@contember/engine-tenant-api 2.2.0-alpha.6 → 2.2.0-alpha.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.6",
+  "version": "2.2.0-alpha.7",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.6",
-    "@contember/config-loader": "2.2.0-alpha.6",
-    "@contember/database": "2.2.0-alpha.6",
-    "@contember/database-migrations": "2.2.0-alpha.6",
-    "@contember/dic": "2.2.0-alpha.6",
-    "@contember/graphql-utils": "2.2.0-alpha.6",
-    "@contember/logger": "2.2.0-alpha.6",
-    "@contember/schema": "2.2.0-alpha.6",
-    "@contember/schema-utils": "2.2.0-alpha.6",
-    "@contember/typesafe": "2.2.0-alpha.6",
+    "@contember/authorization": "2.2.0-alpha.7",
+    "@contember/config-loader": "2.2.0-alpha.7",
+    "@contember/database": "2.2.0-alpha.7",
+    "@contember/database-migrations": "2.2.0-alpha.7",
+    "@contember/dic": "2.2.0-alpha.7",
+    "@contember/graphql-utils": "2.2.0-alpha.7",
+    "@contember/logger": "2.2.0-alpha.7",
+    "@contember/schema": "2.2.0-alpha.7",
+    "@contember/schema-utils": "2.2.0-alpha.7",
+    "@contember/typesafe": "2.2.0-alpha.7",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.6",
+    "@contember/database-tester": "2.2.0-alpha.7",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/model/commands/idp/ClaimIdpRevalidationCommand.ts

@@ -1,3 +1,4 @@
+import { UpdateBuilder } from '@contember/database'
 import { Command } from '../Command.js'
 
 /**
@@ -17,12 +18,12 @@ export class ClaimIdpRevalidationCommand implements Command<boolean> {
 	}
 
 	async execute({ db }: Command.Args): Promise<boolean> {
-		const result = await db.query(
-			`UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-			[this.id, this.interval],
-		)
-		return (result.rowCount ?? 0) > 0
+		const qb = UpdateBuilder.create()
+			.table('idp_session')
+			.where({ id: this.id })
+			.where(expr => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval))
+			.values({ last_validated_at: expr => expr.raw('now()') })
+
+		return (await qb.execute(db)) > 0
 	}
 }

package/tests/cases/unit/idp/claimIdpRevalidation.test.ts

@@ -0,0 +1,50 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers } from '../../../../src/index.js'
+import { ClaimIdpRevalidationCommand } from '../../../../src/model/commands/idp/ClaimIdpRevalidationCommand.js'
+
+const providers: Providers = {
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-05-26T12:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt: async value => ({ value, version: 1 }),
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const execute = async (expectedQuery: ExpectedQuery): Promise<boolean> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+
+	const claimed = await db.commandBus.execute(new ClaimIdpRevalidationCommand('idp-session-1', '30 seconds'))
+
+	expect(expectedQueries).toHaveLength(0)
+	return claimed
+}
+
+// The table must be schema-qualified: the tenant schema is not on the connection's search_path,
+// so an unqualified name makes the claim fail on every request, and the caller treats that as
+// "somebody else holds the claim" — re-validation then never runs at all.
+test('the claim is issued against the qualified tenant table', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 1 },
+	})
+
+	expect(claimed).toBe(true)
+})
+
+test('a session still inside the throttle window is not claimed', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 0 },
+	})
+
+	expect(claimed).toBe(false)
+})