@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/types/utils/Mailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAApD,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW;IAEjF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQtF;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAIzC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgB1D;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,KAAG,MAQrD,CAAA"}
+{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAjF,YAA6B,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW,EAAI;IAErF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOrF;CACD;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHzB,YACkB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAErD;IAEY,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAezD;CACD;AAED,eAAO,MAAM,YAAY,YAAa,aAAa,KAAG,MAQrD,CAAA"}

package/dist/types/utils/TemplateRenderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAGvF"}
+{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtF;CACD"}

package/dist/types/utils/array.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EACvG,OAAO,IAAI,EAAE,EACb,KAAK,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}
+{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,SAChG,IAAI,EAAE,OACR,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}

package/dist/types/utils/batchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAChD,yBAAyB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAC3D,IAAI,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}
+{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,WAAW,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,2BACvB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MACvD,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.3",
+  "version": "2.2.0-alpha.5",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.3",
-    "@contember/config-loader": "2.2.0-alpha.3",
-    "@contember/database": "2.2.0-alpha.3",
-    "@contember/database-migrations": "2.2.0-alpha.3",
-    "@contember/dic": "2.2.0-alpha.3",
-    "@contember/graphql-utils": "2.2.0-alpha.3",
-    "@contember/logger": "2.2.0-alpha.3",
-    "@contember/schema": "2.2.0-alpha.3",
-    "@contember/schema-utils": "2.2.0-alpha.3",
-    "@contember/typesafe": "2.2.0-alpha.3",
+    "@contember/authorization": "2.2.0-alpha.5",
+    "@contember/config-loader": "2.2.0-alpha.5",
+    "@contember/database": "2.2.0-alpha.5",
+    "@contember/database-migrations": "2.2.0-alpha.5",
+    "@contember/dic": "2.2.0-alpha.5",
+    "@contember/graphql-utils": "2.2.0-alpha.5",
+    "@contember/logger": "2.2.0-alpha.5",
+    "@contember/schema": "2.2.0-alpha.5",
+    "@contember/schema-utils": "2.2.0-alpha.5",
+    "@contember/typesafe": "2.2.0-alpha.5",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.3",
+    "@contember/database-tester": "2.2.0-alpha.5",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/TenantContainer.ts

@@ -20,6 +20,7 @@ import {
 	HCaptchaProvider,
 	Identity,
 	IdentityFactory,
+	IDPClaimSyncService,
 	IDPHandlerRegistry,
 	IDPManager,
 	IdpSessionRevalidator,
@@ -31,6 +32,7 @@ import {
 	OIDCProvider,
 	OtpAuthenticator,
 	OtpManager,
+	PanelAccessResolver,
 	PasswordChangeManager,
 	PasswordResetManager,
 	PermissionContextFactory,
@@ -101,6 +103,7 @@ import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'
 import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'
 import { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'
 import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'
+import { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'
 import { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'
 import { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'
 import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'
@@ -124,6 +127,7 @@ export interface TenantContainer {
 	backchannelLogoutManager: BackchannelLogoutManager
 	signUpManager: SignUpManager
 	projectManager: ProjectManager
+	panelAccessResolver: PanelAccessResolver
 	resolvers: Schema.Resolvers
 	resolverContextFactory: TenantResolverContextFactory
 	authorizator: Authorizator<Identity>
@@ -159,6 +163,7 @@ export class TenantContainerFactory {
 				'backchannelLogoutManager',
 				'projectMemberManager',
 				'projectManager',
+				'panelAccessResolver',
 				'signUpManager',
 				'resolvers',
 				'authorizator',
@@ -183,6 +188,7 @@ export class TenantContainerFactory {
 			.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))
 			.addService('apiKeyService', () => new ApiKeyService())
 			.addService('authPolicyResolver', () => new AuthPolicyResolver())
+			.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))
 			.addService('authLogService', () => new AuthLogService())
 			.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))
 			.addService('idpRegistry', () => {
@@ -192,7 +198,8 @@ export class TenantContainerFactory {
 				idpRegistry.registerHandler('apple', new AppleProvider())
 				return idpRegistry
 			})
-			.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))
+			.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))
+			.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))
 			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
 			.addService('unpersistedApiKeyManager', () =>
 				UnpersistedApiKeyManager.createForRootTokens({
@@ -246,8 +253,11 @@ export class TenantContainerFactory {
 				({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>
 					new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),
 			)
-			.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))
-			.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))
+			.addService(
+				'idpSignInManager',
+				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),
+			)
+			.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))
 			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())
 			.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))
 			.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))
@@ -388,6 +398,10 @@ export class TenantContainerFactory {
 				'disablePersonMutationResolver',
 				({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),
 			)
+			.addService(
+				'enablePersonMutationResolver',
+				({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),
+			)
 			.addService(
 				'forceSignOutMutationResolver',
 				({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),

package/src/migrations/2026-06-18-120000-idp-claim-mapping.ts

@@ -0,0 +1,15 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// A09 — IdP claim mapping. The mapping itself rides inside the existing
+// `identity_provider.configuration` JSONB (`configuration.claimMapping`), so no table or column
+// change is needed. This migration only wires the call sites: the new `idp_role_mapped` audit
+// action emitted when claim-mapping (re)syncs project memberships, and `idp_role_mapping_failed`
+// emitted when a configured mapping failed and was skipped (fail-open).
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapped';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-03-120000-person-enable-auth-log.ts

@@ -0,0 +1,12 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// New enum values are added in their own migration so the values are committed
+// before any later migration (or runtime code) inserts rows using them — a new
+// enum value cannot be used in the same transaction that adds it.
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'person_enable';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-04-120000-config-panel.ts

@@ -0,0 +1,13 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// Who may enter the management panel. Defaults reproduce the pre-config
+// behaviour (super admins and project admins), an empty list means nobody.
+const sql = `
+ALTER TABLE "config"
+	ADD COLUMN "panel_global_roles"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',
+	ADD COLUMN "panel_project_roles" TEXT[] NOT NULL DEFAULT '{admin}';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -62,6 +62,9 @@ import _20260526140000idpsession from './2026-05-26-140000-idp-session.js'
 import _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'
 import _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'
 import _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'
+import _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'
+import _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'
+import _20260804120000configpanel from './2026-08-04-120000-config-panel.js'
 import snapshot from './snapshot.js'
 import { computeTokenHash, Providers } from '../model/index.js'
 import { Logger } from '@contember/logger'
@@ -147,6 +150,9 @@ const migrations = {
 	'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,
 	'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,
 	'2026-06-16-130000-idp-logout': _20260616130000idplogout,
+	'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,
+	'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,
+	'2026-08-04-120000-config-panel': _20260804120000configpanel,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -56,7 +56,10 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -179,6 +182,8 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -14,12 +14,11 @@ export class UpdateConfigurationCommand implements Command<void> {
 		const captcha = this.configuration.captcha
 		const rl = this.configuration.rateLimits
 
-		// Encrypt captcha secret at rest. Empty string clears the value;
-		// non-empty re-encrypts so we always rotate to the latest key version.
+		// Null and omission preserve the stored secret; only an empty string clears it.
 		let captchaSecretCol: Buffer | null | undefined
 		let captchaSecretVersionCol: number | null | undefined
-		if (captcha?.secret !== undefined) {
-			if (captcha.secret === '' || captcha.secret === null) {
+		if (captcha?.secret !== undefined && captcha.secret !== null) {
+			if (captcha.secret === '') {
 				captchaSecretCol = null
 				captchaSecretVersionCol = null
 			} else {
@@ -79,6 +78,8 @@ export class UpdateConfigurationCommand implements Command<void> {
 					rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,
 					rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,
 					rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,
+					panel_global_roles: this.configuration.panel?.globalRoles ?? undefined,
+					panel_project_roles: this.configuration.panel?.projectRoles ?? undefined,
 				} satisfies {
 					[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined
 				},

package/src/model/commands/membership/UpdateProjectMemberCommand.ts

@@ -3,7 +3,7 @@ import { UpdateProjectMemberErrorCode } from '../../../schema/index.js'
 import { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'
 import { SelectBuilder } from '@contember/database'
 import { MembershipUpdateInput } from './types.js'
-import { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'
+import { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'
 import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'
 
 export class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {

package/src/model/commands/membership/index.ts

@@ -1,6 +1,7 @@
 export * from './AddProjectMemberCommand.js'
 export * from './CreateOrUpdateProjectMembershipCommand.js'
 export * from './RemoveProjectMemberCommand.js'
+export * from './RemoveProjectMembershipCommand.js'
 export * from './UpdateProjectMemberCommand.js'
-export * from './variables/PatchProjectMembershipVariablesCommand.js'
+export * from './variables/index.js'
 export * from './types.js'

package/src/model/commands/membership/variables/index.ts

@@ -1 +1,2 @@
 export * from './PatchProjectMembershipVariablesCommand.js'
+export * from './SetProjectMembershipVariableValuesCommand.js'

package/src/model/commands/person/EnablePersonCommand.ts

@@ -0,0 +1,18 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+export class EnablePersonCommand implements Command<void> {
+	constructor(private readonly personId: string) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await UpdateBuilder.create()
+			.table('person')
+			.values({
+				disabled_at: null,
+			})
+			.where({
+				id: this.personId,
+			})
+			.execute(db)
+	}
+}

package/src/model/queries/configuration/ConfigurationQuery.ts

@@ -96,6 +96,10 @@ export class ConfigurationQuery extends DatabaseQuery<Config> {
 					window: result.rate_limit_email_verification_per_ip_window,
 				},
 			},
+			panel: {
+				globalRoles: result.panel_global_roles,
+				projectRoles: result.panel_project_roles,
+			},
 		}
 	}
 }

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -50,6 +50,7 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 
 				return qb
 			})
+			.orderBy(['identity', 'id'])
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)
 			.getResult(db)
 	}

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -17,6 +17,7 @@ export class PersonQueryBuilderFactory {
 			.select(expr => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), 'email_otp_enabled')
 			.select(['person', 'passwordless_enabled'])
 			.select(['person', 'email_verified_at'])
+			.select(['person', 'disabled_at'])
 			.from('person')
 			.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))
 	}

package/src/model/queries/person/types.ts

@@ -36,4 +36,5 @@ export interface PersonListRow {
 	readonly email_otp_enabled: boolean
 	readonly passwordless_enabled: boolean | null
 	readonly email_verified_at: Date | null
+	readonly disabled_at: Date | null
 }

package/src/model/service/AuthLogService.ts

@@ -3,6 +3,18 @@ import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntr
 import { Response } from '../utils/Response.js'
 import { AuthActionType } from '../type/AuthLog.js'
 import { JSONValue } from '@contember/schema'
+import { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'
+
+/**
+ * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a
+ * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort
+ * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is
+ * still recorded, just not as a reference.
+ */
+const invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>
+	isUnpersistedIdentityId(identityId)
+		? { metadata: { invokedByUnpersistedIdentityId: identityId } }
+		: { invokedById: identityId }
 
 class AuthLogService {
 	async logAuthAction(
@@ -37,13 +49,15 @@ class AuthLogService {
 		if (ctx.forwarderUserAgent !== undefined) {
 			metadata.forwarderUserAgent = ctx.forwarderUserAgent
 		}
+		const invoker = invokedBy(ctx.identityId)
+		Object.assign(metadata, invoker.metadata)
 
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				success: data.response.ok,
 				personInputIdentifier: data.personInput ?? authData?.data?.personInput,
 				personId: data.personId ?? authData?.data?.personId,
-				invokedById: ctx.identityId,
+				invokedById: invoker.invokedById,
 				type: data.type,
 				identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
 				errorCode: data.response.ok ? null : data.response.error,
@@ -77,10 +91,12 @@ class AuthLogService {
 			eventData?: JSONValue
 		},
 	): Promise<void> {
+		const invoker = invokedBy(entry.identityId)
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				type: entry.type,
-				invokedById: entry.identityId,
+				invokedById: invoker.invokedById,
+				metadata: invoker.metadata,
 				personId: entry.personId ?? undefined,
 				success: entry.success,
 				ipAddress: entry.ipAddress,

package/src/model/service/IDPSignInManager.ts

@@ -11,11 +11,14 @@ import { TenantRole } from '../authorization/index.js'
 import { NoPassword } from '../dtos/index.js'
 import { IdentityProviderRow } from '../queries/idp/types.js'
 import { AuthLogService } from './AuthLogService.js'
+import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'
+import { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'
 
 class IDPSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
 		private readonly idpRegistry: IDPHandlerRegistry,
+		private readonly claimSyncService: IDPClaimSyncService,
 	) {}
 
 	async signInIDP(
@@ -85,6 +88,40 @@ class IDPSignInManager {
 				})
 			}
 
+			// A09 — map IdP claims to project memberships. Returns a `{ before, after }` delta only
+			// when something actually changed; the resolver emits the `idp_role_mapped` audit from it
+			// (audit stays at the resolver layer).
+			//
+			// Fail-open on a MALFORMED/out-of-band `claimMapping`: parsing is caught so a bad config can
+			// never lock the user out — sign-in proceeds without claim mapping and the resolver emits an
+			// `idp_role_mapping_failed` marker. A DB error during the apply itself is NOT caught: it
+			// propagates and rolls back the whole sign-in transaction, so a half-applied set of grants is
+			// never committed (failing sign-in on an infra error is the safe outcome).
+			let mapping: ClaimMapping | null = null
+			let claimMappingFailed = false
+			try {
+				mapping = parseClaimMapping(provider.configuration)
+			} catch {
+				claimMappingFailed = true
+			}
+			let claimMappingAudit: ClaimMappingAudit | null = null
+			if (mapping) {
+				const syncResult = await this.claimSyncService.sync(
+					db,
+					mapping,
+					claim,
+					{ id: personRow.identity_id },
+					resolved.isNewPerson === true,
+				)
+				claimMappingAudit = syncResult.audit
+				// The apply-time safety backstop dropped a configured rule (config-time validation was skipped, or
+				// the project's ACL drifted since): surface the same fail-open marker as a malformed config, so a
+				// silently-unapplied grant is visible to the operator. The resolver emits `idp_role_mapping_failed`.
+				if (syncResult.droppedUnsafeRules) {
+					claimMappingFailed = true
+				}
+			}
+
 			const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
 				db,
 				personRow.identity_id,
@@ -129,6 +166,9 @@ class IDPSignInManager {
 				person: personRow,
 				token: sessionToken,
 				idpResponse: claim,
+				claimMappingAudit,
+				claimMappingFailed,
+				identityProviderId: provider.id,
 				[AuthLogService.Key]: new AuthLogService.Bag({
 					personId: personRow.id,
 					identityProviderId: provider.id,
@@ -194,7 +234,7 @@ class IDPSignInManager {
 		if (provider.autoSignUp) {
 			const signedUpPerson = await this.signUp(db, claim, provider)
 			await this.saveIdpIdentifier(db, provider, claim, signedUpPerson)
-			return { person: signedUpPerson }
+			return { person: signedUpPerson, isNewPerson: true }
 		}
 
 		return { person: null }
@@ -229,6 +269,8 @@ namespace IDPSignInManager {
 		readonly person: PersonRow | null
 		readonly blockedReason?: 'idp_email_unverified'
 		readonly blockedPersonId?: string
+		/** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */
+		readonly isNewPerson?: boolean
 	}
 
 	export type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>
@@ -237,6 +279,12 @@ namespace IDPSignInManager {
 		readonly person: PersonRow
 		readonly token: string
 		readonly idpResponse?: Record<string, unknown>
+		/** Identity provider the sign-in went through (for the resolver's audit). */
+		readonly identityProviderId?: string
+		/** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */
+		readonly claimMappingAudit?: ClaimMappingAudit | null
+		/** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */
+		readonly claimMappingFailed?: boolean
 		[AuthLogService.Key]: AuthLogService.Bag
 	}
 

package/src/model/service/PanelAccessResolver.ts

@@ -0,0 +1,32 @@
+import { DatabaseContext } from '../utils/index.js'
+import { AllProjectRolesByIdentityQuery, ConfigurationQuery } from '../queries/index.js'
+import { Providers } from '../providers.js'
+
+/**
+ * Decides whether an identity may enter the management panel served by the engine.
+ *
+ * This is an **entry gate for the console, not an authorization system**: everything the panel shows
+ * still goes through the tenant ACL, and whoever gets in could equally call `/tenant` directly. Its
+ * job is to keep the console door shut for accounts that have no business there, so an admin surface
+ * on a public API port does not look like a leak.
+ *
+ * An identity is allowed when it holds one of `globalRoles`, or a membership with one of
+ * `projectRoles` in **any** project. Empty lists mean nobody.
+ */
+export class PanelAccessResolver {
+	constructor(private readonly providers: Providers) {}
+
+	async isAllowed(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<boolean> {
+		const config = await db.queryHandler.fetch(new ConfigurationQuery(this.providers))
+		const policy = config.panel
+
+		if (policy.globalRoles.some(role => globalRoles.includes(role))) {
+			return true
+		}
+		if (policy.projectRoles.length === 0) {
+			return false
+		}
+		const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))
+		return projectRoles.some(it => policy.projectRoles.includes(it.role))
+	}
+}

package/src/model/service/PersonAccessManager.ts

@@ -1,14 +1,18 @@
+import { Logger } from '@contember/logger'
 import { PersonQuery, PersonRow } from '../queries/index.js'
 import { DatabaseContext } from '../utils/index.js'
 import { DisablePersonCommand } from '../commands/person/DisablePersonCommand.js'
+import { EnablePersonCommand } from '../commands/person/EnablePersonCommand.js'
 import { ApiKeyManager } from './apiKey/index.js'
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
-import { DisablePersonErrorCode } from '../../schema/index.js'
+import { DisablePersonErrorCode, EnablePersonErrorCode } from '../../schema/index.js'
 
 class PersonAccessManager {
 	constructor(private readonly apiKeyManager: ApiKeyManager) {}
 
-	async disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {
+	async disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse> {
+		// Retried: the api_key update races the target's own background session tracking and loses with a 40001,
+		// which would otherwise leave the person enabled behind an internal error. Nothing here escapes the transaction.
 		return await dbContext.transaction(async trx => {
 			if (person.disabled_at !== null) {
 				return new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')
@@ -19,7 +23,18 @@ class PersonAccessManager {
 			await this.disableIdentityApiKeys(trx, person.identity_id)
 
 			return new ResponseOk(null)
-		})
+		}, { retry: { logger } })
+	}
+
+	async enablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonEnableAccessResponse> {
+		if (person.disabled_at === null) {
+			return new ResponseError('PERSON_ALREADY_ENABLED', 'Person is already enabled')
+		}
+
+		// Only clears the disabled flag — api keys revoked while disabling stay revoked, the person has to sign in again.
+		await dbContext.commandBus.execute(new EnablePersonCommand(person.id))
+
+		return new ResponseOk(null)
 	}
 
 	private async disablePersonAccount(dbContext: DatabaseContext, personId: string) {
@@ -32,5 +47,6 @@ class PersonAccessManager {
 }
 
 export type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>
+export type PersonEnableAccessResponse = Response<null, EnablePersonErrorCode>
 
 export { PersonAccessManager }

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -127,8 +127,10 @@ export class ApiKeyManager {
 			}
 		}
 
-		setImmediate(async () => {
-			await dbContext.commandBus.execute(
+		// Detached (runs after the response), so a rejection here would be an unhandledRejection and can take the
+		// worker down. Tracking is best-effort — the next request writes it again.
+		setImmediate(() => {
+			dbContext.commandBus.execute(
 				new ProlongApiKeyCommand(
 					apiKeyRow.id,
 					apiKeyRow.type,
@@ -142,7 +144,7 @@ export class ApiKeyManager {
 					},
 					apiKeyRow.max_expires_at,
 				),
-			)
+			).catch(() => {})
 		})
 
 		return new ResponseOk(

package/src/model/service/apiKey/UnpersistedApiKeyManager.ts

@@ -10,6 +10,30 @@ import { VerifyResult } from './ApiKeyManager.js'
  */
 export const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'
 
+/**
+ * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the
+ * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in
+ * memory, so the surface it opens is fixed by this file rather than by whatever token an operator
+ * happened to configure.
+ */
+export const UNPERSISTED_LOGIN_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000002'
+
+const unpersistedIdentityIds: ReadonlySet<string> = new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID])
+
+/**
+ * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.
+ * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.
+ */
+export const isUnpersistedIdentityId = (identityId: string | undefined): boolean => identityId !== undefined && unpersistedIdentityIds.has(identityId)
+
+/**
+ * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to
+ * present: the surface is reached by being routed there, so nothing is compared and nothing is read
+ * from the database.
+ */
+export const createUnpersistedLoginVerifyResult = (): VerifyResult =>
+	new VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [TenantRole.LOGIN], null, false)
+
 export interface UnpersistedApiKey {
 	readonly tokenHash: TokenHash
 	readonly identityId: string