@contember/engine-tenant-api 2.2.0-alpha.5 → 2.2.0-alpha.7

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -4,6 +4,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { SignInErrorCode } from '../../../../src/schema/index.js'
 import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src/index.js'
@@ -31,6 +32,7 @@ test('signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -94,6 +96,7 @@ test('signs in - normalize email', async () => {
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -137,6 +140,7 @@ test('sign in - invalid password', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -170,6 +174,7 @@ test('sign in - email not verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: null },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -205,6 +210,7 @@ test('sign in - email verification required but already verified', async () => {
 				email,
 				response: { personId, identityId, password, roles: [], emailVerificationRequired: true, emailVerifiedAt: now },
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -253,6 +259,7 @@ test('otp token not provided', async () => {
 					otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember',
 				},
 			}),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -290,6 +297,7 @@ test('sign in - invalid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 		],
 		return: {
 			data: {
@@ -327,6 +335,7 @@ test('sign in - valid otp token', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
 			getAuthPoliciesSql(),
@@ -380,6 +389,7 @@ test('sign in - valid backup code (when OTP is required)', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: true }),
 			countUnusedBackupCodesSql({ personId, count: 4 }),
 			getConfigSql(),
@@ -432,6 +442,7 @@ test('sign in - email OTP enabled, no code provided: dispatches a code and retur
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			// signIn lazily re-fetches the config to resolve the email-OTP send rate limit.
 			getConfigSql(),
 			...sendEmailOtpSql({ personId, rateLimitEventId: testUuid(1), tokenId: testUuid(2) }),
@@ -475,6 +486,7 @@ test('sign in - email OTP enabled, valid code: signs in', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 			consumeEmailOtpTokenSql({ tokenId }),
@@ -515,6 +527,7 @@ test('sign in - email OTP enabled, invalid code: INVALID_OTP_TOKEN', async () =>
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], emailOtpEnabled: true } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getLatestEmailOtpTokenSql({ personId, tokenId }),
 			claimEmailOtpAttemptSql({ tokenId }),
 		],
@@ -550,6 +563,7 @@ test('sign in - already-used backup code is rejected', async () => {
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			localAuthDisablingIdpsSql({ personId }),
 			consumeBackupCodeSql({ personId, codeHash: BACKUP_CODE_HASH, consumed: false }),
 		],
 		return: {

package/tests/cases/integration/mocked/signInPasswordlessMutation.test.ts

@@ -6,6 +6,7 @@ import { signInPasswordlessMutation } from './gql/passwordless.js'
 import { computeTokenHash } from '../../../../src/index.js'
 import { sqlTransaction } from './sql/sqlTransaction.js'
 import { getPersonByIdSql } from './sql/getPersonByIdSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { getConfigSql } from './sql/getConfigSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -54,6 +55,7 @@ test('signInPasswordless - marks an unverified email verified before issuing the
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: null },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -110,6 +112,7 @@ test('signInPasswordless - skips the email-verified update when already verified
 					personId,
 					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
 				}),
+				localAuthDisablingIdpsSql({ personId }),
 				{
 					sql: SQL`UPDATE "tenant"."person_token" SET "used_at" = ? WHERE "id" = ? AND "used_at" IS NULL`,
 					parameters: [isDate, requestId],
@@ -144,3 +147,36 @@ test('signInPasswordless - skips the email-verified update when already verified
 		},
 	})
 })
+
+test('signInPasswordless - a link created while the magic link was in flight still refuses the session', async () => {
+	const requestId = testUuid(1)
+	const personId = testUuid(2)
+	const identityId = testUuid(3)
+	const token = 'passwordless-token'
+	await executeTenantTest({
+		query: signInPasswordlessMutation({ requestId, token, validationType: 'token' }),
+		executes: [
+			...sqlTransaction(
+				personTokenByIdSql({ requestId, personId, token }),
+				getPersonByIdSql({
+					personId,
+					response: { personId, identityId, password: '123', roles: [], email: 'john@doe.com', emailVerifiedAt: now },
+				}),
+				localAuthDisablingIdpsSql({ personId, slugs: ['corporateSso'] }),
+			),
+		],
+		return: {
+			data: {
+				signInPasswordless: {
+					ok: false,
+					error: { code: 'IDP_REQUIRED' },
+					result: null,
+				},
+			},
+		},
+		expectedAuthLog: {
+			type: 'passwordless_login',
+			response: expect.objectContaining({ ok: false }),
+		},
+	})
+})

package/tests/cases/integration/mocked/sql/getIdpBySlugSql.ts

@@ -7,7 +7,7 @@ export const getIdpBySlugSql = (args: {
 	response: null | IdentityProviderRow
 }): ExpectedQuery => ({
 	sql:
-		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified"
+		SQL`select "id", "slug", "type", "configuration", "disabled_at" as "disabledAt", "auto_sign_up" as "autoSignUp", "exclusive", "init_returns_config" as "initReturnsConfig", "require_verified_email" as "requireVerifiedEmail", "assume_email_verified" as "assumeEmailVerified", "disable_local_authentication" as "disableLocalAuthentication"
 		from "tenant"."identity_provider"
 		where "slug" = ?`,
 	parameters: [args.slug],

package/tests/cases/integration/mocked/sql/localAuthDisablingIdpsSql.ts

@@ -0,0 +1,21 @@
+import { ExpectedQuery } from '@contember/database-tester'
+import { SQL } from '../../../../src/tags.js'
+
+/**
+ * The `LocalAuthDisablingIdpsQuery` lookup every local authentication path runs.
+ * `slugs` defaults to none, i.e. local authentication stays available.
+ */
+export const localAuthDisablingIdpsSql = (args: {
+	personId: string
+	slugs?: string[]
+}): ExpectedQuery => ({
+	sql: SQL`SELECT "identity_provider"."slug" AS "slug"
+	         FROM "tenant"."person_identity_provider"
+		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
+	         WHERE "person_identity_provider"."person_id" = ? AND "identity_provider"."disable_local_authentication" = ? AND "identity_provider"."disabled_at" IS NULL
+	         ORDER BY "identity_provider"."slug" ASC`,
+	parameters: [args.personId, true],
+	response: {
+		rows: (args.slugs ?? []).map(slug => ({ slug })),
+	},
+})

package/tests/cases/integration/mocked/sql/personIdentityProvidersSql.ts

@@ -8,6 +8,7 @@ export interface PersonIdpConnectionRow {
 	slug: string
 	type: string
 	disabledAt?: Date | null
+	disableLocalAuthentication?: boolean
 }
 
 export const getPersonIdentityProvidersSql = (args: {
@@ -15,7 +16,7 @@ export const getPersonIdentityProvidersSql = (args: {
 	response: PersonIdpConnectionRow[]
 }): ExpectedQuery => ({
 	sql:
-		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt"
+		SQL`SELECT "person_identity_provider"."id", "person_identity_provider"."created_at" as "createdAt", "person_identity_provider"."external_identifier" as "externalIdentifier", "identity_provider"."slug" as "identityProviderSlug", "identity_provider"."type" as "identityProviderType", "identity_provider"."disabled_at" as "identityProviderDisabledAt", "identity_provider"."disable_local_authentication" as "identityProviderDisableLocalAuthentication"
 	         FROM "tenant"."person_identity_provider"
 		              INNER JOIN "tenant"."identity_provider" AS "identity_provider" ON "identity_provider"."id" = "person_identity_provider"."identity_provider_id"
 	         WHERE "person_id" = ?
@@ -29,6 +30,7 @@ export const getPersonIdentityProvidersSql = (args: {
 			identityProviderSlug: it.slug,
 			identityProviderType: it.type,
 			identityProviderDisabledAt: it.disabledAt ?? null,
+			identityProviderDisableLocalAuthentication: it.disableLocalAuthentication ?? false,
 		})),
 	},
 })

package/tests/cases/integration/mocked/trustForwardedClientInfo.test.ts

@@ -3,6 +3,7 @@ import { testUuid } from '../../../src/testUuid.js'
 import { selectMembershipsSql } from './sql/selectMembershipsSql.js'
 import { signInMutation } from './gql/signIn.js'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql.js'
+import { localAuthDisablingIdpsSql } from './sql/localAuthDisablingIdpsSql.js'
 import { expect, test } from 'bun:test'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql.js'
@@ -29,6 +30,7 @@ test('signIn: trustForwardedClientInfo=true is propagated when caller has the fl
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),
@@ -68,6 +70,7 @@ test('signIn: trustForwardedClientInfo=true is silently dropped when caller has
 			getConfigSql(),
 			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			localAuthDisablingIdpsSql({ personId }),
 			getAuthPoliciesSql(),
 			getConfigSql(),
 			getIdentityByIdSql({ identityId }),

package/tests/cases/unit/idp/claimIdpRevalidation.test.ts

@@ -0,0 +1,50 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers } from '../../../../src/index.js'
+import { ClaimIdpRevalidationCommand } from '../../../../src/model/commands/idp/ClaimIdpRevalidationCommand.js'
+
+const providers: Providers = {
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-05-26T12:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt: async value => ({ value, version: 1 }),
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const execute = async (expectedQuery: ExpectedQuery): Promise<boolean> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+
+	const claimed = await db.commandBus.execute(new ClaimIdpRevalidationCommand('idp-session-1', '30 seconds'))
+
+	expect(expectedQueries).toHaveLength(0)
+	return claimed
+}
+
+// The table must be schema-qualified: the tenant schema is not on the connection's search_path,
+// so an unqualified name makes the claim fail on every request, and the caller treats that as
+// "somebody else holds the claim" — re-validation then never runs at all.
+test('the claim is issued against the qualified tenant table', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 1 },
+	})
+
+	expect(claimed).toBe(true)
+})
+
+test('a session still inside the throttle window is not claimed', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 0 },
+	})
+
+	expect(claimed).toBe(false)
+})

package/tests/cases/unit/idp/idpManagerUnknownConfigKeys.test.ts

@@ -10,7 +10,14 @@ import { DatabaseContext } from '../../../../src/index.js'
 // no network), so the real provider can be used here rather than a pass-through double.
 
 const OIDC_BASE = { url: 'https://idp.example.com', clientId: 'client', clientSecret: 'secret' }
-const OPTIONS = { autoSignUp: false, exclusive: false, initReturnsConfig: false, requireVerifiedEmail: false, assumeEmailVerified: false }
+const OPTIONS = {
+	autoSignUp: false,
+	exclusive: false,
+	initReturnsConfig: false,
+	requireVerifiedEmail: false,
+	assumeEmailVerified: false,
+	disableLocalAuthentication: false,
+}
 
 const makeManager = () => {
 	const registry = new IDPHandlerRegistry()