@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/tests/cases/integration/mocked/personIdentityProviders.test.ts

@@ -278,6 +278,73 @@ test('refuses to disconnect when the only other connection is to a disabled prov
 	})
 })
 
+test('refuses to disconnect a provider that disables local authentication, even though a password remains', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			// the password would be usable again the moment the link is gone, which is exactly the escape to close
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{ id: connectionId, createdAt, externalIdentifier: 'ext-1', slug: 'corporateSso', type: 'oidc', disableLocalAuthentication: true },
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
+test('still refuses while that provider is disabled: break-glass reopens local sign-in, not self-unlinking', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{
+							id: connectionId,
+							createdAt,
+							externalIdentifier: 'ext-1',
+							slug: 'corporateSso',
+							type: 'oidc',
+							disabledAt: new Date('2021-01-01T00:00:00.000Z'),
+							disableLocalAuthentication: true,
+						},
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
 test('returns NOT_FOUND when the person is not connected to the given connection', async () => {
 	const personId = testUuid(1)
 	await executeTenantTest({

package/tests/cases/integration/mocked/personsQuery.test.ts

@@ -5,12 +5,14 @@ import { test } from 'bun:test'
 import { listPersonsSql } from './sql/listPersonsSql.js'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getConfigSql } from './sql/getConfigSql.js'
 
 test('persons query lists all persons (SUPER_ADMIN path, no filter)', async () => {
 	const person1 = testUuid(1)
 	const identity1 = testUuid(2)
 	const person2 = testUuid(3)
 	const identity2 = testUuid(4)
+	const disabledAt = new Date('2019-09-04T12:00:00.000Z')
 
 	await executeTenantTest({
 		query: {
@@ -21,6 +23,9 @@ query {
 		email
 		name
 		emailOtpEnabled
+		disabledAt
+		passwordlessAvailable
+		passwordlessSelfManaged
 		identity {
 			id
 		}
@@ -31,16 +36,43 @@ query {
 		executes: [
 			listPersonsSql({
 				rows: [
-					{ personId: person1, identityId: identity1, email: 'alice@example.com', name: 'Alice', emailOtpEnabled: true },
-					{ personId: person2, identityId: identity2, email: 'bob@example.com', name: 'Bob' },
+					{
+						personId: person1,
+						identityId: identity1,
+						email: 'alice@example.com',
+						name: 'Alice',
+						emailOtpEnabled: true,
+						passwordlessEnabled: true,
+						disabledAt,
+					},
+					{ personId: person2, identityId: identity2, email: 'bob@example.com', name: 'Bob', passwordlessEnabled: false },
 				],
 			}),
+			getConfigSql({ passwordless_enabled: 'optIn' }),
 		],
 		return: {
 			data: {
 				persons: [
-					{ id: person1, email: 'alice@example.com', name: 'Alice', emailOtpEnabled: true, identity: { id: identity1 } },
-					{ id: person2, email: 'bob@example.com', name: 'Bob', emailOtpEnabled: false, identity: { id: identity2 } },
+					{
+						id: person1,
+						email: 'alice@example.com',
+						name: 'Alice',
+						emailOtpEnabled: true,
+						disabledAt: disabledAt.toISOString(),
+						passwordlessAvailable: true,
+						passwordlessSelfManaged: true,
+						identity: { id: identity1 },
+					},
+					{
+						id: person2,
+						email: 'bob@example.com',
+						name: 'Bob',
+						emailOtpEnabled: false,
+						disabledAt: null,
+						passwordlessAvailable: false,
+						passwordlessSelfManaged: true,
+						identity: { id: identity2 },
+					},
 				],
 			},
 		},
@@ -124,7 +156,8 @@ query {
 					// ProjectMembersQuery (filter {}) — every member identity of the project
 					sql: SQL`select "id", "description" from "tenant"."identity"
 						where exists (select ?::int from "tenant"."project_membership"
-							where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?)`,
+							where "project_membership"."identity_id" = "identity"."id" and "project_id" = ?)
+						order by "identity"."id" asc`,
 					parameters: [1, projectId],
 					response: {
 						rows: [

package/tests/cases/integration/mocked/signInAnomalyDetection.test.ts

@@ -3,6 +3,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src/index.js'
 import { Buffer } from 'buffer'
@@ -51,6 +52,7 @@ test('anomaly off by default: a new country does not add any queries (baseline p
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -83,6 +85,7 @@ test('anomaly on, new device only (medium): sends UNUSUAL_LOGIN email, still sig
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// applyRiskPolicy: history (same country, different device → medium 2) then email
@@ -131,6 +134,7 @@ test('anomaly on, new country (high): requires step-up, dispatches email OTP, re
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// history: previously only ever seen in CZ → US is a new country (high, 3) → step-up.
@@ -185,6 +189,7 @@ test('anomaly on, step-up retry with the emailed code: consumes it and signs in
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert; otpToken is ignored here)
 			getAuthPoliciesSql(),
 			// previously only ever seen in CZ → US is a new country (high, 3) → step-up.
@@ -235,6 +240,7 @@ test('anomaly on, step-up retry with a wrong code: INVALID_OTP_TOKEN, no session
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getLoginHistorySql({ personId, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
 			// wrong code: token is found and an attempt is claimed, but validation fails.
@@ -289,6 +295,7 @@ test('anomaly on, step-up scored for a user who already cleared TOTP this reques
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// active TOTP + valid token → verified here (no SQL); mfaSatisfiedThisRequest = true.
 			// applyRiskPolicy: US is a new country (high, 3 → stepUp) BUT MFA already satisfied
 			// this request → NO email-OTP challenge (no sendEmailOtpSql/getLatestEmailOtpTokenSql
@@ -343,6 +350,7 @@ test('anomaly on, new IP prefix only (low): the client IP flows into scoring →
 			recordLoginRateLimitSql(clientIp),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			// history IP is 10.0.0.5 (/24 = 10.0.0.0) → current 203.0.113.9 (/24 = 203.0.113.0)
 			// is a new prefix; country + device match → score 1 → email.
@@ -388,6 +396,7 @@ test('anomaly on, custom historySize flows into the baseline query limit', async
 			anomalyConfig3,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			// limit 3, not the default 10. Same country + device → score 0 → clean.
 			getLoginHistorySql({ personId, limit: 3, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
@@ -422,6 +431,7 @@ test('anomaly on, historySize <= 0 is clamped to a limit of 1', async () => {
 			anomalyConfig0,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getLoginHistorySql({ personId, limit: 1, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
 			anomalyConfig0,
@@ -452,6 +462,7 @@ test('anomaly on, all signals match history: no email, no step-up, signs in clea
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// same country, same device → score 0 → allow, no email.