@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/tests/cases/unit/idp/idpSessionRevalidator.test.ts

@@ -1,15 +1,28 @@
 import { describe, expect, test } from 'bun:test'
-import { IDPHandlerRegistry, IdpSessionRevalidator, RevalidationResult } from '../../../../src/model/service/idp/index.js'
+import { IDPClaimSyncService, IDPHandlerRegistry, IdpSessionRevalidator, RevalidationResult } from '../../../../src/model/service/idp/index.js'
 import { IdpSessionRow } from '../../../../src/model/queries/idp/IdpSessionByApiKeyQuery.js'
 import { DatabaseContext } from '../../../../src/index.js'
 import { ClaimIdpRevalidationCommand } from '../../../../src/model/commands/idp/ClaimIdpRevalidationCommand.js'
-import { DisableApiKeyCommand } from '../../../../src/model/commands/index.js'
+import { CreateOrUpdateProjectMembershipCommand, DisableApiKeyCommand, RemoveProjectMembershipCommand } from '../../../../src/model/commands/index.js'
 import { UpdateIdpSessionCommand } from '../../../../src/model/commands/idp/UpdateIdpSessionCommand.js'
 import { CreateAuthLogEntryCommand } from '../../../../src/model/commands/authLog/CreateAuthLogEntryCommand.js'
+import { ProjectBySlugQuery, ProjectMembershipByIdentityQuery } from '../../../../src/model/queries/index.js'
+import { Schema } from '@contember/schema'
+import { emptySchema } from '@contember/schema-utils'
 
 const NOW = new Date('2026-05-26T12:00:00Z')
 const t = (iso: string) => new Date(`2026-05-26T${iso}Z`)
 
+// All production constructions take the claim-sync service; it is stateless, so a fresh instance per
+// revalidator is fine. Tests that don't configure a claimMapping never reach it. The claim-sync service
+// resolves the project schema for its apply-time safety check: a project that EXISTS but whose schema can't
+// be resolved is now fail-closed (the grant is dropped — see IDPClaimSyncService.dropUnsafeRules). The
+// happy-path claim tests below grant the plain `editor` role on the existing `demo` project, so they need a
+// resolvable schema that defines that role (otherwise the apply-time backstop would drop the grant).
+const claimSyncSchema: Schema = { ...emptySchema, acl: { roles: { editor: { stages: '*', entities: {}, variables: {} } } } }
+const makeRevalidator = (registry: IDPHandlerRegistry) =>
+	new IdpSessionRevalidator(registry, new IDPClaimSyncService({ getSchema: () => Promise.resolve(claimSyncSchema) }))
+
 const apiKeyRow: any = {
 	id: 'api-key-1',
 	identity_id: 'identity-1',
@@ -73,13 +86,13 @@ const tick = () => new Promise(resolve => setImmediate(resolve))
 describe('IdpSessionRevalidator — gating', () => {
 	test('no federated session → valid, no commands', async () => {
 		const h = createHarness(null)
-		expect(await new IdpSessionRevalidator(registryWith()).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe('valid')
+		expect(await makeRevalidator(registryWith()).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe('valid')
 		expect(h.executed).toHaveLength(0)
 	})
 
 	test('revalidation disabled → valid', async () => {
 		const h = createHarness(baseRow({ providerConfiguration: { revalidation: { enabled: false } } }))
-		expect(await new IdpSessionRevalidator(registryWith(async () => ({ status: 'valid' }))).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe(
+		expect(await makeRevalidator(registryWith(async () => ({ status: 'valid' }))).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe(
 			'valid',
 		)
 		expect(h.executed).toHaveLength(0)
@@ -87,7 +100,7 @@ describe('IdpSessionRevalidator — gating', () => {
 
 	test('provider disabled → revoked', async () => {
 		const h = createHarness(baseRow({ providerDisabledAt: t('11:30:00') }))
-		expect(await new IdpSessionRevalidator(registryWith(async () => ({ status: 'valid' }))).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe(
+		expect(await makeRevalidator(registryWith(async () => ({ status: 'valid' }))).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe(
 			'revoked',
 		)
 		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(true)
@@ -95,7 +108,7 @@ describe('IdpSessionRevalidator — gating', () => {
 
 	test('provider cannot revalidate → valid', async () => {
 		const h = createHarness(baseRow())
-		expect(await new IdpSessionRevalidator(registryWith(/* no revalidate */)).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe('valid')
+		expect(await makeRevalidator(registryWith(/* no revalidate */)).revalidate(h.dbContext, h.readDbContext, apiKeyRow)).toBe('valid')
 		expect(h.executed).toHaveLength(0)
 	})
 })
@@ -105,7 +118,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 		let called = false
 		// obtained 11:55, expires 13:55 → softAt = 12:55 > NOW
 		const h = createHarness(baseRow({ tokenObtainedAt: t('11:55:00'), session: { tokens: { refresh_token: 'r' }, expiresAt: t('13:55:00') } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			called = true
 			return { status: 'valid' }
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
@@ -117,7 +130,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 	test('soft window → background (SWR): valid immediately, refresh after the response', async () => {
 		let called = false
 		const h = createHarness(baseRow()) // soft phase
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			called = true
 			return { status: 'revoked', reason: 'invalid_grant' }
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
@@ -132,7 +145,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 	test('expired token → blocking: revoked returned synchronously', async () => {
 		// expires 11:30 (past), obtained 10:00 → hard
 		const h = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
+		const out = await makeRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
 			.revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('revoked')
 		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(true)
@@ -148,7 +161,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 
 	test('expired token + valid refresh → valid, persists rotated session', async () => {
 		const h = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		const out = await new IdpSessionRevalidator(
+		const out = await makeRevalidator(
 			registryWith(async () => ({ status: 'valid', idpSession: { tokens: { refresh_token: 'new' }, expiresAt: t('13:30:00') } })),
 		)
 			.revalidate(h.dbContext, h.readDbContext, apiKeyRow)
@@ -179,7 +192,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 			queryHandler: { fetch: async () => baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }) }, // expired → blocking
 		} as unknown as DatabaseContext
 
-		const out = await new IdpSessionRevalidator(
+		const out = await makeRevalidator(
 			registryWith(async () => ({ status: 'valid', idpSession: { tokens: { refresh_token: 'new' }, expiresAt: t('13:30:00') } })),
 		).revalidate(ctx, ctx, apiKeyRow)
 		expect(out).toBe('valid')
@@ -189,7 +202,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 
 	test('mode=blocking forces synchronous revoke even in the soft window', async () => {
 		const h = createHarness(baseRow({ providerConfiguration: { revalidation: { enabled: true, mode: 'blocking' } } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
+		const out = await makeRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
 			.revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('revoked')
 		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(true)
@@ -198,7 +211,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 	test('no token expiry → fallback background throttle (revalidates, deferred)', async () => {
 		let called = false
 		const h = createHarness(baseRow({ tokenObtainedAt: null, session: { sessionId: 's', tokens: { access_token: 'a' }, expiresAt: undefined } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			called = true
 			return { status: 'valid' }
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
@@ -211,7 +224,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 	test('throttled (claim lost) → valid, revalidate not called', async () => {
 		let called = false
 		const h = createHarness(baseRow(), { claim: false })
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			called = true
 			return { status: 'valid' }
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
@@ -222,7 +235,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 
 	test('transient IdP failure in blocking phase → valid (fail open, no revoke)', async () => {
 		const h = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			throw new Error('ECONNREFUSED')
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('valid')
@@ -240,7 +253,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 			},
 			revalidate: async () => ({ status: 'revoked', reason: 'invalid_grant' }),
 		})
-		const out = await new IdpSessionRevalidator(registry).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
+		const out = await makeRevalidator(registry).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('valid')
 		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(false)
 	})
@@ -249,7 +262,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 describe('IdpSessionRevalidator — audit logging', () => {
 	test('token rotation is audited as idp_session_revalidated', async () => {
 		const h = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		await new IdpSessionRevalidator(
+		await makeRevalidator(
 			registryWith(async () => ({ status: 'valid', idpSession: { tokens: { refresh_token: 'new' }, expiresAt: t('13:30:00') } })),
 		).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		const log = h.executed.find(c => c instanceof CreateAuthLogEntryCommand) as CreateAuthLogEntryCommand | undefined
@@ -262,14 +275,14 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		const reqInfo = { ip: '203.0.113.7', userAgent: 'Mozilla/5.0 test' }
 
 		const revoked = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		await new IdpSessionRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
+		await makeRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
 			.revalidate(revoked.dbContext, revoked.readDbContext, apiKeyRow, reqInfo)
 		const revokeLog = revoked.executed.find(c => c instanceof CreateAuthLogEntryCommand) as any
 		expect(revokeLog.data.ipAddress).toBe('203.0.113.7')
 		expect(revokeLog.data.userAgent).toBe('Mozilla/5.0 test')
 
 		const rotated = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		await new IdpSessionRevalidator(
+		await makeRevalidator(
 			registryWith(async () => ({ status: 'valid', idpSession: { tokens: { refresh_token: 'new' }, expiresAt: t('13:30:00') } })),
 		).revalidate(rotated.dbContext, rotated.readDbContext, apiKeyRow, reqInfo)
 		const rotateLog = rotated.executed.find(c => c instanceof CreateAuthLogEntryCommand) as any
@@ -280,7 +293,7 @@ describe('IdpSessionRevalidator — audit logging', () => {
 	test('transient IdP failure (fail open) is audited as idp_session_revalidation_failed / revalidation_error', async () => {
 		// expired → blocking, so the failure audit runs synchronously
 		const h = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			throw new Error('ECONNREFUSED')
 		})).revalidate(h.dbContext, h.readDbContext, apiKeyRow, { ip: '203.0.113.7', userAgent: 'UA' })
 		expect(out).toBe('valid')
@@ -304,7 +317,7 @@ describe('IdpSessionRevalidator — audit logging', () => {
 			},
 			revalidate: async () => ({ status: 'revoked', reason: 'invalid_grant' }),
 		})
-		const out = await new IdpSessionRevalidator(registry).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
+		const out = await makeRevalidator(registry).revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('valid')
 		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(false)
 		const log = h.executed.find(c => c instanceof CreateAuthLogEntryCommand) as any
@@ -333,7 +346,7 @@ describe('IdpSessionRevalidator — audit logging', () => {
 			commandBus,
 			queryHandler: { fetch: async () => baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }) },
 		} as unknown as DatabaseContext
-		const out = await new IdpSessionRevalidator(registryWith(async () => {
+		const out = await makeRevalidator(registryWith(async () => {
 			throw new Error('ECONNREFUSED')
 		})).revalidate(ctx, ctx, apiKeyRow)
 		expect(out).toBe('valid')
@@ -343,7 +356,7 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		// userinfo / introspection return valid without an idpSession; logging every such tick
 		// (every minInterval) would flood the audit log, so it must stay silent.
 		const h = createHarness(baseRow({ session: { tokens: { access_token: 'a' }, expiresAt: t('11:30:00') } }))
-		const out = await new IdpSessionRevalidator(registryWith(async () => ({ status: 'valid' })))
+		const out = await makeRevalidator(registryWith(async () => ({ status: 'valid' })))
 			.revalidate(h.dbContext, h.readDbContext, apiKeyRow)
 		expect(out).toBe('valid')
 		expect(h.executed.some(c => c instanceof CreateAuthLogEntryCommand)).toBe(false)
@@ -374,7 +387,7 @@ describe('IdpSessionRevalidator — audit logging', () => {
 				queryHandler: { fetch: async () => baseRow() }, // soft phase → background (SWR)
 			} as unknown as DatabaseContext
 
-			const out = await new IdpSessionRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
+			const out = await makeRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })))
 				.revalidate(ctx, ctx, apiKeyRow)
 			expect(out).toBe('valid') // served from the still-valid token
 			await tick()
@@ -385,3 +398,192 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		}
 	})
 })
+
+describe('IdpSessionRevalidator — A09 claim mapping on refresh', () => {
+	// Expired token → blocking refresh that returns fresh claims; the row carries an `always` claim
+	// mapping granting `demo::editor` when `department === 'Editorial'`.
+	const expiredSession = { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') }
+	const claimMappingRow = (claimMapping: unknown) =>
+		baseRow({ session: expiredSession, providerConfiguration: { revalidation: { enabled: true }, claimMapping } })
+
+	// A query-/transaction-aware harness: the claim sync runs its real reads/writes against this mock.
+	// `ProjectMembershipByIdentityQuery` returns [] the first time (before snapshot) and the granted
+	// membership the second time (after snapshot), so the before/after delta is non-empty.
+	const claimHarness = (row: IdpSessionRow, opts: { failTransaction?: boolean } = {}) => {
+		const executed: any[] = []
+		let membershipFetches = 0
+		const inner: any = {
+			providers: { now: () => NOW },
+			commandBus: {
+				execute: async (command: any) => {
+					executed.push(command)
+					if (command instanceof ClaimIdpRevalidationCommand) {
+						return true
+					}
+					if (command instanceof CreateOrUpdateProjectMembershipCommand) {
+						return 'membership-1'
+					}
+					return undefined
+				},
+			},
+			queryHandler: {
+				fetch: async (query: any) => {
+					if (query instanceof ProjectBySlugQuery) {
+						return { id: 'proj-1', slug: 'demo', name: 'demo', config: {} }
+					}
+					if (query instanceof ProjectMembershipByIdentityQuery) {
+						membershipFetches++
+						return membershipFetches === 1 ? [] : [{ role: 'editor', variables: [] }]
+					}
+					// IdpSessionByApiKeyQuery (and anything else) → the federated-session row
+					return row
+				},
+			},
+		}
+		inner.transaction = opts.failTransaction
+			? async () => {
+				throw new Error('claim-sync tx failed')
+			}
+			: async (cb: (db: any) => Promise<unknown>) => cb(inner)
+		return { ctx: inner as unknown as DatabaseContext, executed }
+	}
+
+	const validWithClaims = (claims: Record<string, unknown>, claimsComplete = false) =>
+		registryWith(async () => ({ status: 'valid', claims, claimsComplete }))
+
+	test('always mapping + fresh claims → re-applies the membership and audits idp_role_mapped', async () => {
+		const claimMapping = { rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }] }
+		const h = claimHarness(claimMappingRow(claimMapping))
+		const out = await makeRevalidator(validWithClaims({ department: 'Editorial' })).revalidate(h.ctx, h.ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(h.executed.some(c => c instanceof CreateOrUpdateProjectMembershipCommand)).toBe(true)
+		const log = h.executed.find(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapped') as any
+		expect(log).toBeDefined()
+		expect(log.data.success).toBe(true)
+		expect(log.data.eventData.after.memberships).toEqual([{ project: 'demo', role: 'editor', variables: [] }])
+	})
+
+	test('sticky mapping is skipped on refresh (always-only) — no membership write, no audit', async () => {
+		const claimMapping = {
+			syncPolicy: 'sticky',
+			rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }],
+		}
+		const h = claimHarness(claimMappingRow(claimMapping))
+		const out = await makeRevalidator(validWithClaims({ department: 'Editorial' })).revalidate(h.ctx, h.ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(h.executed.some(c => c instanceof CreateOrUpdateProjectMembershipCommand)).toBe(false)
+		expect(h.executed.some(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapped')).toBe(false)
+	})
+
+	test('claim sync failure is fail-open: session stays valid, audited as idp_role_mapping_failed', async () => {
+		const claimMapping = { rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }] }
+		const h = claimHarness(claimMappingRow(claimMapping), { failTransaction: true })
+		const out = await makeRevalidator(validWithClaims({ department: 'Editorial' })).revalidate(h.ctx, h.ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(false)
+		const log = h.executed.find(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapping_failed') as any
+		expect(log).toBeDefined()
+		expect(log.data.success).toBe(true)
+	})
+
+	test('refresh without fresh claims does not run claim sync', async () => {
+		const claimMapping = { rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }] }
+		const h = claimHarness(claimMappingRow(claimMapping))
+		// revalidate returns valid but with NO claims (e.g. introspection) → nothing to map
+		const out = await makeRevalidator(registryWith(async () => ({ status: 'valid' }))).revalidate(h.ctx, h.ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(h.executed.some(c => c instanceof CreateOrUpdateProjectMembershipCommand)).toBe(false)
+		expect(h.executed.some(c => c instanceof CreateAuthLogEntryCommand)).toBe(false)
+	})
+
+	test('complete surface (method:refresh) + unmatched:remove → revokes on refresh, exactly like sign-in', async () => {
+		// Variant A: a `method: "refresh"` rebuilds sign-in's full claim surface (claimsComplete:true), so refresh
+		// reconciles like a sign-in — a rule that no longer matches strips its membership under `remove`.
+		const claimMapping = {
+			unmatched: 'remove',
+			rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }],
+		}
+		const row = claimMappingRow(claimMapping)
+		const executed: any[] = []
+		let membershipFetches = 0
+		const inner: any = {
+			providers: { now: () => NOW },
+			commandBus: {
+				execute: async (command: any) => {
+					executed.push(command)
+					if (command instanceof ClaimIdpRevalidationCommand) {
+						return true
+					}
+					return undefined
+				},
+			},
+			queryHandler: {
+				fetch: async (query: any) => {
+					if (query instanceof ProjectBySlugQuery) {
+						return { id: 'proj-1', slug: 'demo', name: 'demo', config: {} }
+					}
+					if (query instanceof ProjectMembershipByIdentityQuery) {
+						membershipFetches++
+						// the before-snapshot + the remove reconciliation (reads 1 & 2) still see `editor`; the
+						// after-snapshot (read 3) sees it gone, so the audit delta is non-empty.
+						return membershipFetches <= 2 ? [{ role: 'editor', variables: [] }] : []
+					}
+					return row
+				},
+			},
+		}
+		inner.transaction = async (cb: (db: any) => Promise<unknown>) => cb(inner)
+		const ctx = inner as unknown as DatabaseContext
+		// the claim no longer matches → `editor` is out of the granted set → removed under `remove`
+		const out = await makeRevalidator(validWithClaims({ department: 'Sales' }, true)).revalidate(ctx, ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(executed.filter(c => c instanceof RemoveProjectMembershipCommand)).toHaveLength(1)
+		const log = executed.find(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapped') as any
+		expect(log).toBeDefined()
+		expect(log.data.eventData.before.memberships).toEqual([{ project: 'demo', role: 'editor', variables: [] }])
+		expect(log.data.eventData.after.memberships).toEqual([])
+	})
+
+	test('partial surface (userinfo / failed userinfo) + unmatched:remove → does NOT remove on refresh', async () => {
+		// A partial surface (claimsComplete:false — method:userinfo, or a refresh whose userinfo fetch failed)
+		// stays additive-only: a rule that misses here must not strip a membership the IdP still asserts. Removal
+		// is deferred to a full sign-in, which always sees the complete surface.
+		const claimMapping = {
+			unmatched: 'remove',
+			rules: [{ claim: 'department', equals: 'Editorial', grantMembership: { project: 'demo', role: 'editor' } }],
+		}
+		const row = claimMappingRow(claimMapping)
+		const executed: any[] = []
+		const inner: any = {
+			providers: { now: () => NOW },
+			commandBus: {
+				execute: async (command: any) => {
+					executed.push(command)
+					if (command instanceof ClaimIdpRevalidationCommand) {
+						return true
+					}
+					return undefined
+				},
+			},
+			queryHandler: {
+				fetch: async (query: any) => {
+					if (query instanceof ProjectBySlugQuery) {
+						return { id: 'proj-1', slug: 'demo', name: 'demo', config: {} }
+					}
+					if (query instanceof ProjectMembershipByIdentityQuery) {
+						return [{ role: 'editor', variables: [] }]
+					}
+					return row
+				},
+			},
+		}
+		inner.transaction = async (cb: (db: any) => Promise<unknown>) => cb(inner)
+		const ctx = inner as unknown as DatabaseContext
+		// claimsComplete defaults false → allowRemoval false → keep, so the still-asserted membership is left alone
+		const out = await makeRevalidator(validWithClaims({ department: 'Sales' })).revalidate(ctx, ctx, apiKeyRow)
+		expect(out).toBe('valid')
+		expect(executed.some(c => c instanceof RemoveProjectMembershipCommand)).toBe(false)
+		// nothing changed (removal off, no grant) → no idp_role_mapped audit
+		expect(executed.some(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapped')).toBe(false)
+	})
+})

package/tests/cases/unit/idp/oidcClaims.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, test } from 'bun:test'
+import { liftNestedClaims } from '../../../../src/model/service/idp/providers/OIDCHelpers.js'
+
+// liftNestedClaims is the SHARED claim-normalization used by BOTH the OIDC sign-in response handler
+// (handleOIDCResponse) and the session-refresh path (revalidateOIDC), so an `attributesKey` provider —
+// notably Apereo CAS, which nests its claims under `attributes` — resolves its A09 claim mapping
+// identically at sign-in and on refresh (SEC-2).
+describe('liftNestedClaims', () => {
+	test('no attributesKey → source returned unchanged (same reference)', () => {
+		const source = { sub: '1', groups: ['a'] }
+		expect(liftNestedClaims(source, undefined)).toBe(source)
+	})
+
+	test('lifts a nested attributes object to the top level', () => {
+		expect(liftNestedClaims({ sub: '1', attributes: { department: 'Editorial', groups: ['IT'] } }, 'attributes'))
+			.toEqual({ sub: '1', department: 'Editorial', groups: ['IT'], attributes: { department: 'Editorial', groups: ['IT'] } })
+	})
+
+	test('a signed top-level claim keeps precedence over an attributes-level value of the same name', () => {
+		// nested attributes are UNSIGNED → spread UNDER source, so the top-level (verified) value wins
+		expect(liftNestedClaims({ sub: 'signed', attributes: { sub: 'spoofed' } }, 'attributes').sub).toBe('signed')
+	})
+
+	test('a non-object / array / missing attributesKey value is a no-op', () => {
+		expect(liftNestedClaims({ sub: '1', attributes: 'x' }, 'attributes')).toEqual({ sub: '1', attributes: 'x' })
+		expect(liftNestedClaims({ sub: '1', attributes: ['x'] }, 'attributes')).toEqual({ sub: '1', attributes: ['x'] })
+		expect(liftNestedClaims({ sub: '1' }, 'attributes')).toEqual({ sub: '1' })
+	})
+})

package/tests/cases/unit/idp/oidcResponse.test.ts

@@ -142,3 +142,57 @@ describe('handleOIDCResponse — non-string email/name do not leak', () => {
 		expect(result.email).toBeUndefined()
 	})
 })
+
+describe('handleOIDCResponse — display name', () => {
+	// `name` is optional in OIDC core and several providers (Apereo CAS, Entra ID, Keycloak under its
+	// default mappers) omit it while sending the parts. Without the fallback CreatePersonCommand lands
+	// on its own last-resort default and the person ends up named after their e-mail's local part.
+	test('composes the name from given_name + family_name when there is no `name` claim', async () => {
+		const client = stubClient({ sub: 's', email: 'jan@example.com', given_name: 'Jan', family_name: 'Novák' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.name).toBe('Jan Novák')
+	})
+
+	test('an explicit `name` claim still wins over the parts', async () => {
+		const client = stubClient({ sub: 's', name: 'Jan Novák ml.', given_name: 'Jan', family_name: 'Novák' })
+		const result = await handleOIDCResponse(client, responseData)
+		expect(result.name).toBe('Jan Novák ml.')
+	})
+
+	test('only one part present → that part alone, no stray whitespace', async () => {
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: 'Jan' }), responseData)).name).toBe('Jan')
+		expect((await handleOIDCResponse(stubClient({ sub: 's', family_name: 'Novák' }), responseData)).name).toBe('Novák')
+	})
+
+	test('blank / non-string parts are ignored rather than composed into whitespace', async () => {
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: '  ', family_name: '' }), responseData)).name)
+			.toBeUndefined()
+		expect((await handleOIDCResponse(stubClient({ sub: 's', given_name: ['Jan'], family_name: 3 }), responseData)).name)
+			.toBeUndefined()
+	})
+
+	test('a blank `name` claim falls back to the parts', async () => {
+		const client = stubClient({ sub: 's', name: '   ', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(client, responseData)).name).toBe('Jan Novák')
+	})
+
+	test('an explicitly mapped name claim is honoured as-is — no silent substitution', async () => {
+		// Mapping a claim states where the name lives; falling back to other claims would defeat that.
+		const client = stubClient({ sub: 's', displayName: 'Jan N.', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(client, responseData, { claimMapping: { name: 'displayName' } })).name).toBe('Jan N.')
+		const missing = stubClient({ sub: 's', given_name: 'Jan', family_name: 'Novák' })
+		expect((await handleOIDCResponse(missing, responseData, { claimMapping: { name: 'displayName' } })).name).toBeUndefined()
+	})
+
+	test('the parts are read after attributes-lifting, so a CAS-shaped userinfo works', async () => {
+		const client = stubClient(
+			{ sub: 's' },
+			{ sub: 's', attributes: { given_name: 'Jan', family_name: 'Novák' } },
+		)
+		const result = await handleOIDCResponse(client, responseData, {
+			fetchUserInfo: true,
+			claimMapping: { attributesKey: 'attributes' },
+		})
+		expect(result.name).toBe('Jan Novák')
+	})
+})

package/tests/cases/unit/idp/oidcRevalidate.test.ts

@@ -24,13 +24,70 @@ describe('revalidateOIDC — refresh', () => {
 
 		expect(result.status).toBe('valid')
 		if (result.status === 'valid') {
-			expect(result.claims).toEqual({ sub: 'user-1', email: 'a@b.cz' })
+			// claims are normalized the SAME way sign-in normalizes them (identity fields mapped on top of the
+			// raw claims), so an `always` mapping reconciles against an identical surface on refresh.
+			expect(result.claims).toEqual({ sub: 'user-1', email: 'a@b.cz', externalIdentifier: 'user-1', emailVerified: false })
+			// id_token present + surface rebuilt → complete, so the caller may run `unmatched: "remove"` here too.
+			expect(result.claimsComplete).toBe(true)
 			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-new')
 			expect(result.idpSession?.sessionId).toBe('sid-1')
 			expect(result.idpSession?.expiresAt).toEqual(new Date(1_900_000_000 * 1000))
 		}
 	})
 
+	test('fetchUserInfo: merges userinfo into the refresh surface (same as sign-in)', async () => {
+		// At sign-in, `fetchUserInfo` merges userinfo over the id-token claims; the refresh path does the SAME,
+		// so a rule keyed on a userinfo-only claim (e.g. `groups`) resolves on refresh too.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				access_token: 'access-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'user-1', email: 'a@b.cz' }),
+			}),
+			userinfo: async (token: any) => {
+				expect(token.access_token).toBe('access-new')
+				return { sub: 'user-1', groups: ['IT-Admins'] }
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { fetchUserInfo: true })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect((result.claims as any)?.groups).toEqual(['IT-Admins'])
+			expect((result.claims as any)?.email).toBe('a@b.cz')
+			expect(result.claimsComplete).toBe(true)
+		}
+	})
+
+	test('fetchUserInfo failure → keep session, skip the sync (no claims, surface not complete)', async () => {
+		// The IdP already vouched for the session via the successful refresh; a failed userinfo fetch must not
+		// fail revalidation. Drop the claims so the sync is skipped (and removal can never run off a half-built
+		// surface) and retry on a later refresh.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				access_token: 'access-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'user-1' }),
+			}),
+			userinfo: async () => {
+				throw new Error('userinfo unreachable')
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { fetchUserInfo: true })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect(result.claims).toBeUndefined()
+			expect(result.claimsComplete).toBe(false)
+			// the session is still kept (rotated token persisted)
+			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-new')
+		}
+	})
+
 	test('non-rotating IdP: refresh omits the refresh token → keep the stored one (no spurious revoke)', async () => {
 		// RFC 6749 §6 — a refresh response MAY omit refresh_token; the client keeps the old one.
 		const client = {
@@ -78,6 +135,28 @@ describe('revalidateOIDC — refresh', () => {
 		} as any
 		await expect(revalidateOIDC(client, 'refresh', session({ refresh_token: 'x' }))).rejects.toThrow('ECONNREFUSED')
 	})
+
+	test('attributesKey: nested claims are lifted to the top level on the refresh path (same as sign-in)', async () => {
+		// A09 (SEC-2): an `attributesKey` provider (e.g. Apereo CAS) nests its claims under `attributes`; the
+		// `claimMapping` option wires that lift into `revalidateOIDC` so its mapping resolves identically on refresh.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'signed', attributes: { groups: ['IT-Admins'], sub: 'spoofed' } }),
+			}),
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { claimMapping: { attributesKey: 'attributes' } })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			// the nested `groups` is surfaced top-level for rule matching…
+			expect((result.claims as any)?.groups).toEqual(['IT-Admins'])
+			// …while a signed top-level claim keeps precedence over an attributes-level value of the same name
+			expect((result.claims as any)?.sub).toBe('signed')
+		}
+	})
 })
 
 describe('revalidateOIDC — userinfo', () => {
@@ -91,7 +170,20 @@ describe('revalidateOIDC — userinfo', () => {
 		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'access-1' }))
 		expect(result.status).toBe('valid')
 		if (result.status === 'valid') {
-			expect(result.claims).toEqual({ sub: 'user-1', groups: ['admins'] })
+			expect(result.claims).toEqual({ sub: 'user-1', groups: ['admins'], externalIdentifier: 'user-1', emailVerified: false })
+			// userinfo carries no id-token claims → narrower than sign-in's surface → additive-only on refresh.
+			expect(result.claimsComplete).toBe(false)
+		}
+	})
+
+	test('attributesKey: userinfo nested claims are lifted to the top level', async () => {
+		const client = {
+			userinfo: async () => ({ sub: 'user-1', attributes: { groups: ['admins'] } }),
+		} as any
+		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'access-1' }), { claimMapping: { attributesKey: 'attributes' } })
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect((result.claims as any)?.groups).toEqual(['admins'])
 		}
 	})