@contember/engine-tenant-api 2.2.0-alpha.5 → 2.2.0-alpha.6

package/tests/cases/integration/mocked/localAuthenticationDisabled.test.ts

@@ -0,0 +1,182 @@
+import { expect, test } from 'bun:test'
+import { executeTenantTest } from '../../../src/testTenant.js'
+import { testUuid } from '../../../src/testUuid.js'
+import { signInMutation } from './gql/signIn.js'
+import { initSignInPasswordlessMutation } from './gql/passwordless.js'
+import { createResetPasswordRequestMutation } from './gql/createResetPasswordRequest.js'
+import { getConfigSql } from './sql/getConfigSql.js'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
+import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
+import { createSessionKeySql } from './sql/createSessionKeySql.js'
+import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
+import { getIdentityByIdSql } from './sql/getIdentityByIdSql.js'
+import { getAuthPoliciesSql } from './sql/authPolicySql.js'
+import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
+import { sqlTransaction } from './sql/sqlTransaction.js'
+
+const email = 'john@doe.com'
+const password = '123'
+const personId = testUuid(7)
+const identityId = testUuid(2)
+
+test('signIn - a provider that disables local authentication refuses the password', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - the wrong password is not even consulted, so the answer cannot double as a password oracle', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password: 'not-the-password' }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'IDP_REQUIRED' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - revealLoginMethod off collapses it into INVALID_CREDENTIALS', async () => {
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql({ login_reveal_login_method: false }),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: false,
+					errors: [{ code: 'INVALID_CREDENTIALS' }],
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('signIn - a person with no such link signs in as before', async () => {
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	await executeTenantTest({
+		query: signInMutation({ email, password }),
+		executes: [
+			getConfigSql(),
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			// The asserted SQL carries `disabled_at IS NULL`, so a DISABLED provider never
+			// reaches this list — turning the provider off is the break-glass.
+			localAuthDisablingIdpsSql({ personId }),
+			getAuthPoliciesSql(),
+			getConfigSql(),
+			getIdentityByIdSql({ identityId }),
+			getAuthPoliciesSql(),
+			createSessionKeySql({ apiKeyId, identityId }),
+			getIdentityProjectsSql({ identityId, projectId }),
+			selectMembershipsSql({ identityId, projectId, membershipsResponse: [] }),
+		],
+		return: {
+			data: {
+				signIn: {
+					ok: true,
+					errors: [],
+					result: { token: '0000000000000000000000000000000000000000' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})
+
+test('initSignInPasswordless - the magic link is refused as well, so no second door stays open', async () => {
+	await executeTenantTest({
+		query: initSignInPasswordlessMutation({ email }),
+		executes: [
+			getConfigSql({ passwordless_enabled: 'always' }),
+			...sqlTransaction(
+				getConfigSql({ passwordless_enabled: 'always' }),
+				getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				initSignInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login_init',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})
+
+test('createResetPasswordRequest - reports ok but sends nothing, because the password it would set is unusable', async () => {
+	await executeTenantTest({
+		query: createResetPasswordRequestMutation({ email }),
+		executes: [
+			getConfigSql(),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+		],
+		return: {
+			data: {
+				createResetPasswordRequest: {
+					ok: true,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'password_reset_init',
+			personInput: email,
+			personId,
+			response: expect.objectContaining({ ok: true }),
+		},
+	})
+})

package/tests/cases/integration/mocked/personIdentityProviders.test.ts

@@ -278,6 +278,73 @@ test('refuses to disconnect when the only other connection is to a disabled prov
 	})
 })
 
+test('refuses to disconnect a provider that disables local authentication, even though a password remains', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			// the password would be usable again the moment the link is gone, which is exactly the escape to close
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{ id: connectionId, createdAt, externalIdentifier: 'ext-1', slug: 'corporateSso', type: 'oidc', disableLocalAuthentication: true },
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
+test('still refuses while that provider is disabled: break-glass reopens local sign-in, not self-unlinking', async () => {
+	const personId = testUuid(1)
+	const connectionId = testUuid(2)
+	await executeTenantTest({
+		query: disconnectMyIdentityProviderMutation({ id: connectionId }),
+		executes: [
+			getPersonByIdentityForIdp({ identityId: authenticatedIdentityId, personId, passwordHash: 'BCRYPTED-123' }),
+			...sqlTransaction(
+				getPersonIdentityProvidersSql({
+					personId,
+					response: [
+						{
+							id: connectionId,
+							createdAt,
+							externalIdentifier: 'ext-1',
+							slug: 'corporateSso',
+							type: 'oidc',
+							disabledAt: new Date('2021-01-01T00:00:00.000Z'),
+							disableLocalAuthentication: true,
+						},
+					],
+				}),
+			),
+		],
+		return: {
+			data: {
+				disconnectMyIdentityProvider: {
+					ok: false,
+					error: {
+						code: 'IDP_REQUIRED',
+					},
+				},
+			},
+		},
+	})
+})
+
 test('returns NOT_FOUND when the person is not connected to the given connection', async () => {
 	const personId = testUuid(1)
 	await executeTenantTest({

package/tests/cases/integration/mocked/signInAnomalyDetection.test.ts

@@ -3,6 +3,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src/index.js'
 import { Buffer } from 'buffer'
@@ -51,6 +52,7 @@ test('anomaly off by default: a new country does not add any queries (baseline p
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -83,6 +85,7 @@ test('anomaly on, new device only (medium): sends UNUSUAL_LOGIN email, still sig
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// applyRiskPolicy: history (same country, different device → medium 2) then email
@@ -131,6 +134,7 @@ test('anomaly on, new country (high): requires step-up, dispatches email OTP, re
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// history: previously only ever seen in CZ → US is a new country (high, 3) → step-up.
@@ -185,6 +189,7 @@ test('anomaly on, step-up retry with the emailed code: consumes it and signs in
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert; otpToken is ignored here)
 			getAuthPoliciesSql(),
 			// previously only ever seen in CZ → US is a new country (high, 3) → step-up.
@@ -235,6 +240,7 @@ test('anomaly on, step-up retry with a wrong code: INVALID_OTP_TOKEN, no session
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getLoginHistorySql({ personId, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
 			// wrong code: token is found and an attempt is claimed, but validation fails.
@@ -289,6 +295,7 @@ test('anomaly on, step-up scored for a user who already cleared TOTP this reques
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// active TOTP + valid token → verified here (no SQL); mfaSatisfiedThisRequest = true.
 			// applyRiskPolicy: US is a new country (high, 3 → stepUp) BUT MFA already satisfied
 			// this request → NO email-OTP challenge (no sendEmailOtpSql/getLatestEmailOtpTokenSql
@@ -343,6 +350,7 @@ test('anomaly on, new IP prefix only (low): the client IP flows into scoring →
 			recordLoginRateLimitSql(clientIp),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			// history IP is 10.0.0.5 (/24 = 10.0.0.0) → current 203.0.113.9 (/24 = 203.0.113.0)
 			// is a new prefix; country + device match → score 1 → email.
@@ -388,6 +396,7 @@ test('anomaly on, custom historySize flows into the baseline query limit', async
 			anomalyConfig3,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			// limit 3, not the default 10. Same country + device → score 0 → clean.
 			getLoginHistorySql({ personId, limit: 3, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
@@ -422,6 +431,7 @@ test('anomaly on, historySize <= 0 is clamped to a limit of 1', async () => {
 			anomalyConfig0,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getLoginHistorySql({ personId, limit: 1, rows: [{ geoCountry: 'CZ', deviceFingerprint: KNOWN_FINGERPRINT, ip: '10.0.0.5' }] }),
 			anomalyConfig0,
@@ -452,6 +462,7 @@ test('anomaly on, all signals match history: no email, no step-up, signs in clea
 			anomalyConfig,
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// enforceMfaEnrollment (no policies → inert, single query)
 			getAuthPoliciesSql(),
 			// same country, same device → score 0 → allow, no email.

package/tests/cases/integration/mocked/signInIdpClaimMapping.test.ts

@@ -56,6 +56,7 @@ test('claim mapping grants a project membership on sign-in', async () => {
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -143,6 +144,7 @@ test('claim mapping grants a membership with a claim-derived variable (mapped va
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -242,6 +244,7 @@ test('a granted membership whose declared variable resolves to no values keeps t
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -332,6 +335,7 @@ test('sticky sync policy skips re-mapping for an existing person (no membership
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -393,6 +397,7 @@ test('a malformed stored claimMapping is skipped (fail-open) — sign-in succeed
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -456,6 +461,7 @@ test('a claim mapping referencing a non-existent project is skipped, sign-in sti
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -521,6 +527,7 @@ test('unmatched: remove strips a no-longer-granted membership in a mapped projec
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -623,6 +630,7 @@ test('unmatched: remove revokes the whole membership when a declared variable re
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -737,6 +745,7 @@ test('sticky sync policy APPLIES on a brand-new auto-signed-up person', async ()
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -822,6 +831,7 @@ test('unmatched: remove revokes a vocabulary membership even when no rule matche
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -919,6 +929,7 @@ test('unmatched: remove never strips a membership outside the mapping vocabulary
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -1023,6 +1034,7 @@ test('a passthrough claim-derived variable writes only allow-listed values (the
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -1121,6 +1133,7 @@ test('TEST-4: a claimMapping carrying only the OIDC identity-field remap (no rul
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -1177,6 +1190,7 @@ test('a passthrough claim-derived variable with allow:[] writes no variable, kee
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,

package/tests/cases/integration/mocked/signInIdpClaimMappingFixes.test.ts

@@ -60,6 +60,7 @@ test('SEC-1: a grant for a project that does not exist yet is KEPT but inert —
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: { externalIdentifier, email, claims: { department: 'Editorial' }, claimMapping: { rules: [editorRule] } },
 						disabledAt: null,
 						slug: 'mock',
@@ -111,6 +112,7 @@ test('SEC-1: a grant for an EXISTING project whose schema is unresolvable is DRO
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: { externalIdentifier, email, claims: { department: 'Editorial' }, claimMapping: { rules: [editorRule] } },
 						disabledAt: null,
 						slug: 'mock',
@@ -170,6 +172,7 @@ test('TEST-3: a partial drop applies the safe grant AND still emits the fail-ope
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -264,6 +267,7 @@ test('TEST-4: an allow-bounded claim-derived `condition` variable writes ONLY th
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,

package/tests/cases/integration/mocked/signInIdpClaimMappingSafety.test.ts

@@ -81,6 +81,7 @@ test('a DB error during the membership apply rolls back the whole sign-in (no se
 					initReturnsConfig: false,
 					requireVerifiedEmail: false,
 					assumeEmailVerified: false,
+					disableLocalAuthentication: false,
 					configuration: {
 						externalIdentifier,
 						email,
@@ -151,6 +152,7 @@ test('sticky leaves an existing local account being LINKED to the IdP untouched
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -219,6 +221,7 @@ test('apply-time guard drops a grant that would inject a claim into a condition
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -299,6 +302,7 @@ test('TEST-1: under unmatched:remove, a rule dropped by the apply-time guard doe
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -382,6 +386,7 @@ test('SEC: apply-time guard drops an `admin` grant whose claim-derived variable
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -465,6 +470,7 @@ test('SEC: a legitimate `admin` grant (role has no required variable) is still a
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -49,6 +49,7 @@ test('signs in idp with existing identity', async () => {
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						slug: 'mock',
 						type: 'mock',
 					},
@@ -125,6 +126,7 @@ test('does NOT link by e-mail when provider requires a verified e-mail and the c
 						initReturnsConfig: false,
 						requireVerifiedEmail: true,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -204,6 +206,7 @@ test('links by e-mail when provider requires a verified e-mail and the claim is
 						initReturnsConfig: false,
 						requireVerifiedEmail: true,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -291,6 +294,7 @@ test('links by e-mail when require + assumeEmailVerified are set, even though th
 						requireVerifiedEmail: true,
 						// trusted IdP: e-mails are treated as verified even though the claim says false
 						assumeEmailVerified: true,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier,
 							email,
@@ -378,6 +382,7 @@ test('signs in exclusive idp', async () => {
 						initReturnsConfig: false,
 						requireVerifiedEmail: false,
 						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
 						configuration: {
 							externalIdentifier: externalIdentifier,
 							email,

package/tests/cases/integration/mocked/signInMfaEnforcement.test.ts

@@ -3,6 +3,7 @@ import { SQL } from '../../../src/tags.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
@@ -48,6 +49,7 @@ test('MFA required + no factor + no code → MFA_ENROLLMENT_REQUIRED with pendin
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration: the matched policy has no
@@ -113,6 +115,7 @@ test('MFA required + valid pending code → enrolls (pending→active), returns
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration from the global config default.
@@ -173,6 +176,7 @@ test('MFA required + invalid pending code → INVALID_OTP_TOKEN', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpPendingUri: pendingUri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Enforcement resolves the grace duration from the global config default.
@@ -206,6 +210,7 @@ test('active TOTP + requiring policy → existing OTP_REQUIRED path (policy not
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'], otpUri } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -241,6 +246,7 @@ test('MFA required + per-policy grace → opens grace window, sets mfa_grace_unt
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			gracePolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// Per-policy grace override is present → the global config is NOT read here.
@@ -288,6 +294,7 @@ test('MFA required + no policy grace override → global config default opens th
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: ['editor'] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			requiringPolicy(),
 			getAllProjectRolesByIdentitySql({ identityId }),
 			// No per-policy override → the global config default is read; here it is