@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/src/schema/tenant.graphql.ts

@@ -119,6 +119,7 @@ const schema: DocumentNode = gql`
 		disableEmailOtp: DisableEmailOtpResponse
 
 		disablePerson(personId: String!): DisablePersonResponse
+		enablePerson(personId: String!): EnablePersonResponse
 		forceSignOutPerson(personId: String!, reason: String): ForceSignOutPersonResponse
 		resetPersonMfa(personId: String!): ResetPersonMfaResponse
 		revokeSession(sessionId: String!): RevokeSessionResponse
@@ -201,6 +202,7 @@ const schema: DocumentNode = gql`
 		login: ConfigLogin!
 		captcha: ConfigCaptcha!
 		rateLimits: ConfigRateLimits!
+		panel: ConfigPanel!
 	}
 
 	type ConfigSignup {
@@ -334,6 +336,21 @@ const schema: DocumentNode = gql`
 		window: Interval!
 	}
 
+	"""
+	Who may enter the management panel. This is an entry gate for the console
+	only, not an authorization system: everything done inside the panel still
+	goes through the tenant ACL, so being allowed in grants no extra rights.
+	An identity may enter when its global roles intersect globalRoles, or when
+	it holds a membership with one of projectRoles in at least one project.
+	Both lists empty means nobody can enter.
+	"""
+	type ConfigPanel {
+		"""Global roles (identity.roles) that may use the management panel."""
+		globalRoles: [String!]!
+		"""Project membership roles that may use the management panel, in any project."""
+		projectRoles: [String!]!
+	}
+
 	input ConfigInput {
 		signup: ConfigSignupInput
 		emailChange: ConfigEmailChangeInput
@@ -342,6 +359,7 @@ const schema: DocumentNode = gql`
 		login: ConfigLoginInput
 		captcha: ConfigCaptchaInput
 		rateLimits: ConfigRateLimitsInput
+		panel: ConfigPanelInput
 	}
 
 	input ConfigSignupInput {
@@ -426,6 +444,15 @@ const schema: DocumentNode = gql`
 		limit: Int
 		window: Interval
 	}
+
+	"""
+	Each list is replaced as a whole; omitting one leaves it unchanged. An empty
+	list closes the panel for that dimension.
+	"""
+	input ConfigPanelInput {
+		globalRoles: [String!]
+		projectRoles: [String!]
+	}
 	
 	type ConfigureResponse {
 		ok: Boolean!
@@ -539,6 +566,11 @@ const schema: DocumentNode = gql`
 		MFA_ENROLLMENT_REQUIRED
 		EMAIL_NOT_VERIFIED
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so password sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -840,6 +872,11 @@ const schema: DocumentNode = gql`
 		NOT_A_PERSON
 		""" The person is not allowed to disconnect their last remaining sign-in method. """
 		LAST_AUTH_METHOD
+		"""
+		The provider has \`disableLocalAuthentication\`, so this connection is the only way
+		the person may sign in and cannot be removed by them — not even while the provider is disabled.
+		"""
+		IDP_REQUIRED
 	}
 
 	type IdentityProvider {
@@ -866,6 +903,13 @@ const schema: DocumentNode = gql`
 		Defaults to false.
 		"""
 		assumeEmailVerified: Boolean!
+		"""
+		When true, a person linked to this provider may authenticate ONLY through it:
+		password sign-in and passwordless sign-in are refused and no password-reset
+		mail is sent. Disabling the provider lifts the restriction, which is the
+		break-glass for an IdP outage. Defaults to false.
+		"""
+		disableLocalAuthentication: Boolean!
 	}
 
 	input IDPOptions {
@@ -874,6 +918,7 @@ const schema: DocumentNode = gql`
 		initReturnsConfig: Boolean
 		requireVerifiedEmail: Boolean
 		assumeEmailVerified: Boolean
+		disableLocalAuthentication: Boolean
 	}
 
 	# === passwordless sign in ===
@@ -895,6 +940,11 @@ const schema: DocumentNode = gql`
 		PASSWORDLESS_DISABLED
 		INVALID_CAPTCHA
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so passwordless sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 	
 	type InitSignInPasswordlessResult {
@@ -932,6 +982,11 @@ const schema: DocumentNode = gql`
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
 		MFA_ENROLLMENT_REQUIRED
+		"""
+		The person became linked to an identity provider with
+		\`disableLocalAuthentication\` after this magic link was issued.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInPasswordlessResult implements CommonSignInResult {
@@ -1235,8 +1290,22 @@ const schema: DocumentNode = gql`
 		email: String
 		name: String
 		otpEnabled: Boolean!
+		""" The person's own opt-in flag; \`null\` means "follow the tenant policy". On its own it does not say whether passwordless sign-in works — see \`passwordlessAvailable\`. """
 		passwordlessEnabled: Boolean
 		"""
+		Whether passwordless sign-in is actually usable for this person right now: the tenant-wide
+		policy resolved against \`passwordlessEnabled\`, i.e. the very same decision \`signIn\` makes. A UI
+		offering an enable/disable toggle must branch on this — under an \`always\` or \`never\` policy the
+		raw opt-in flag says nothing about what will happen.
+		"""
+		passwordlessAvailable: Boolean!
+		"""
+		Whether \`passwordlessEnabled\` is what decides \`passwordlessAvailable\`. False under an \`always\`
+		or \`never\` policy, where the person's own flag is ignored — a UI should then report the state
+		rather than offer a toggle that changes nothing.
+		"""
+		passwordlessSelfManaged: Boolean!
+		"""
 		Whether e-mail based one-time-password 2FA is enabled for this person
 		(see \`initEmailOtp\` / \`confirmEmailOtp\` / \`disableEmailOtp\`). Independent
 		of \`otpEnabled\` (TOTP authenticator), so a UI can show each MFA method's
@@ -1244,6 +1313,11 @@ const schema: DocumentNode = gql`
 		"""
 		emailOtpEnabled: Boolean!
 		emailVerified: Boolean!
+		"""
+		When the account was disabled (see \`disablePerson\`), null while the person
+		is active. Read-only — flip it with \`disablePerson\` / \`enablePerson\`.
+		"""
+		disabledAt: DateTime
 		identity: Identity!
 
 		"""
@@ -1313,9 +1387,60 @@ const schema: DocumentNode = gql`
 		sessions: [SessionInfo!]!
 	}
 
+	"""
+	What the identity may do tenant-wide, evaluated against the same ACL the resolvers enforce.
+
+	This is for building a UI that does not offer what it cannot deliver — it is **not** a security
+	boundary, and answering \`true\` here grants nothing. Every operation is still checked when it is
+	called. The distinction matters because permission failure is not uniform across this API: some
+	queries answer an empty list, others throw, and every mutation throws, so a client cannot tell
+	"nothing to show" from "not yours to see" by trying.
+	"""
 	type IdentityGlobalPermissions {
 		canCreateProject: Boolean!
 		canDeployEntrypoint: Boolean!
+		""" Read \`configuration\`, which throws otherwise. The other configuration queries gate on their own actions. """
+		canViewConfiguration: Boolean!
+		""" Read \`identityProviders\`. """
+		canListIdentityProviders: Boolean!
+		""" Read \`mailTemplates\`. """
+		canListMailTemplates: Boolean!
+		"""
+		Write the tenant configuration (\`configure\`) and read \`authPolicies\`. The CLI is the usual write path.
+		"""
+		canManageConfiguration: Boolean!
+		""" Read \`authLog\`, which throws otherwise. """
+		canViewAuthLog: Boolean!
+		"""
+		List every person in the tenant. Without it \`persons\` still answers, narrowed to the members
+		of the projects the caller administers — so this marks a full listing, not access to one.
+		"""
+		canListPersons: Boolean!
+		""" Read \`globalApiKeys\`, which answers an empty list otherwise. """
+		canListGlobalApiKeys: Boolean!
+		canCreateGlobalApiKey: Boolean!
+	}
+
+	"""
+	What the calling identity may do in this project. Same contract as
+	\`IdentityGlobalPermissions\`: advisory, evaluated per caller, never a substitute for the checks in
+	the resolvers.
+	"""
+	type ProjectPermissions {
+		""" Read \`members\` and \`apiKeys\`; both answer an empty list otherwise. """
+		canViewMembers: Boolean!
+		""" Invite or add a member (\`invite\`, \`addProjectMember\`). Which roles may be granted is checked per membership. """
+		canAddMember: Boolean!
+		canUpdateMember: Boolean!
+		canRemoveMember: Boolean!
+		""" Read \`secrets\` (their names, never values); answers an empty list otherwise. """
+		canViewSecrets: Boolean!
+		""" Write a project secret (\`setProjectSecret\`). Distinct from viewing: a project admin commonly has one and not the other. """
+		canSetSecret: Boolean!
+		""" Create an API key scoped to this project. """
+		canCreateApiKey: Boolean!
+		""" Update the project itself (\`updateProject\`). """
+		canUpdate: Boolean!
 	}
 
 	type IdentityProjectRelation {
@@ -1350,6 +1475,8 @@ const schema: DocumentNode = gql`
 		+ SUPER_ADMIN by default); returns an empty list otherwise.
 		"""
 		secrets: [ProjectSecretInfo!]!
+		""" What the calling identity may do here. Advisory — for building the UI, not for enforcing it. """
+		permissions: ProjectPermissions!
 	}
 
 	""" Metadata about a project secret — never its value. """
@@ -1541,6 +1668,23 @@ const schema: DocumentNode = gql`
 		PERSON_NOT_FOUND
 	}
 
+	# === enablePerson ===
+
+	type EnablePersonResponse {
+		ok: Boolean!
+		error: EnablePersonError
+	}
+
+	type EnablePersonError {
+		code: EnablePersonErrorCode!
+		developerMessage: String!
+	}
+
+	enum EnablePersonErrorCode {
+		PERSON_ALREADY_ENABLED
+		PERSON_NOT_FOUND
+	}
+
 	# === forceSignOutPerson ===
 
 	type ForceSignOutPersonResponse {

package/tests/cases/integration/mocked/configurationPanel.test.ts

@@ -0,0 +1,105 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { expect, test } from 'bun:test'
+
+test('configuration exposes the panel access lists', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			configuration { panel { globalRoles projectRoles } }
+		}`,
+		executes: [
+			getConfigSql({ panel_global_roles: ['super_admin', 'ops'], panel_project_roles: [] }),
+		],
+		return: {
+			data: {
+				configuration: {
+					panel: {
+						globalRoles: ['super_admin', 'ops'],
+						projectRoles: [],
+					},
+				},
+			},
+		},
+	})
+})
+
+test('configuration returns the panel defaults', async () => {
+	await executeTenantTest({
+		query: GQL`query {
+			configuration { panel { globalRoles projectRoles } }
+		}`,
+		executes: [getConfigSql()],
+		return: {
+			data: {
+				configuration: {
+					panel: {
+						globalRoles: ['super_admin', 'project_admin'],
+						projectRoles: ['admin'],
+					},
+				},
+			},
+		},
+	})
+})
+
+test('configure writes both panel role lists', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { panel: { globalRoles: ['super_admin', 'ops'], projectRoles: ['admin', 'editor'] } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "panel_global_roles" = ?, "panel_project_roles" = ? where "id" = ?`,
+				parameters: [['super_admin', 'ops'], ['admin', 'editor'], 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})
+
+test('configure writes an empty panel list (closes the panel)', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { panel: { globalRoles: [] } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "panel_global_roles" = ? where "id" = ?`,
+				parameters: [[], 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})
+
+// An omitted section must not touch the panel columns — the update is a partial merge.
+test('configure without a panel section leaves the columns alone', async () => {
+	await executeTenantTest({
+		query: {
+			query: GQL`mutation($config: ConfigInput!) {
+				configure(config: $config) { ok error { code } }
+			}`,
+			variables: { config: { password: { minLength: 12 } } },
+		},
+		executes: [
+			{
+				sql: SQL`update "tenant"."config" set "password_min_length" = ? where "id" = ?`,
+				parameters: [12, 'singleton'],
+				response: { rowCount: 1 },
+			},
+		],
+		return: { data: { configure: { ok: true, error: null } } },
+		expectedAuthLog: expect.objectContaining({ type: 'tenant_config_change' }),
+	})
+})

package/tests/cases/integration/mocked/disablePersonMutation.test.ts

@@ -0,0 +1,89 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+import { expect, test } from 'bun:test'
+
+const disablePersonQuery = GQL`mutation($id: String!) {
+	disablePerson(personId: $id) {
+		ok
+		error { code }
+	}
+}`
+
+test('disablePerson revokes the account and its api keys', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: disablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: null },
+			}),
+			...sqlTransaction(
+				{
+					sql: SQL`update "tenant"."person" set "disabled_at" = ? where "id" = ?`,
+					parameters: [(value: unknown) => value instanceof Date, personId],
+					response: { rowCount: 1 },
+				},
+				{
+					sql: SQL`update "tenant"."api_key" set "disabled_at" = ? where "identity_id" = ?`,
+					parameters: [(value: unknown) => value instanceof Date, identityId],
+					response: { rowCount: 1 },
+				},
+			),
+		],
+		return: {
+			data: {
+				disablePerson: { ok: true, error: null },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_disable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('disablePerson returns PERSON_ALREADY_DISABLED', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: disablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: {
+					personId,
+					identityId,
+					password: '123',
+					roles: [],
+					email: 'jane@doe.com',
+					disabledAt: new Date('2019-09-04 12:00'),
+				},
+			}),
+			...sqlTransaction(),
+		],
+		return: {
+			data: {
+				disablePerson: { ok: false, error: { code: 'PERSON_ALREADY_DISABLED' } },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_disable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/enablePersonMutation.test.ts

@@ -0,0 +1,130 @@
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { GQL, SQL } from '../../../src/tags.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { expect, test } from 'bun:test'
+
+const enablePersonQuery = GQL`mutation($id: String!) {
+	enablePerson(personId: $id) {
+		ok
+		error { code }
+	}
+}`
+
+test('enablePerson clears the disabled flag', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: new Date('2019-09-04 12:00') },
+			}),
+			{
+				sql: SQL`update "tenant"."person" set "disabled_at" = ? where "id" = ?`,
+				parameters: [null, personId],
+				response: { rowCount: 1 },
+			},
+		],
+		return: {
+			data: {
+				enablePerson: { ok: true, error: null },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_enable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('enablePerson checks permission against the target roles', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+	const targetRoles = ['super_admin']
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		authorizator: {
+			isAllowed: async (identity, scope, action) => {
+				expect(action).toEqual({ resource: 'person', privilege: 'disable', meta: { roles: targetRoles } })
+				return false
+			},
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: targetRoles, email: 'jane@doe.com', disabledAt: new Date('2019-09-04 12:00') },
+			}),
+		],
+		return: {
+			data: { enablePerson: null },
+			errors: [{ message: 'You are not allowed to enable person account' }],
+		},
+	})
+})
+
+test('enablePerson returns PERSON_NOT_FOUND', async () => {
+	const personId = testUuid(1)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			{
+				sql:
+					SQL`SELECT "person"."id", "person"."password_hash", "person_mfa"."totp_secret" AS "otp_secret", "person_mfa"."totp_secret_version" AS "otp_secret_version", "person_mfa"."totp_activated_at" AS "otp_activated_at", "person_mfa"."totp_pending_secret" AS "otp_pending_secret", "person_mfa"."totp_pending_version" AS "otp_pending_version", "person_mfa"."totp_pending_created_at" AS "otp_pending_created_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."identity_id", "person"."email", "person"."name", "person"."disabled_at", "person"."passwordless_enabled", "person"."mfa_grace_until", "person"."email_verified_at", "person"."email_verification_required", "identity"."roles"
+					FROM "tenant"."person"
+						INNER JOIN "tenant"."identity" AS "identity" ON "identity"."id" = "person"."identity_id"
+						LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"
+					WHERE "person"."id" = ?`,
+				parameters: [personId],
+				response: { rows: [] },
+			},
+		],
+		return: {
+			data: {
+				enablePerson: { ok: false, error: { code: 'PERSON_NOT_FOUND' } },
+			},
+		},
+	})
+})
+
+test('enablePerson returns PERSON_ALREADY_ENABLED', async () => {
+	const personId = testUuid(1)
+	const identityId = testUuid(2)
+
+	await executeTenantTest({
+		query: {
+			query: enablePersonQuery,
+			variables: { id: personId },
+		},
+		executes: [
+			getPersonByIdSql({
+				personId,
+				response: { personId, identityId, password: '123', roles: [], email: 'jane@doe.com', disabledAt: null },
+			}),
+		],
+		return: {
+			data: {
+				enablePerson: { ok: false, error: { code: 'PERSON_ALREADY_ENABLED' } },
+			},
+		},
+		expectedAuthLog: {
+			type: 'person_enable',
+			targetPersonId: personId,
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/gql/passwordless.ts

@@ -21,3 +21,13 @@ export const signInPasswordlessMutation = (
 	}`,
 	variables,
 })
+
+export const initSignInPasswordlessMutation = (variables: { email: string }): GraphQLTestQuery => ({
+	query: GQL`mutation($email: String!) {
+		initSignInPasswordless(email: $email) {
+			ok
+			error { code }
+		}
+	}`,
+	variables,
+})