@contember/engine-tenant-api 2.2.0-alpha.5 → 2.2.0-alpha.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.5",
+  "version": "2.2.0-alpha.7",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.5",
-    "@contember/config-loader": "2.2.0-alpha.5",
-    "@contember/database": "2.2.0-alpha.5",
-    "@contember/database-migrations": "2.2.0-alpha.5",
-    "@contember/dic": "2.2.0-alpha.5",
-    "@contember/graphql-utils": "2.2.0-alpha.5",
-    "@contember/logger": "2.2.0-alpha.5",
-    "@contember/schema": "2.2.0-alpha.5",
-    "@contember/schema-utils": "2.2.0-alpha.5",
-    "@contember/typesafe": "2.2.0-alpha.5",
+    "@contember/authorization": "2.2.0-alpha.7",
+    "@contember/config-loader": "2.2.0-alpha.7",
+    "@contember/database": "2.2.0-alpha.7",
+    "@contember/database-migrations": "2.2.0-alpha.7",
+    "@contember/dic": "2.2.0-alpha.7",
+    "@contember/graphql-utils": "2.2.0-alpha.7",
+    "@contember/logger": "2.2.0-alpha.7",
+    "@contember/schema": "2.2.0-alpha.7",
+    "@contember/schema-utils": "2.2.0-alpha.7",
+    "@contember/typesafe": "2.2.0-alpha.7",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.5",
+    "@contember/database-tester": "2.2.0-alpha.7",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts

@@ -0,0 +1,18 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+-- When TRUE, a person linked to this identity provider may authenticate ONLY through
+-- it: password sign-in, passwordless sign-in and password-reset mails are refused for
+-- them. The link itself is the marker, so it also covers a person who predates the
+-- provider and got linked by e-mail matching.
+--
+-- Scoped to providers that are currently enabled: disabling the provider restores
+-- local authentication for everyone linked to it, which is the break-glass for an IdP
+-- outage. Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "disable_local_authentication" BOOLEAN NOT NULL DEFAULT FALSE;
+`
+
+export default async function(builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -65,6 +65,7 @@ import _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'
 import _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'
 import _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'
 import _20260804120000configpanel from './2026-08-04-120000-config-panel.js'
+import _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'
 import snapshot from './snapshot.js'
 import { computeTokenHash, Providers } from '../model/index.js'
 import { Logger } from '@contember/logger'
@@ -153,6 +154,7 @@ const migrations = {
 	'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,
 	'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,
 	'2026-08-04-120000-config-panel': _20260804120000configpanel,
+	'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot.ts

@@ -204,7 +204,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,

package/src/model/commands/idp/ClaimIdpRevalidationCommand.ts

@@ -1,3 +1,4 @@
+import { UpdateBuilder } from '@contember/database'
 import { Command } from '../Command.js'
 
 /**
@@ -17,12 +18,12 @@ export class ClaimIdpRevalidationCommand implements Command<boolean> {
 	}
 
 	async execute({ db }: Command.Args): Promise<boolean> {
-		const result = await db.query(
-			`UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-			[this.id, this.interval],
-		)
-		return (result.rowCount ?? 0) > 0
+		const qb = UpdateBuilder.create()
+			.table('idp_session')
+			.where({ id: this.id })
+			.where(expr => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval))
+			.values({ last_validated_at: expr => expr.raw('now()') })
+
+		return (await qb.execute(db)) > 0
 	}
 }

package/src/model/commands/idp/CreateIdpCommand.ts

@@ -9,7 +9,12 @@ export class CreateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db, providers }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data
+		const {
+			configuration,
+			options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+			slug,
+			type,
+		} = this.data
 		await InsertBuilder.create()
 			.into('identity_provider')
 			.values({
@@ -22,6 +27,7 @@ export class CreateIdpCommand implements Command<void> {
 				init_returns_config: initReturnsConfig,
 				require_verified_email: requireVerifiedEmail,
 				assume_email_verified: assumeEmailVerified,
+				disable_local_authentication: disableLocalAuthentication,
 			})
 			.execute(db)
 	}

package/src/model/commands/idp/UpdateIdpCommand.ts

@@ -10,7 +10,10 @@ export class UpdateIdpCommand implements Command<void> {
 	}
 
 	async execute({ db }: Command.Args): Promise<void> {
-		const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data
+		const {
+			configuration,
+			options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {},
+		} = this.data
 		await UpdateBuilder.create()
 			.table('identity_provider')
 			.values({
@@ -20,6 +23,7 @@ export class UpdateIdpCommand implements Command<void> {
 				init_returns_config: initReturnsConfig,
 				require_verified_email: requireVerifiedEmail,
 				assume_email_verified: assumeEmailVerified,
+				disable_local_authentication: disableLocalAuthentication,
 			})
 			.where({
 				id: this.id,

package/src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts

@@ -0,0 +1,41 @@
+import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'
+
+/**
+ * Slugs of the identity providers that forbid this person every local
+ * authentication method — password sign-in, passwordless sign-in and the
+ * password-reset mail. Empty means local authentication is available.
+ *
+ * The IdP link is the marker, so this also covers a person who predates the
+ * provider and was linked to it by e-mail matching, not only one created by
+ * auto-sign-up. A DISABLED provider does not count: turning the provider off
+ * hands local authentication back to everyone linked to it, which is the
+ * break-glass when the IdP is unreachable.
+ */
+export class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {
+	constructor(
+		private readonly personId: string,
+	) {
+		super()
+	}
+
+	async fetch({ db }: DatabaseQueryable): Promise<string[]> {
+		const rows = await SelectBuilder.create<{ slug: string }>()
+			.select(['identity_provider', 'slug'], 'slug')
+			.from('person_identity_provider')
+			.join(
+				'identity_provider',
+				'identity_provider',
+				expr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),
+			)
+			.where(where =>
+				where
+					.compare(['person_identity_provider', 'person_id'], Operator.eq, this.personId)
+					.compare(['identity_provider', 'disable_local_authentication'], Operator.eq, true)
+					.isNull(['identity_provider', 'disabled_at'])
+			)
+			.orderBy(['identity_provider', 'slug'])
+			.getResult(db)
+
+		return rows.map(it => it.slug)
+	}
+}

package/src/model/queries/idp/PersonIdentityProvidersQuery.ts

@@ -7,6 +7,7 @@ export interface PersonIdentityProviderRow {
 	readonly identityProviderSlug: string
 	readonly identityProviderType: string
 	readonly identityProviderDisabledAt: Date | null
+	readonly identityProviderDisableLocalAuthentication: boolean
 }
 
 /**
@@ -29,6 +30,7 @@ export class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityPr
 			.select(['identity_provider', 'slug'], 'identityProviderSlug')
 			.select(['identity_provider', 'type'], 'identityProviderType')
 			.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')
+			.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')
 			.from('person_identity_provider')
 			.join(
 				'identity_provider',

package/src/model/queries/idp/helpers.ts

@@ -13,13 +13,14 @@ export const createBaseIdpQuery = () =>
 		.select('init_returns_config', 'initReturnsConfig')
 		.select('require_verified_email', 'requireVerifiedEmail')
 		.select('assume_email_verified', 'assumeEmailVerified')
+		.select('disable_local_authentication', 'disableLocalAuthentication')
 		.from('identity_provider')
 
 export const createIdpDto = (
-	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,
+	{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,
 ): IdentityProviderDto => {
 	return {
 		...row,
-		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },
+		options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
 	}
 }

package/src/model/queries/idp/index.ts

@@ -3,4 +3,5 @@ export * from './IdentityProvidersQuery.js'
 export * from './IdpSessionByApiKeyQuery.js'
 export * from './IdpSessionsBySidQuery.js'
 export * from './IdpSessionsBySubQuery.js'
+export * from './LocalAuthDisablingIdpsQuery.js'
 export * from './PersonIdentityProvidersQuery.js'

package/src/model/queries/idp/types.ts

@@ -11,6 +11,7 @@ export type IdentityProviderRow = {
 	initReturnsConfig: boolean
 	requireVerifiedEmail: boolean
 	assumeEmailVerified: boolean
+	disableLocalAuthentication: boolean
 }
 
 export type IdentityProviderDto =

package/src/model/service/PasswordResetManager.ts

@@ -1,6 +1,6 @@
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
 import { UserMailer } from '../mailing/index.js'
-import { ConfigurationQuery, PersonRow } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonRow } from '../queries/index.js'
 import { PermissionContext } from '../authorization/index.js'
 import { ProjectManager } from './ProjectManager.js'
 import { DatabaseContext } from '../utils/index.js'
@@ -35,6 +35,14 @@ export class PasswordResetManager {
 			throw new ImplementationException()
 		}
 
+		// A person federated through a provider with `disableLocalAuthentication`
+		// cannot sign in with a password, so a reset mail would only offer them a
+		// credential the tenant refuses — and one more link worth phishing.
+		const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+		if (exclusiveIdps.length > 0) {
+			return
+		}
+
 		// Per-email exponential backoff on outbound mails — don't spam a real
 		// user with reset mails just because attackers keep poking the
 		// endpoint. Reuses login_* backoff config against person_auth_log.

package/src/model/service/PasswordlessSignInManager.ts

@@ -1,5 +1,5 @@
 import { ApiKeyManager } from './apiKey/index.js'
-import { ConfigurationQuery, PersonQuery, PersonRow } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow } from '../queries/index.js'
 import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
 import {
 	ActivatePasswordlessOtpErrorCode,
@@ -62,6 +62,16 @@ class PasswordlessSignInManager {
 					}),
 				})
 			}
+			const exclusiveIdps = await db.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+			if (exclusiveIdps.length > 0) {
+				return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personInput: email,
+						personId: person.id,
+					}),
+				})
+			}
+
 			if (!isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
 				return new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {
 					[AuthLogService.Key]: new AuthLogService.Bag({
@@ -185,6 +195,18 @@ class PasswordlessSignInManager {
 				})
 			}
 
+			// Re-checked here and not only at init: a link created while this magic link
+			// was in flight would otherwise still mint a locally authenticated session.
+			const exclusiveIdps = await db.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(personRow.id))
+			if (exclusiveIdps.length > 0) {
+				return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, {
+					[AuthLogService.Key]: new AuthLogService.Bag({
+						personId: personRow.id,
+						tokenId: tokenResult?.id,
+					}),
+				})
+			}
+
 			let usedBackupCode = false
 			if (personRow.otp_secret && personRow.otp_activated_at) {
 				if (mfaOtp) {

package/src/model/service/SignInManager.ts

@@ -1,6 +1,6 @@
 import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'
 import { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'
-import { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'
+import { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'
 import { Config } from '../type/Config.js'
 import { Providers } from '../providers.js'
 import { DatabaseContext } from '../utils/index.js'
@@ -51,6 +51,14 @@ class SignInManager {
 				personId: person.id,
 			}),
 		}
+		// Refused before the password is even looked at: for a person federated
+		// through a provider with `disableLocalAuthentication`, a password is not a
+		// credential this tenant accepts, however it got set.
+		const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))
+		if (exclusiveIdps.length > 0) {
+			return new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, authLogData)
+		}
+
 		if (!person.password_hash) {
 			return new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)
 		}

package/src/model/service/idp/PersonIdentityProviderManager.ts

@@ -29,6 +29,14 @@ export class PersonIdentityProviderManager {
 				return new ResponseError('NOT_FOUND', `You are not connected to the identity provider connection "${connectionId}".`)
 			}
 
+			// The link is what binds the person to the provider's policy, so they cannot remove it themselves.
+			if (connection.identityProviderDisableLocalAuthentication) {
+				return new ResponseError(
+					'IDP_REQUIRED',
+					`The identity provider "${connection.identityProviderSlug}" is the only way you may sign in; its connection cannot be removed.`,
+				)
+			}
+
 			const configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))
 			const hasPassword = person.password_hash !== null
 			const hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)

package/src/model/type/IdentityProvider.ts

@@ -11,4 +11,6 @@ export interface IdentityProviderOptions {
 	initReturnsConfig: boolean
 	requireVerifiedEmail: boolean
 	assumeEmailVerified: boolean
+	/** A person linked to this provider may authenticate only through it. */
+	disableLocalAuthentication: boolean
 }

package/src/resolvers/mutation/idp/AddIDPMutationResolver.ts

@@ -26,6 +26,7 @@ export class AddIDPMutationResolver implements MutationResolvers {
 				initReturnsConfig: args.options?.initReturnsConfig ?? false,
 				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? false,
 				assumeEmailVerified: args.options?.assumeEmailVerified ?? false,
+				disableLocalAuthentication: args.options?.disableLocalAuthentication ?? false,
 			},
 		})
 		if (!result.ok) {

package/src/resolvers/mutation/idp/UpdateIDPMutationResolver.ts

@@ -26,6 +26,7 @@ export class UpdateIDPMutationResolver implements MutationResolvers {
 				initReturnsConfig: args.options?.initReturnsConfig ?? undefined,
 				requireVerifiedEmail: args.options?.requireVerifiedEmail ?? undefined,
 				assumeEmailVerified: args.options?.assumeEmailVerified ?? undefined,
+				disableLocalAuthentication: args.options?.disableLocalAuthentication ?? undefined,
 			},
 		}, args.mergeConfiguration ?? false)
 		if (!result.ok) {

package/src/resolvers/mutation/idp/audit.ts

@@ -14,6 +14,7 @@ export const idpRowToAuditSnapshot = (row: IdentityProviderRow | null): JSONValu
 		initReturnsConfig: row.initReturnsConfig,
 		requireVerifiedEmail: row.requireVerifiedEmail,
 		assumeEmailVerified: row.assumeEmailVerified,
+		disableLocalAuthentication: row.disableLocalAuthentication,
 		configurationKeys: Object.keys(row.configuration).sort(),
 	}
 }

package/src/resolvers/mutation/person/PasswordlessMutationResolver.ts

@@ -68,6 +68,13 @@ export class PasswordlessMutationResolver
 				// If the user does not exist, we don't want to reveal that
 				return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
 			}
+			// Naming the provider tells the caller both that the person exists and how
+			// they authenticate, so it needs both reveal flags. PASSWORDLESS_DISABLED is
+			// the neutral answer this endpoint already gives for an unknown address.
+			const { revealUserExists, revealLoginMethod } = configuration.login
+			if (result.error === 'IDP_REQUIRED' && !(revealUserExists && revealLoginMethod)) {
+				return createErrorResponse('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')
+			}
 
 			return createErrorResponse(result.error, result.errorMessage)
 		}

package/src/resolvers/mutation/person/SignInMutationResolver.ts

@@ -108,10 +108,10 @@ export class SignInMutationResolver implements MutationResolvers {
 		if (!response.ok) {
 			const { revealUserExists, revealLoginMethod } = configuration.login
 			const collapseAll = !revealUserExists
-				&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL'].includes(response.error)
+				&& ['NO_PASSWORD_SET', 'PERSON_DISABLED', 'INVALID_PASSWORD', 'UNKNOWN_EMAIL', 'IDP_REQUIRED'].includes(response.error)
 			const collapseMethodOnly = revealUserExists
 				&& !revealLoginMethod
-				&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD'].includes(response.error)
+				&& ['NO_PASSWORD_SET', 'INVALID_PASSWORD', 'IDP_REQUIRED'].includes(response.error)
 			if (collapseAll || collapseMethodOnly) {
 				return createErrorResponse('INVALID_CREDENTIALS', 'Invalid credentials')
 			}

package/src/schema/index.ts

@@ -948,6 +948,11 @@ export type DisconnectIdpError = {
 }
 
 export type DisconnectIdpErrorCode =
+	/**
+	 * The provider has `disableLocalAuthentication`, so this connection is the only way
+	 * the person may sign in and cannot be removed by them — not even while the provider is disabled.
+	 */
+	| 'IDP_REQUIRED'
 	/**  The person is not allowed to disconnect their last remaining sign-in method.  */
 	| 'LAST_AUTH_METHOD'
 	/**  The caller is not a person (e.g. an API key) and so has no IdP connections to disconnect.  */
@@ -1013,6 +1018,7 @@ export type ForceSignOutPersonResponse = {
 export type IdpOptions = {
 	readonly assumeEmailVerified?: InputMaybe<Scalars['Boolean']['input']>
 	readonly autoSignUp?: InputMaybe<Scalars['Boolean']['input']>
+	readonly disableLocalAuthentication?: InputMaybe<Scalars['Boolean']['input']>
 	readonly exclusive?: InputMaybe<Scalars['Boolean']['input']>
 	readonly initReturnsConfig?: InputMaybe<Scalars['Boolean']['input']>
 	readonly requireVerifiedEmail?: InputMaybe<Scalars['Boolean']['input']>
@@ -1027,6 +1033,13 @@ export type IdpOptionsOutput = {
 	 */
 	readonly assumeEmailVerified: Scalars['Boolean']['output']
 	readonly autoSignUp: Scalars['Boolean']['output']
+	/**
+	 * When true, a person linked to this provider may authenticate ONLY through it:
+	 * password sign-in and passwordless sign-in are refused and no password-reset
+	 * mail is sent. Disabling the provider lifts the restriction, which is the
+	 * break-glass for an IdP outage. Defaults to false.
+	 */
+	readonly disableLocalAuthentication: Scalars['Boolean']['output']
 	readonly exclusive: Scalars['Boolean']['output']
 	readonly initReturnsConfig: Scalars['Boolean']['output']
 	/**
@@ -1169,6 +1182,11 @@ export type InitSignInPasswordlessError = {
 }
 
 export type InitSignInPasswordlessErrorCode =
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so passwordless sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_CAPTCHA'
 	| 'PASSWORDLESS_DISABLED'
 	| 'PERSON_NOT_FOUND'
@@ -2150,6 +2168,11 @@ export type SignInError = {
 
 export type SignInErrorCode =
 	| 'EMAIL_NOT_VERIFIED'
+	/**
+	 * The person is linked to an identity provider with
+	 * `disableLocalAuthentication`, so password sign-in is not available to them.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_CREDENTIALS'
 	| 'INVALID_OTP_TOKEN'
 	| 'INVALID_PASSWORD'
@@ -2214,6 +2237,11 @@ export type SignInPasswordlessError = {
 }
 
 export type SignInPasswordlessErrorCode =
+	/**
+	 * The person became linked to an identity provider with
+	 * `disableLocalAuthentication` after this magic link was issued.
+	 */
+	| 'IDP_REQUIRED'
 	| 'INVALID_OTP_TOKEN'
 	| 'MFA_ENROLLMENT_REQUIRED'
 	| 'OTP_REQUIRED'
@@ -3772,6 +3800,7 @@ export type IdpOptionsOutputResolvers<
 > = {
 	assumeEmailVerified?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	autoSignUp?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
+	disableLocalAuthentication?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	exclusive?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	initReturnsConfig?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>
 	requireVerifiedEmail?: Resolver<ResolversTypes['Boolean'], ParentType, ContextType>

package/src/schema/tenant.graphql.ts

@@ -566,6 +566,11 @@ const schema: DocumentNode = gql`
 		MFA_ENROLLMENT_REQUIRED
 		EMAIL_NOT_VERIFIED
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so password sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInResult implements CommonSignInResult {
@@ -867,6 +872,11 @@ const schema: DocumentNode = gql`
 		NOT_A_PERSON
 		""" The person is not allowed to disconnect their last remaining sign-in method. """
 		LAST_AUTH_METHOD
+		"""
+		The provider has \`disableLocalAuthentication\`, so this connection is the only way
+		the person may sign in and cannot be removed by them — not even while the provider is disabled.
+		"""
+		IDP_REQUIRED
 	}
 
 	type IdentityProvider {
@@ -893,6 +903,13 @@ const schema: DocumentNode = gql`
 		Defaults to false.
 		"""
 		assumeEmailVerified: Boolean!
+		"""
+		When true, a person linked to this provider may authenticate ONLY through it:
+		password sign-in and passwordless sign-in are refused and no password-reset
+		mail is sent. Disabling the provider lifts the restriction, which is the
+		break-glass for an IdP outage. Defaults to false.
+		"""
+		disableLocalAuthentication: Boolean!
 	}
 
 	input IDPOptions {
@@ -901,6 +918,7 @@ const schema: DocumentNode = gql`
 		initReturnsConfig: Boolean
 		requireVerifiedEmail: Boolean
 		assumeEmailVerified: Boolean
+		disableLocalAuthentication: Boolean
 	}
 
 	# === passwordless sign in ===
@@ -922,6 +940,11 @@ const schema: DocumentNode = gql`
 		PASSWORDLESS_DISABLED
 		INVALID_CAPTCHA
 		RATE_LIMIT_EXCEEDED
+		"""
+		The person is linked to an identity provider with
+		\`disableLocalAuthentication\`, so passwordless sign-in is not available to them.
+		"""
+		IDP_REQUIRED
 	}
 	
 	type InitSignInPasswordlessResult {
@@ -959,6 +982,11 @@ const schema: DocumentNode = gql`
 		OTP_REQUIRED
 		INVALID_OTP_TOKEN
 		MFA_ENROLLMENT_REQUIRED
+		"""
+		The person became linked to an identity provider with
+		\`disableLocalAuthentication\` after this magic link was issued.
+		"""
+		IDP_REQUIRED
 	}
 
 	type SignInPasswordlessResult implements CommonSignInResult {

package/tests/cases/integration/mocked/gql/passwordless.ts

@@ -21,3 +21,13 @@ export const signInPasswordlessMutation = (
 	}`,
 	variables,
 })
+
+export const initSignInPasswordlessMutation = (variables: { email: string }): GraphQLTestQuery => ({
+	query: GQL`mutation($email: String!) {
+		initSignInPasswordless(email: $email) {
+			ok
+			error { code }
+		}
+	}`,
+	variables,
+})

package/tests/cases/integration/mocked/idpClaimMappingConfig.test.ts

@@ -72,7 +72,7 @@ test('addIDP accepts a claimMapping whose membership role IS defined in the proj
 			...sqlTransaction(
 				{
 					sql:
-						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"  from "tenant"."identity_provider"  where "slug" = ?',
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
 					parameters: ['oidc'],
 					response: { rows: [{ id: '123', slug: 'oidc' }] },
 				},
@@ -227,7 +227,7 @@ test('addIDP accepts a condition variable bounded by an allow allowlist plus a v
 			...sqlTransaction(
 				{
 					sql:
-						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"  from "tenant"."identity_provider"  where "slug" = ?',
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
 					parameters: ['oidc'],
 					response: { rows: [{ id: '123', slug: 'oidc' }] },
 				},
@@ -274,7 +274,7 @@ test('addIDP accepts a condition variable whose constant value IS a valid condit
 			...sqlTransaction(
 				{
 					sql:
-						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"  from "tenant"."identity_provider"  where "slug" = ?',
+						'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
 					parameters: ['oidc'],
 					response: { rows: [{ id: '123', slug: 'oidc' }] },
 				},
@@ -305,7 +305,7 @@ test('updateIDP runs the same claimMapping validation (rejects a merged-in grant
 	}
 	const selectIdp = {
 		sql:
-			'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"  from "tenant"."identity_provider"  where "slug" = ?',
+			'select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"  from "tenant"."identity_provider"  where "slug" = ?',
 		parameters: ['mock'],
 		response: { rows: [idpRow] },
 	}