@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -4,6 +4,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { SignInErrorCode } from '../../../../src/schema/index.js'
 import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src/index.js'
@@ -31,6 +32,7 @@ test('signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -94,6 +96,7 @@ test('signs in - normalize email', async () => {
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -137,6 +140,7 @@ test('sign in - invalid password', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -170,6 +174,7 @@ test('sign in - email not verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: null },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -205,6 +210,7 @@ test('sign in - email verification required but already verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: now },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -253,6 +259,7 @@ test('otp token not provided', async () => {
 					otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember',
 				},
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -290,6 +297,7 @@ test('sign in - invalid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -327,6 +335,7 @@ test('sign in - valid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
 			getAuthPoliciesSql(),
@@ -380,6 +389,7 @@ test('sign in - valid backup code (when OTP is required)', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: true }),
 			countUnusedBackupCodesSql({ personId, count: 4 }),
 			getConfigSql(),
@@ -432,6 +442,7 @@ test('sign in - email OTP enabled, no code provided: dispatches a code and retur
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// signIn lazily re-fetches the config to resolve the email-OTP send rate limit.
 			getConfigSql(),
 			...sendEmailOtpSql({ personId, rateLimitEventId: testUuid(1), tokenId: testUuid(2) }),
@@ -475,6 +486,7 @@ test('sign in - email OTP enabled, valid code: signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 			consumeEmailOtpTokenSql({ tokenId }),
@@ -515,6 +527,7 @@ test('sign in - email OTP enabled, invalid code: INVALID_OTP_TOKEN', async () =>
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 		],
@@ -550,6 +563,7 @@ test('sign in - already-used backup code is rejected', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: false }),
 		],
 		return: {

package/tests/cases/integration/mocked/signInPasswordlessMutation.test.ts

@@ -6,6 +6,7 @@ import { signInPasswordlessMutation } from './gql/passwordless.js'
 import { computeTokenHash } from '../../../../src/index.js'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -54,6 +55,7 @@ test('signInPasswordless - marks an unverified email verified before issuing the
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: null },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -110,6 +112,7 @@ test('signInPasswordless - skips the email-verified update when already verified
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -144,3 +147,36 @@ test('signInPasswordless - skips the email-verified update when already verified
 		},
 	})
 })
+
+test('signInPasswordless - a link created while the magic link was in flight still refuses the session', async () => {
+	const requestId = testUuid(1)
+	const personId = testUuid(2)
+	const identityId = testUuid(3)
+	const token = 'passwordless-token'
+	await executeTenantTest({
+		query: signInPasswordlessMutation({ requestId, token, validationType: 'token' }),
+		executes: [
+			...sqlTransaction(
+				personTokenByIdSql({ requestId, personId, token }),
+				getPersonByIdSql({
+					personId,
+					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
+				}),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				signInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/sql/getConfigSql.ts

@@ -59,6 +59,9 @@ export const getConfigSql = (overrides: Record<string, unknown> = {}): ExpectedQ
 				captcha_protect_password_reset: true,
 				captcha_protect_passwordless_init: true,
 				captcha_protect_email_verification: false,
+				// Management panel entry gate — matches the column defaults.
+				panel_global_roles: ['super_admin', 'project_admin'],
+				panel_project_roles: ['admin'],
 				...overrides,
 			},
 		],

package/tests/cases/integration/mocked/sql/getIdpBySlugSql.ts

@@ -7,7 +7,7 @@ export const getIdpBySlugSql = (args: {
 	response: null | IdentityProviderRow
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"
+		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"
 		from "tenant"."identity_provider"
 		where "slug" = ?`,
 	parameters: [args.slug],

package/tests/cases/integration/mocked/sql/getProjectBySlugSql.ts

@@ -2,7 +2,7 @@ import { ExpectedQuery } from '@contember/database-tester'
 import { SQL } from '../../../../src/tags.js'
 import { Project } from '../../../../../src/index.js'
 
-export const getProjectBySlugSql = (args: { projectSlug: string; response: Project }): ExpectedQuery => ({
+export const getProjectBySlugSql = (args: { projectSlug: string; response: Project | null }): ExpectedQuery => ({
 	sql: SQL`select "id", "name", "slug", "config", "updated_at" as "updatedAt"
 	         FROM "tenant"."project"
 	         WHERE "slug" = ?`,

package/tests/cases/integration/mocked/sql/listPersonsSql.ts

@@ -7,10 +7,12 @@ export interface ListPersonsResponseRow {
 	email: string
 	name?: string
 	emailOtpEnabled?: boolean
+	passwordlessEnabled?: boolean | null
+	disabledAt?: Date | null
 }
 
 const COLUMNS =
-	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at"'
+	'"person"."id", "person"."identity_id", "person"."email", "person"."name", "person_mfa"."totp_activated_at" AS "otp_activated_at", coalesce("person_mfa"."email_otp_enabled", false) AS "email_otp_enabled", "person"."passwordless_enabled", "person"."email_verified_at", "person"."disabled_at"'
 
 const FROM = `FROM "tenant"."person"
 	LEFT JOIN "tenant"."person_mfa" AS "person_mfa" ON "person_mfa"."person_id" = "person"."id"`
@@ -47,8 +49,9 @@ export const listPersonsSql = (args: {
 				name: row.name ?? null,
 				otp_activated_at: null,
 				email_otp_enabled: row.emailOtpEnabled ?? false,
-				passwordless_enabled: null,
+				passwordless_enabled: row.passwordlessEnabled ?? null,
 				email_verified_at: null,
+				disabled_at: row.disabledAt ?? null,
 			})),
 		},
 	}

package/tests/cases/integration/mocked/sql/localAuthDisablingIdpsSql.ts

@@ -0,0 +1,21 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+/**
+ * The `LocalAuthDisablingIdpsQuery` lookup every local authentication path runs.
+ * `slugs` defaults to none, i.e. local authentication stays available.
+ */
+export const localAuthDisablingIdpsSql = (args: {
+	personId: string
+	slugs?: string[]
+}): ExpectedQuery => ({
+	sql: SQL`SELECT "identity_provider"."slug" AS "slug"
+	         FROM "tenant"."person_identity_provider"
+		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
+	         WHERE "person_identity_provider"."person_id" = ? AND "identity_provider"."disable_local_authentication" = ? AND "identity_provider"."disabled_at" IS NULL
+	         ORDER BY "identity_provider"."slug" ASC`,
+	parameters: [args.personId, true],
+	response: {
+		rows: (args.slugs ?? []).map(slug => ({ slug })),
+	},
+})

package/tests/cases/integration/mocked/sql/personIdentityProvidersSql.ts

@@ -8,6 +8,7 @@ export interface PersonIdpConnectionRow {
 	slug: string
 	type: string
 	disabledAt?: Date | null
+	disableLocalAuthentication?: boolean
 }
 
 export const getPersonIdentityProvidersSql = (args: {
@@ -15,7 +16,7 @@ export const getPersonIdentityProvidersSql = (args: {
 	response: PersonIdpConnectionRow[]
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt"
+		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt", "identity_provider"."disable_local_authentication" as "identityProviderDisableLocalAuthentication"
 	         FROM "tenant"."person_identity_provider"
 		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
 	         WHERE "person_id" = ?
@@ -29,6 +30,7 @@ export const getPersonIdentityProvidersSql = (args: {
 			identityProviderSlug: it.slug,
 			identityProviderType: it.type,
 			identityProviderDisabledAt: it.disabledAt ?? null,
+			identityProviderDisableLocalAuthentication: it.disableLocalAuthentication ?? false,
 		})),
 	},
 })

package/tests/cases/integration/mocked/sql/removeMembershipSql.ts

@@ -0,0 +1,14 @@
+import { SQL } from '../../../../src/tags.js'
+import { ExpectedQuery } from '@contember/database-tester'
+
+/** RemoveProjectMembershipCommand — delete a single (project, identity, role) membership. */
+export const removeMembershipSql = (args: {
+	projectId: string
+	identityId: string
+	role: string
+}): ExpectedQuery => ({
+	sql: SQL`DELETE FROM "tenant"."project_membership"
+	         WHERE "project_id" = ? AND "identity_id" = ? AND "role" = ?`,
+	parameters: [args.projectId, args.identityId, args.role],
+	response: { rowCount: 1 },
+})

package/tests/cases/integration/mocked/trustForwardedClientInfo.test.ts

@@ -3,6 +3,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { expect, test } from 'bun:test'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -29,6 +30,7 @@ test('signIn: trustForwardedClientInfo=true is propagated when caller has the fl
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -68,6 +70,7 @@ test('signIn: trustForwardedClientInfo=true is silently dropped when caller has
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),

package/tests/cases/unit/databaseContextRetry.test.ts

@@ -0,0 +1,81 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { SerializationFailureError } from '@contember/database'
+import { createLogger, TestLoggerHandler } from '@contember/logger'
+import { DatabaseContext } from '../../../src/index.js'
+import { Providers } from '../../../src/model/providers.js'
+
+// Every tenant transaction runs at repeatable read, so postgres aborts it with a 40001 as soon as another
+// transaction commits to a row it wants — the api_key row disablePerson touches is written by that very
+// person's background session tracking. Repeating is the only correct answer, but it is opt-in: several
+// managers send a mail from inside their transaction and would send it twice.
+
+const providers: Providers = {
+	uuid: () => '11111111-1111-1111-1111-111111111111',
+	now: () => new Date('2026-01-01T00:00:00Z'),
+	randomBytes: length => Promise.resolve(Buffer.alloc(length)),
+	bcrypt: value => Promise.resolve(value),
+	bcryptCompare: (data, encrypted) => Promise.resolve(data === encrypted),
+	hash: value => Buffer.from(String(value)),
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+}
+
+const serializationFailure = () =>
+	new SerializationFailureError('update "tenant"."api_key" set "disabled_at" = $1 where "identity_id" = $2', [], {
+		code: '40001',
+		message: 'could not serialize access due to concurrent update',
+	})
+
+const begin: ExpectedQuery[] = [
+	{ sql: 'BEGIN;', response: { rowCount: 1 } },
+	{ sql: 'SET TRANSACTION ISOLATION LEVEL REPEATABLE READ', response: { rowCount: 1 } },
+]
+const commit: ExpectedQuery = { sql: 'COMMIT;', response: { rowCount: 1 } }
+
+const createDbContext = (queries: ExpectedQuery[]) => {
+	const connection = createConnectionMock(queries)
+	return new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+}
+
+test('transaction with retry repeats the whole transaction after a serialization failure', async () => {
+	const queries = [...begin, ...begin, commit]
+	const dbContext = createDbContext(queries)
+	const handler = new TestLoggerHandler()
+	let attempts = 0
+
+	const result = await dbContext.transaction(async () => {
+		attempts++
+		if (attempts === 1) {
+			throw serializationFailure()
+		}
+		return 'done'
+	}, { retry: { logger: createLogger(handler) } })
+
+	expect(result).toBe('done')
+	expect(attempts).toBe(2)
+	// The second attempt opens its own transaction, so it gets a fresh snapshot — a retry on the same one
+	// would abort again forever.
+	expect(queries).toHaveLength(0)
+	// Logged through the injected logger, not an ambient one — a retry must not depend on request-scoped state.
+	expect(handler.messages).toHaveLength(1)
+	expect(handler.messages[0].message).toMatch(/^RETRY: Serialization failure \(attempt #1/)
+})
+
+test('transaction without retry lets the serialization failure through', async () => {
+	const dbContext = createDbContext([...begin])
+	let attempts = 0
+
+	const run = dbContext.transaction(async () => {
+		attempts++
+		throw serializationFailure()
+	})
+
+	await expect(run).rejects.toBeInstanceOf(SerializationFailureError)
+	expect(attempts).toBe(1)
+})