@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/types/utils/Mailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAApD,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW;IAEjF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAQtF;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;IAIzC,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAgB1D;AAED,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,KAAG,MAQrD,CAAA"}
+{"version":3,"file":"Mailer.d.ts","sourceRoot":"","sources":["../../../src/utils/Mailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,KAAK,aAAa,MAAM,+BAA+B,CAAA;AAC9D,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,mCAAmC,CAAA;AACtE,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA;AAE1D,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAC/B,QAAQ,CAAC,EAAE,sBAAsB,CAAA;CACjC;AAED,MAAM,WAAW,QAAQ;IACxB,KAAK,CAAC,EAAE,GAAG,CAAA;IACX,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,GAAG,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,MAAM,aAAa,GACtB,CACD,aAAa,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,GAAG,iBAAiB,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,GAAG,gBAAgB,GAAG;IAChH,OAAO,EAAE,MAAM,GAAG;QACjB,GAAG,EAAE,MAAM,CAAA;QACX,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;CACD,CACD,GACC;IACD,IAAI,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAEF,MAAM,WAAW,MAAM;IACtB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC7C;AAED,qBAAa,UAAW,YAAW,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAsB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAjF,YAA6B,IAAI,EAAE,MAAM,GAAG,SAAS,EAAmB,SAAS,EAAE,WAAW,EAAI;IAErF,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAOrF;CACD;AAED,qBAAa,aAAc,YAAW,MAAM;IAE1C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHzB,YACkB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EAErD;IAEY,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAezD;CACD;AAED,eAAO,MAAM,YAAY,YAAa,aAAa,KAAG,MAQrD,CAAA"}

package/dist/types/utils/TemplateRenderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAGvF"}
+{"version":3,"file":"TemplateRenderer.d.ts","sourceRoot":"","sources":["../../../src/utils/TemplateRenderer.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IACf,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAEtF;CACD"}

package/dist/types/utils/array.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EACvG,OAAO,IAAI,EAAE,EACb,KAAK,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}
+{"version":3,"file":"array.d.ts","sourceRoot":"","sources":["../../../src/utils/array.ts"],"names":[],"mappings":"AAAA,wBAAgB,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,KAAK,IAAI,MAAM,CAElF;AAED,KAAK,UAAU,CAAC,CAAC,EAAE,CAAC,IAAI;KACtB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK;CAC1C,CAAC,MAAM,CAAC,CAAC,CAAA;AAEV,eAAO,MAAM,WAAW,GAAI,IAAI,EAAE,GAAG,SAAS,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,SAChG,IAAI,EAAE,OACR,GAAG,KACN,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,CAQtB,CAAA"}

package/dist/types/utils/batchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,EAChD,yBAAyB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAC3D,IAAI,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}
+{"version":3,"file":"batchQuery.d.ts","sourceRoot":"","sources":["../../../src/utils/batchQuery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,MAAM,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEhE,MAAM,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,IAAI;IAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI;CAC3C,CAAA;AACD,eAAO,MAAM,WAAW,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,WAAW,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,uCAAS,CAAA;AAEnG,eAAO,MAAM,eAAe,GAAI,GAAG,EAAE,MAAM,EAAE,IAAI,2BACvB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MACvD,eAAe,KACjB,UAAU,CAAC,GAAG,EAAE,IAAI,CAiBtB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.3",
+  "version": "2.2.0-alpha.6",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.3",
-    "@contember/config-loader": "2.2.0-alpha.3",
-    "@contember/database": "2.2.0-alpha.3",
-    "@contember/database-migrations": "2.2.0-alpha.3",
-    "@contember/dic": "2.2.0-alpha.3",
-    "@contember/graphql-utils": "2.2.0-alpha.3",
-    "@contember/logger": "2.2.0-alpha.3",
-    "@contember/schema": "2.2.0-alpha.3",
-    "@contember/schema-utils": "2.2.0-alpha.3",
-    "@contember/typesafe": "2.2.0-alpha.3",
+    "@contember/authorization": "2.2.0-alpha.6",
+    "@contember/config-loader": "2.2.0-alpha.6",
+    "@contember/database": "2.2.0-alpha.6",
+    "@contember/database-migrations": "2.2.0-alpha.6",
+    "@contember/dic": "2.2.0-alpha.6",
+    "@contember/graphql-utils": "2.2.0-alpha.6",
+    "@contember/logger": "2.2.0-alpha.6",
+    "@contember/schema": "2.2.0-alpha.6",
+    "@contember/schema-utils": "2.2.0-alpha.6",
+    "@contember/typesafe": "2.2.0-alpha.6",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.3",
+    "@contember/database-tester": "2.2.0-alpha.6",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/TenantContainer.ts

@@ -20,6 +20,7 @@ import {
 	HCaptchaProvider,
 	Identity,
 	IdentityFactory,
+	IDPClaimSyncService,
 	IDPHandlerRegistry,
 	IDPManager,
 	IdpSessionRevalidator,
@@ -31,6 +32,7 @@ import {
 	OIDCProvider,
 	OtpAuthenticator,
 	OtpManager,
+	PanelAccessResolver,
 	PasswordChangeManager,
 	PasswordResetManager,
 	PermissionContextFactory,
@@ -101,6 +103,7 @@ import { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'
 import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'
 import { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'
 import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'
+import { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'
 import { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'
 import { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'
 import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'
@@ -124,6 +127,7 @@ export interface TenantContainer {
 	backchannelLogoutManager: BackchannelLogoutManager
 	signUpManager: SignUpManager
 	projectManager: ProjectManager
+	panelAccessResolver: PanelAccessResolver
 	resolvers: Schema.Resolvers
 	resolverContextFactory: TenantResolverContextFactory
 	authorizator: Authorizator<Identity>
@@ -159,6 +163,7 @@ export class TenantContainerFactory {
 				'backchannelLogoutManager',
 				'projectMemberManager',
 				'projectManager',
+				'panelAccessResolver',
 				'signUpManager',
 				'resolvers',
 				'authorizator',
@@ -183,6 +188,7 @@ export class TenantContainerFactory {
 			.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))
 			.addService('apiKeyService', () => new ApiKeyService())
 			.addService('authPolicyResolver', () => new AuthPolicyResolver())
+			.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))
 			.addService('authLogService', () => new AuthLogService())
 			.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))
 			.addService('idpRegistry', () => {
@@ -192,7 +198,8 @@ export class TenantContainerFactory {
 				idpRegistry.registerHandler('apple', new AppleProvider())
 				return idpRegistry
 			})
-			.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))
+			.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))
+			.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))
 			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
 			.addService('unpersistedApiKeyManager', () =>
 				UnpersistedApiKeyManager.createForRootTokens({
@@ -246,8 +253,11 @@ export class TenantContainerFactory {
 				({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>
 					new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),
 			)
-			.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))
-			.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))
+			.addService(
+				'idpSignInManager',
+				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),
+			)
+			.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))
 			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())
 			.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))
 			.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))
@@ -388,6 +398,10 @@ export class TenantContainerFactory {
 				'disablePersonMutationResolver',
 				({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),
 			)
+			.addService(
+				'enablePersonMutationResolver',
+				({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),
+			)
 			.addService(
 				'forceSignOutMutationResolver',
 				({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),

package/src/migrations/2026-06-18-120000-idp-claim-mapping.ts

@@ -0,0 +1,15 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// A09 — IdP claim mapping. The mapping itself rides inside the existing
+// `identity_provider.configuration` JSONB (`configuration.claimMapping`), so no table or column
+// change is needed. This migration only wires the call sites: the new `idp_role_mapped` audit
+// action emitted when claim-mapping (re)syncs project memberships, and `idp_role_mapping_failed`
+// emitted when a configured mapping failed and was skipped (fail-open).
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapped';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-03-120000-person-enable-auth-log.ts

@@ -0,0 +1,12 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// New enum values are added in their own migration so the values are committed
+// before any later migration (or runtime code) inserts rows using them — a new
+// enum value cannot be used in the same transaction that adds it.
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'person_enable';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-08-04-120000-config-panel.ts

@@ -0,0 +1,13 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+// Who may enter the management panel. Defaults reproduce the pre-config
+// behaviour (super admins and project admins), an empty list means nobody.
+const sql = `
+ALTER TABLE "config"
+	ADD COLUMN "panel_global_roles"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',
+	ADD COLUMN "panel_project_roles" TEXT[] NOT NULL DEFAULT '{admin}';
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts

@@ -0,0 +1,18 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+-- When TRUE, a person linked to this identity provider may authenticate ONLY through
+-- it: password sign-in, passwordless sign-in and password-reset mails are refused for
+-- them. The link itself is the marker, so it also covers a person who predates the
+-- provider and got linked by e-mail matching.
+--
+-- Scoped to providers that are currently enabled: disabling the provider restores
+-- local authentication for everyone linked to it, which is the break-glass for an IdP
+-- outage. Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "disable_local_authentication" BOOLEAN NOT NULL DEFAULT FALSE;
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -62,6 +62,10 @@ import _20260526140000idpsession from './2026-05-26-140000-idp-session.js'
 import _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'
 import _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'
 import _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'
+import _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'
+import _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'
+import _20260804120000configpanel from './2026-08-04-120000-config-panel.js'
+import _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'
 import snapshot from './snapshot.js'
 import { computeTokenHash, Providers } from '../model/index.js'
 import { Logger } from '@contember/logger'
@@ -147,6 +151,10 @@ const migrations = {
 	'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,
 	'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,
 	'2026-06-16-130000-idp-logout': _20260616130000idplogout,
+	'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,
+	'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,
+	'2026-08-04-120000-config-panel': _20260804120000configpanel,
+	'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -56,7 +56,10 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -179,6 +182,8 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );
@@ -199,7 +204,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -14,12 +14,11 @@ export class UpdateConfigurationCommand implements Command<void> {
 		const captcha = this.configuration.captcha
 		const rl = this.configuration.rateLimits
 
-		// Encrypt captcha secret at rest. Empty string clears the value;
-		// non-empty re-encrypts so we always rotate to the latest key version.
+		// Null and omission preserve the stored secret; only an empty string clears it.
 		let captchaSecretCol: Buffer | null | undefined
 		let captchaSecretVersionCol: number | null | undefined
-		if (captcha?.secret !== undefined) {
-			if (captcha.secret === '' || captcha.secret === null) {
+		if (captcha?.secret !== undefined && captcha.secret !== null) {
+			if (captcha.secret === '') {
 				captchaSecretCol = null
 				captchaSecretVersionCol = null
 			} else {
@@ -79,6 +78,8 @@ export class UpdateConfigurationCommand implements Command<void> {
 					rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,
 					rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,
 					rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,
+					panel_global_roles: this.configuration.panel?.globalRoles ?? undefined,
+					panel_project_roles: this.configuration.panel?.projectRoles ?? undefined,
 				} satisfies {
 					[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined
 				},

package/src/model/commands/idp/CreateIdpCommand.ts

@@ -9,7 +9,12 @@ export class CreateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data
+		const {
+			configuration,
+			options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+			slug,
+			type,
+		} = this.data
 		await InsertBuilder.create()
 			.into('identity_provider')
 			.values({
@@ -22,6 +27,7 @@ export class CreateIdpCommand implements Command<void> {
 				init_returns_config: initReturnsConfig,
 				require_verified_email: requireVerifiedEmail,
 				assume_email_verified: assumeEmailVerified,
+				disable_local_authentication: disableLocalAuthentication,
 			})
 			.execute(db)
 	}

package/src/model/commands/idp/UpdateIdpCommand.ts

@@ -10,7 +10,10 @@ export class UpdateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data
+		const {
+			configuration,
+			options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {},
+		} = this.data
 		await UpdateBuilder.create()
 			.table('identity_provider')
 			.values({
@@ -20,6 +23,7 @@ export class UpdateIdpCommand implements Command<void> {
 				init_returns_config: initReturnsConfig,
 				require_verified_email: requireVerifiedEmail,
 				assume_email_verified: assumeEmailVerified,
+				disable_local_authentication: disableLocalAuthentication,
 			})
 			.where({
 				id: this.id,

package/src/model/commands/membership/UpdateProjectMemberCommand.ts

@@ -3,7 +3,7 @@ import { UpdateProjectMemberErrorCode } from '../../../schema/index.js'
 import { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'
 import { SelectBuilder } from '@contember/database'
 import { MembershipUpdateInput } from './types.js'
-import { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'
+import { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'
 import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'
 
 export class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {

package/src/model/commands/membership/index.ts

@@ -1,6 +1,7 @@
 export * from './AddProjectMemberCommand.js'
 export * from './CreateOrUpdateProjectMembershipCommand.js'
 export * from './RemoveProjectMemberCommand.js'
+export * from './RemoveProjectMembershipCommand.js'
 export * from './UpdateProjectMemberCommand.js'
-export * from './variables/PatchProjectMembershipVariablesCommand.js'
+export * from './variables/index.js'
 export * from './types.js'

package/src/model/commands/membership/variables/index.ts

@@ -1 +1,2 @@
 export * from './PatchProjectMembershipVariablesCommand.js'
+export * from './SetProjectMembershipVariableValuesCommand.js'

package/src/model/commands/person/EnablePersonCommand.ts

@@ -0,0 +1,18 @@
+import { Command } from '../Command.js'
+import { UpdateBuilder } from '@contember/database'
+
+export class EnablePersonCommand implements Command<void> {
+	constructor(private readonly personId: string) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		await UpdateBuilder.create()
+			.table('person')
+			.values({
+				disabled_at: null,
+			})
+			.where({
+				id: this.personId,
+			})
+			.execute(db)
+	}
+}

package/src/model/queries/configuration/ConfigurationQuery.ts

@@ -96,6 +96,10 @@ export class ConfigurationQuery extends DatabaseQuery<Config> {
 					window: result.rate_limit_email_verification_per_ip_window,
 				},
 			},
+			panel: {
+				globalRoles: result.panel_global_roles,
+				projectRoles: result.panel_project_roles,
+			},
 		}
 	}
 }

package/src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts

@@ -0,0 +1,41 @@
+import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'
+
+/**
+ * Slugs of the identity providers that forbid this person every local
+ * authentication method — password sign-in, passwordless sign-in and the
+ * password-reset mail. Empty means local authentication is available.
+ *
+ * The IdP link is the marker, so this also covers a person who predates the
+ * provider and was linked to it by e-mail matching, not only one created by
+ * auto-sign-up. A DISABLED provider does not count: turning the provider off
+ * hands local authentication back to everyone linked to it, which is the
+ * break-glass when the IdP is unreachable.
+ */
+export class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {
+	constructor(
+		private readonly personId: string,
+	) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<string[]> {
+		const rows = await SelectBuilder.create<{ slug: string }>()
+			.select(['identity_provider', 'slug'], 'slug')
+			.from('person_identity_provider')
+			.join(
+				'identity_provider',
+				'identity_provider',
+				expr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),
+			)
+			.where(where =>
+				where
+					.compare(['person_identity_provider', 'person_id'], Operator.eq, this.personId)
+					.compare(['identity_provider', 'disable_local_authentication'], Operator.eq, true)
+					.isNull(['identity_provider', 'disabled_at'])
+			)
+			.orderBy(['identity_provider', 'slug'])
+			.getResult(db)
+
+		return rows.map(it => it.slug)
+	}
+}

package/src/model/queries/idp/PersonIdentityProvidersQuery.ts

@@ -7,6 +7,7 @@ export interface PersonIdentityProviderRow {
 	readonly identityProviderSlug: string
 	readonly identityProviderType: string
 	readonly identityProviderDisabledAt: Date | null
+	readonly identityProviderDisableLocalAuthentication: boolean
 }
 
 /**
@@ -29,6 +30,7 @@ export class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityPr
 			.select(['identity_provider', 'slug'], 'identityProviderSlug')
 			.select(['identity_provider', 'type'], 'identityProviderType')
 			.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')
+			.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')
 			.from('person_identity_provider')
 			.join(
 				'identity_provider',

package/src/model/queries/idp/helpers.ts

@@ -13,13 +13,14 @@ export const createBaseIdpQuery = () =>
 		.select('init_returns_config', 'initReturnsConfig')
 		.select('require_verified_email', 'requireVerifiedEmail')
 		.select('assume_email_verified', 'assumeEmailVerified')
+		.select('disable_local_authentication', 'disableLocalAuthentication')
 		.from('identity_provider')
 
 export const createIdpDto = (
-	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,
+	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,
 ): IdentityProviderDto => {
 	return {
 		...row,
-		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },
+		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
 	}
 }

package/src/model/queries/idp/index.ts

@@ -3,4 +3,5 @@ export * from './IdentityProvidersQuery.js'
 export * from './IdpSessionByApiKeyQuery.js'
 export * from './IdpSessionsBySidQuery.js'
 export * from './IdpSessionsBySubQuery.js'
+export * from './LocalAuthDisablingIdpsQuery.js'
 export * from './PersonIdentityProvidersQuery.js'

package/src/model/queries/idp/types.ts

@@ -11,6 +11,7 @@ export type IdentityProviderRow = {
 	initReturnsConfig: boolean
 	requireVerifiedEmail: boolean
 	assumeEmailVerified: boolean
+	disableLocalAuthentication: boolean
 }
 
 export type IdentityProviderDto =

package/src/model/queries/membership/ProjectMembersQuery.ts

@@ -50,6 +50,7 @@ export class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult
 
 				return qb
 			})
+			.orderBy(['identity', 'id'])
 			.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)
 			.getResult(db)
 	}

package/src/model/queries/person/PersonQueryBuilderFactory.ts

@@ -17,6 +17,7 @@ export class PersonQueryBuilderFactory {
 			.select(expr => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), 'email_otp_enabled')
 			.select(['person', 'passwordless_enabled'])
 			.select(['person', 'email_verified_at'])
+			.select(['person', 'disabled_at'])
 			.from('person')
 			.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))
 	}

package/src/model/queries/person/types.ts

@@ -36,4 +36,5 @@ export interface PersonListRow {
 	readonly email_otp_enabled: boolean
 	readonly passwordless_enabled: boolean | null
 	readonly email_verified_at: Date | null
+	readonly disabled_at: Date | null
 }

package/src/model/service/AuthLogService.ts

@@ -3,6 +3,18 @@ import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntr
 import { Response } from '../utils/Response.js'
 import { AuthActionType } from '../type/AuthLog.js'
 import { JSONValue } from '@contember/schema'
+import { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'
+
+/**
+ * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a
+ * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort
+ * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is
+ * still recorded, just not as a reference.
+ */
+const invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>
+	isUnpersistedIdentityId(identityId)
+		? { metadata: { invokedByUnpersistedIdentityId: identityId } }
+		: { invokedById: identityId }
 
 class AuthLogService {
 	async logAuthAction(
@@ -37,13 +49,15 @@ class AuthLogService {
 		if (ctx.forwarderUserAgent !== undefined) {
 			metadata.forwarderUserAgent = ctx.forwarderUserAgent
 		}
+		const invoker = invokedBy(ctx.identityId)
+		Object.assign(metadata, invoker.metadata)
 
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				success: data.response.ok,
 				personInputIdentifier: data.personInput ?? authData?.data?.personInput,
 				personId: data.personId ?? authData?.data?.personId,
-				invokedById: ctx.identityId,
+				invokedById: invoker.invokedById,
 				type: data.type,
 				identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
 				errorCode: data.response.ok ? null : data.response.error,
@@ -77,10 +91,12 @@ class AuthLogService {
 			eventData?: JSONValue
 		},
 	): Promise<void> {
+		const invoker = invokedBy(entry.identityId)
 		await db.commandBus.execute(
 			new CreateAuthLogEntryCommand({
 				type: entry.type,
-				invokedById: entry.identityId,
+				invokedById: invoker.invokedById,
+				metadata: invoker.metadata,
 				personId: entry.personId ?? undefined,
 				success: entry.success,
 				ipAddress: entry.ipAddress,