name : undefined,
-			emailVerified,
+			...normalized,
 			...(idpSession ? { idpSession } : {}),
 		}
 	} catch (e: any) {
@@ -169,7 +249,9 @@ export const revalidateOIDC = async (
 	client: Client,
 	method: 'refresh' | 'userinfo' | 'introspection',
 	session: IDPSessionState,
+	options: { claimMapping?: OIDCClaimMapping; fetchUserInfo?: boolean } = {},
 ): Promise<RevalidationResult> => {
+	const { claimMapping, fetchUserInfo } = options
 	const tokens = session.tokens ?? {}
 	const refreshToken = typeof tokens.refresh_token === 'string' ? tokens.refresh_token : undefined
 	const accessToken = typeof tokens.access_token === 'string' ? tokens.access_token : undefined
@@ -180,14 +262,31 @@ export const revalidateOIDC = async (
 			}
 			const tokenSet = await client.refresh(refreshToken)
 			let claims: Record<string, unknown> | undefined
+			let claimsComplete = false
 			try {
-				claims = tokenSet.id_token ? tokenSet.claims() : undefined
+				// Reconstruct the SAME claim surface sign-in builds (handleOIDCResponse): the refreshed id-token
+				// claims merged with userInfo when `fetchUserInfo` is set — exactly as at sign-in — then the shared
+				// normalization (lift nested attributes + map identity fields). An `always` mapping therefore
+				// reconciles against an identical surface on refresh, so `claimsComplete` lets the caller enable
+				// `unmatched: "remove"` reconciliation here too (see IdpSessionRevalidator).
+				if (tokenSet.id_token) {
+					const idClaims = tokenSet.claims()
+					const userInfo = tokenSet.access_token && fetchUserInfo ? await client.userinfo(tokenSet) : {}
+					claims = normalizeClaims({ ...idClaims, ...userInfo }, claimMapping, typeof idClaims.sub === 'string' ? idClaims.sub : undefined)
+					claimsComplete = true
+				}
 			} catch {
+				// Building the surface failed (userinfo unreachable, a non-scalar `externalIdentifier`, …). The IdP
+				// already vouched for the session via the successful refresh, so KEEP it — just skip the claim sync
+				// this tick (no claims → no grant, no removal) and retry on a later refresh. Leaving claimsComplete
+				// false also guarantees a half-built surface can never drive a removal.
 				claims = undefined
+				claimsComplete = false
 			}
 			return {
 				status: 'valid',
 				claims,
+				claimsComplete,
 				// carry the stored tokens forward: a non-rotating IdP omits the refresh token here
 				idpSession: tokenSetToSessionState(tokenSet, session.sessionId, tokens),
 			}
@@ -197,7 +296,16 @@ export const revalidateOIDC = async (
 				return { status: 'revoked', reason: 'no_access_token' }
 			}
 			const userInfo = await client.userinfo(accessToken)
-			return { status: 'valid', claims: userInfo }
+			let claims: Record<string, unknown> | undefined
+			try {
+				claims = normalizeClaims(userInfo, claimMapping, typeof userInfo.sub === 'string' ? userInfo.sub : undefined)
+			} catch {
+				claims = undefined
+			}
+			// A userinfo probe carries no id-token claims, so its surface is NARROWER than sign-in's (id-token +
+			// userinfo): a rule keyed on an id-token-only claim would miss here. Keep refresh-time sync additive-only
+			// (`claimsComplete: false`) so `unmatched: "remove"` never strips a membership off this partial surface.
+			return { status: 'valid', claims, claimsComplete: false }
 		}
 		// introspection
 		const token = accessToken ?? refreshToken

package/src/model/service/idp/providers/OIDCProvider.ts

@@ -48,7 +48,10 @@ export class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration>
 
 	public async revalidate(configuration: OIDCConfiguration, session: IDPSessionState): Promise<RevalidationResult> {
 		const client = await this.createOIDCClient(configuration)
-		return await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session)
+		return await revalidateOIDC(client, configuration.revalidation?.method ?? 'refresh', session, {
+			claimMapping: configuration.claimMapping,
+			fetchUserInfo: configuration.fetchUserInfo,
+		})
 	}
 
 	public async buildLogoutUrl(configuration: OIDCConfiguration, request: LogoutUrlRequest): Promise<string | null> {

package/src/model/service/index.ts

@@ -17,6 +17,7 @@ export * from './MailTemplateManager.js'
 export * from './MembershipValidator.js'
 export * from './OtpAuthenticator.js'
 export * from './OtpManager.js'
+export * from './PanelAccessResolver.js'
 export * from './PasswordChangeManager.js'
 export * from './PasswordResetManager.js'
 export * from './PersonAccessManager.js'

package/src/model/type/AuthLog.ts

@@ -16,6 +16,7 @@ export type AuthActionType =
 	| 'passwordless_login_exchange'
 	| 'passwordless_login'
 	| 'person_disable'
+	| 'person_enable'
 	| 'session_revoked_by_user'
 	| 'forced_sign_out'
 	| 'global_role_grant'
@@ -35,6 +36,8 @@ export type AuthActionType =
 	| 'idp_logout_initiated'
 	| 'idp_backchannel_logout'
 	| 'idp_disconnect'
+	| 'idp_role_mapped'
+	| 'idp_role_mapping_failed'
 	| 'project_create'
 	| 'project_update'
 	| 'project_secret_change'

package/src/model/type/Config.ts

@@ -48,6 +48,9 @@ export type ConfigRow = {
 	rate_limit_email_otp_per_person_window: IPostgresInterval
 	rate_limit_email_verification_per_ip_limit: number
 	rate_limit_email_verification_per_ip_window: IPostgresInterval
+	// Readonly: the GraphQL input renders list values as ReadonlyArray, which is written straight to these columns.
+	panel_global_roles: readonly string[]
+	panel_project_roles: readonly string[]
 }
 
 export type Config =

package/src/model/utils/DatabaseContext.ts

@@ -1,8 +1,20 @@
-import { Client, Connection } from '@contember/database'
+import { Client, Connection, retryTransaction } from '@contember/database'
+import { Logger } from '@contember/logger'
 import { Providers } from '../providers.js'
 import { CommandBus } from '../commands/index.js'
 import { BatchLoaderArgs, initBatchLoader, ItemLoader } from '../../utils/batchQuery.js'
 
+export interface TransactionOptions {
+	/**
+	 * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
+	 * repeatable-read level every transaction here runs at.
+	 *
+	 * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside
+	 * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.
+	 */
+	retry?: { logger: Logger }
+}
+
 export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
 	private loaders = new Map<BatchLoaderArgs<any, any, any>, ItemLoader<any, any>>()
 
@@ -20,11 +32,20 @@ export class DatabaseContext<Conn extends Connection.ConnectionLike = Connection
 		return this.client.createQueryHandler()
 	}
 
-	public async transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T> {
-		return await this.client.transaction(async db => {
-			await db.query(Connection.REPEATABLE_READ)
-			return await cb(new DatabaseContext(db, this.providers))
-		})
+	public async transaction<T>(
+		cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>,
+		options: TransactionOptions = {},
+	): Promise<T> {
+		const run = async () =>
+			await this.client.transaction(async db => {
+				await db.query(Connection.REPEATABLE_READ)
+				return await cb(new DatabaseContext(db, this.providers))
+			})
+		const retry = options.retry
+		if (!retry) {
+			return await run()
+		}
+		return await retryTransaction(run, message => retry.logger.warn(message))
 	}
 
 	public async scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T> {

package/src/resolvers/ResolverFactory.ts

@@ -40,6 +40,7 @@ import { DateTimeType, IntervalType, JSONType } from '@contember/graphql-utils'
 import { IDPQueryResolver } from './query/IDPQueryResolver.js'
 import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js'
 import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js'
+import { EnablePersonMutationResolver } from './mutation/person/EnablePersonMutationResolver.js'
 import { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js'
 import { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js'
 import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js'
@@ -78,6 +79,7 @@ class ResolverFactory {
 			passwordlessMutationResolver: PasswordlessMutationResolver
 
 			disablePersonMutationResolver: DisablePersonMutationResolver
+			enablePersonMutationResolver: EnablePersonMutationResolver
 			forceSignOutMutationResolver: ForceSignOutMutationResolver
 			resetPersonMfaMutationResolver: ResetPersonMfaMutationResolver
 			revokeSessionMutationResolver: RevokeSessionMutationResolver
@@ -133,12 +135,15 @@ class ResolverFactory {
 			},
 			Person: {
 				identityProviders: this.resolvers.personTypeResolver.identityProviders.bind(this.resolvers.personTypeResolver),
+				passwordlessAvailable: this.resolvers.personTypeResolver.passwordlessAvailable.bind(this.resolvers.personTypeResolver),
+				passwordlessSelfManaged: this.resolvers.personTypeResolver.passwordlessSelfManaged.bind(this.resolvers.personTypeResolver),
 			},
 			Project: {
 				members: this.resolvers.projectTypeResolver.members.bind(this.resolvers.projectTypeResolver),
 				roles: this.resolvers.projectTypeResolver.roles.bind(this.resolvers.projectTypeResolver),
 				apiKeys: this.resolvers.projectTypeResolver.apiKeys.bind(this.resolvers.projectTypeResolver),
 				secrets: this.resolvers.projectTypeResolver.secrets.bind(this.resolvers.projectTypeResolver),
+				permissions: this.resolvers.projectTypeResolver.permissions.bind(this.resolvers.projectTypeResolver),
 			},
 			Query: {
 				me: this.resolvers.meQueryResolver.me.bind(this.resolvers.meQueryResolver),
@@ -188,6 +193,7 @@ class ResolverFactory {
 					this.resolvers.disconnectMyIdentityProviderMutationResolver,
 				),
 				disablePerson: this.resolvers.disablePersonMutationResolver.disablePerson.bind(this.resolvers.disablePersonMutationResolver),
+				enablePerson: this.resolvers.enablePersonMutationResolver.enablePerson.bind(this.resolvers.enablePersonMutationResolver),
 				forceSignOutPerson: this.resolvers.forceSignOutMutationResolver.forceSignOutPerson.bind(this.resolvers.forceSignOutMutationResolver),
 				resetPersonMfa: this.resolvers.resetPersonMfaMutationResolver.resetPersonMfa.bind(this.resolvers.resetPersonMfaMutationResolver),
 				revokeSession: this.resolvers.revokeSessionMutationResolver.revokeSession.bind(this.resolvers.revokeSessionMutationResolver),

package/src/resolvers/mutation/person/DisablePersonMutationResolver.ts

@@ -11,7 +11,7 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 	) {}
 
 	async disablePerson(
-		parent: any,
+		parent: unknown,
 		args: MutationDisablePersonArgs,
 		context: TenantResolverContext,
 	): Promise<DisablePersonResponse> {
@@ -32,11 +32,11 @@ export class DisablePersonMutationResolver implements MutationResolvers {
 			message: 'You are not allowed to disable person account',
 		})
 
-		const result = await this.personAccessManager.disablePerson(context.db, targetPerson)
+		const result = await this.personAccessManager.disablePerson(context.db, targetPerson, context.logger)
 		await context.logAuthAction({
 			type: 'person_disable',
 			response: result,
-			personId: targetPerson.id,
+			targetPersonId: targetPerson.id,
 		})
 		if (!result.ok) {
 			return createErrorResponse(result.error, result.errorMessage)

package/src/resolvers/mutation/person/EnablePersonMutationResolver.ts

@@ -0,0 +1,50 @@
+import { EnablePersonResponse, MutationEnablePersonArgs, MutationResolvers } from '../../../schema/index.js'
+import { TenantResolverContext } from '../../TenantResolverContext.js'
+import { PermissionActions, PersonAccessManager } from '../../../model/index.js'
+import { PersonManager } from '../../../model/service/PersonManager.js'
+import { createErrorResponse } from '../../errorUtils.js'
+
+export class EnablePersonMutationResolver implements MutationResolvers {
+	constructor(
+		private readonly personAccessManager: PersonAccessManager,
+		private readonly personManager: PersonManager,
+	) {}
+
+	async enablePerson(
+		parent: unknown,
+		args: MutationEnablePersonArgs,
+		context: TenantResolverContext,
+	): Promise<EnablePersonResponse> {
+		const targetPerson = await this.personManager.findPersonById(context.db, args.personId)
+
+		if (targetPerson === null) {
+			return {
+				ok: false,
+				error: {
+					code: 'PERSON_NOT_FOUND',
+					developerMessage: `Person <${args.personId}> was not found`,
+				},
+			}
+		}
+
+		// Enabling is the inverse of disabling, so it is the same privilege — a separate resource/privilege pair would need an ACL change everywhere.
+		await context.requireAccess({
+			action: PermissionActions.PERSON_DISABLE(targetPerson.roles),
+			message: 'You are not allowed to enable person account',
+		})
+
+		const result = await this.personAccessManager.enablePerson(context.db, targetPerson)
+		await context.logAuthAction({
+			type: 'person_enable',
+			response: result,
+			targetPersonId: targetPerson.id,
+		})
+		if (!result.ok) {
+			return createErrorResponse(result.error, result.errorMessage)
+		}
+
+		return {
+			ok: true,
+		}
+	}
+}

package/src/resolvers/mutation/person/IDPMutationResolver.ts

@@ -9,6 +9,7 @@ import { TenantResolverContext } from '../../TenantResolverContext.js'
 import { IDPSignInManager, PermissionActions } from '../../../model/index.js'
 import { createErrorResponse } from '../../errorUtils.js'
 import { SignInResponseFactory } from '../../responseHelpers/SignInResponseFactory.js'
+import { ResponseOk } from '../../../model/utils/Response.js'
 
 export class IDPMutationResolver implements MutationResolvers {
 	constructor(
@@ -59,6 +60,36 @@ export class IDPMutationResolver implements MutationResolvers {
 			type: 'idp_login',
 			response: signIn,
 		})
+		// A09 — audit claim-mapping membership sync separately from the login itself, with a plain
+		// `{ before, after }` diff. Emitted only when the mapping actually changed grants on this
+		// sign-in (the manager returns null otherwise).
+		if (signIn.ok && signIn.result.claimMappingAudit) {
+			const audit = signIn.result.claimMappingAudit
+			await context.logAuthAction({
+				type: 'idp_role_mapped',
+				response: new ResponseOk(null),
+				personId: signIn.result.person.id,
+				// the membership change affects the signing-in person — record it as the target too, so it
+				// surfaces in target_person_id audit queries like the other project_membership_* events.
+				targetPersonId: signIn.result.person.id,
+				identityProviderId: signIn.result.identityProviderId,
+				// the audit object IS the event payload ({ before, after, syncPolicy, unmatched }); pass it
+				// whole so the shape is single-sourced from ClaimMappingAudit (the refresh path does the same).
+				eventData: audit,
+			})
+		}
+		// A09 fail-open marker: the mapping was configured but its evaluation/apply failed and was
+		// skipped so sign-in could proceed. Audited (no claim values in the payload) so a broken
+		// mapping is visible to the operator instead of silently never applying.
+		if (signIn.ok && signIn.result.claimMappingFailed) {
+			await context.logAuthAction({
+				type: 'idp_role_mapping_failed',
+				response: new ResponseOk(null),
+				personId: signIn.result.person.id,
+				targetPersonId: signIn.result.person.id,
+				identityProviderId: signIn.result.identityProviderId,
+			})
+		}
 		if (!signIn.ok) {
 			return createErrorResponse(signIn.error, signIn.errorMessage)
 		}