@contember/engine-tenant-api 2.2.0-alpha.6 → 2.2.0-alpha.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.6",
+  "version": "2.2.0-alpha.8",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.6",
-    "@contember/config-loader": "2.2.0-alpha.6",
-    "@contember/database": "2.2.0-alpha.6",
-    "@contember/database-migrations": "2.2.0-alpha.6",
-    "@contember/dic": "2.2.0-alpha.6",
-    "@contember/graphql-utils": "2.2.0-alpha.6",
-    "@contember/logger": "2.2.0-alpha.6",
-    "@contember/schema": "2.2.0-alpha.6",
-    "@contember/schema-utils": "2.2.0-alpha.6",
-    "@contember/typesafe": "2.2.0-alpha.6",
+    "@contember/authorization": "2.2.0-alpha.8",
+    "@contember/config-loader": "2.2.0-alpha.8",
+    "@contember/database": "2.2.0-alpha.8",
+    "@contember/database-migrations": "2.2.0-alpha.8",
+    "@contember/dic": "2.2.0-alpha.8",
+    "@contember/graphql-utils": "2.2.0-alpha.8",
+    "@contember/logger": "2.2.0-alpha.8",
+    "@contember/schema": "2.2.0-alpha.8",
+    "@contember/schema-utils": "2.2.0-alpha.8",
+    "@contember/typesafe": "2.2.0-alpha.8",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.6",
+    "@contember/database-tester": "2.2.0-alpha.8",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/TenantContainer.ts

@@ -1,3 +1,4 @@
+import { Logger } from '@contember/logger'
 import { AccessEvaluator, Authorizator } from '@contember/authorization'
 import { Connection, DatabaseConfig } from '@contember/database'
 import { Builder } from '@contember/dic'
@@ -148,6 +149,7 @@ export interface TenantContainerArgs {
 	projectInitializer: ProjectInitializer
 	tenantCredentials: TenantCredentials
 	cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>
+	logger: Logger
 }
 
 export class TenantContainerFactory {
@@ -199,7 +201,10 @@ export class TenantContainerFactory {
 				return idpRegistry
 			})
 			.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))
-			.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))
+			.addService(
+				'idpSessionRevalidator',
+				({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger),
+			)
 			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
 			.addService('unpersistedApiKeyManager', () =>
 				UnpersistedApiKeyManager.createForRootTokens({
@@ -255,7 +260,7 @@ export class TenantContainerFactory {
 			)
 			.addService(
 				'idpSignInManager',
-				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),
+				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger),
 			)
 			.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))
 			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())

package/src/model/commands/apiKey/ProlongApiKeyCommand.ts

@@ -4,9 +4,11 @@ import { ApiKeyHelper } from './ApiKeyHelper.js'
 import { QueryBuilder, UpdateBuilder } from '@contember/database'
 
 /**
- * Tracking writes (`last_used_at`) are throttled to at most once per this window, so
- * an idle check must add this slack to avoid prematurely expiring an active session
- * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
+ * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per
+ * this window, even when the IP or User-Agent changes: a key shared by several service replicas
+ * alternates between their addresses, and writing every change makes its row a lock hotspot.
+ * An idle check must add this slack to avoid prematurely expiring an active session whose
+ * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
  */
 export const PROLONG_THROTTLE_MS = 60_000
 
@@ -51,7 +53,7 @@ export class ProlongApiKeyCommand implements Command<void> {
 
 		const requestIp = this.requestInfo?.ip || null
 		const requestUserAgent = this.requestInfo?.userAgent || null
-		const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)
+		const updateTracking = this.shouldUpdateTracking(now)
 
 		if (!updateExpiration && !updateTracking) {
 			return
@@ -74,17 +76,14 @@ export class ProlongApiKeyCommand implements Command<void> {
 		await qb.execute(db)
 	}
 
-	private shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {
+	private shouldUpdateTracking(now: Date): boolean {
 		if (!this.requestInfo) {
 			return false
 		}
-		const last = this.tracking
-		if (!last || last.lastUsedAt === null) {
+		const lastUsedAt = this.tracking?.lastUsedAt
+		if (!lastUsedAt) {
 			return true
 		}
-		if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
-			return true
-		}
-		return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
+		return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
 	}
 }

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -42,6 +42,7 @@ namespace CreateAuthLogEntryCommand {
 		invokedById?: string
 		personInputIdentifier?: string
 		personId?: string
+		/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */
 		personTokenId?: string
 		success: boolean
 		errorCode?: string

package/src/model/commands/idp/ClaimIdpRevalidationCommand.ts

@@ -1,3 +1,4 @@
+import { UpdateBuilder } from '@contember/database'
 import { Command } from '../Command.js'
 
 /**
@@ -17,12 +18,12 @@ export class ClaimIdpRevalidationCommand implements Command<boolean> {
 	}
 
 	async execute({ db }: Command.Args): Promise<boolean> {
-		const result = await db.query(
-			`UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-			[this.id, this.interval],
-		)
-		return (result.rowCount ?? 0) > 0
+		const qb = UpdateBuilder.create()
+			.table('idp_session')
+			.where({ id: this.id })
+			.where(expr => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval))
+			.values({ last_validated_at: expr => expr.raw('now()') })
+
+		return (await qb.execute(db)) > 0
 	}
 }

package/src/model/service/IDPSignInManager.ts

@@ -13,12 +13,14 @@ import { IdentityProviderRow } from '../queries/idp/types.js'
 import { AuthLogService } from './AuthLogService.js'
 import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'
 import { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'
+import { Logger } from '@contember/logger'
 
 class IDPSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
 		private readonly idpRegistry: IDPHandlerRegistry,
 		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {}
 
 	async signInIDP(
@@ -101,7 +103,8 @@ class IDPSignInManager {
 			let claimMappingFailed = false
 			try {
 				mapping = parseClaimMapping(provider.configuration)
-			} catch {
+			} catch (e) {
+				this.logger.warn(e, { message: 'IdP sign-in: claim mapping configuration is invalid', identityProviderId: provider.id })
 				claimMappingFailed = true
 			}
 			let claimMappingAudit: ClaimMappingAudit | null = null
@@ -146,19 +149,28 @@ class IDPSignInManager {
 					// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)
 					// so the operator can see that a session they expected to be continuously
 					// re-validated is in fact not protected, instead of failing closed at sign-in.
-					await db.commandBus.execute(
-						new CreateAuthLogEntryCommand({
-							type: 'idp_session_revalidation_failed',
-							invokedById: personRow.identity_id,
-							personId: personRow.id,
-							identityProviderId: provider.id,
-							personTokenId: apiKeyId,
-							success: true,
-							errorCode: 'encryption_disabled',
-							ipAddress: requestInfo?.ip,
-							userAgent: requestInfo?.userAgent,
-						}),
-					)
+					// Best-effort, in a savepoint: a failed insert would otherwise abort the whole
+					// sign-in transaction, and a lost audit row must not block the sign-in.
+					try {
+						await db.commandBus.transaction(bus =>
+							bus.execute(
+								new CreateAuthLogEntryCommand({
+									type: 'idp_session_revalidation_failed',
+									invokedById: personRow.identity_id,
+									personId: personRow.id,
+									identityProviderId: provider.id,
+									success: true,
+									errorCode: 'encryption_disabled',
+									ipAddress: requestInfo?.ip,
+									userAgent: requestInfo?.userAgent,
+									eventData: { apiKeyId },
+								}),
+							)
+						)
+					} catch (e) {
+						this.logger.error(e, { message: 'IdP sign-in: writing the encryption_disabled audit entry failed', identityProviderId: provider.id })
+						// the savepoint is rolled back, the sign-in transaction stays usable
+					}
 				}
 			}
 

package/src/model/service/idp/IdpSessionRevalidator.ts

@@ -10,6 +10,7 @@ import { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogE
 import { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'
 import { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'
 import { IDPClaimSyncService } from './IDPClaimSyncService.js'
+import { Logger } from '@contember/logger'
 import { parseClaimMapping } from './ClaimMapping.js'
 import { JSONValue } from '@contember/schema'
 
@@ -46,6 +47,7 @@ export class IdpSessionRevalidator {
 	constructor(
 		private readonly idpRegistry: IDPHandlerRegistry,
 		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {
 	}
 
@@ -88,7 +90,8 @@ export class IdpSessionRevalidator {
 		let claimed: boolean
 		try {
 			claimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: claim failed', idpSessionId: row.id })
 			// invalid interval string or transient DB error — fail open, retry next request
 			return 'valid'
 		}
@@ -106,7 +109,9 @@ export class IdpSessionRevalidator {
 		// here; otherwise it becomes an unhandledRejection and can take the worker down. The
 		// session is simply kept and re-tried on a later request (the claim floor throttles).
 		setImmediate(() => {
-			this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})
+			this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(e => {
+				this.logger.error(e, { message: 'IdP session revalidation: background run failed', idpSessionId: row.id })
+			})
 		})
 		return 'valid'
 	}
@@ -146,7 +151,8 @@ export class IdpSessionRevalidator {
 		let config: {}
 		try {
 			config = handler.validateConfiguration(row.providerConfiguration)
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: stored configuration is invalid', idpSessionId: row.id })
 			// corrupt stored config — must NOT revoke; keep the session and retry later. Audit
 			// it so the operator can tell "vouched for" apart from "silently broken" (without an
 			// entry, a config typo disables re-validation invisibly for the life of every session).
@@ -157,7 +163,8 @@ export class IdpSessionRevalidator {
 		let result: RevalidationResult
 		try {
 			result = await handler.revalidate!(config, row.session)
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: identity provider call failed', idpSessionId: row.id })
 			// transient failure (network / IdP down) — must NOT revoke; keep the session and retry
 			// on a later request (the claim floor prevents hammering the IdP). Audited (throttled
 			// to one entry per claim window) so a prolonged IdP outage is visible rather than a
@@ -185,7 +192,8 @@ export class IdpSessionRevalidator {
 			try {
 				await dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))
 				await this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)
-			} catch {
+			} catch (e) {
+				this.logger.error(e, { message: 'IdP session revalidation: persisting the rotated session failed', idpSessionId: row.id })
 				// fall through — session stays valid, persist retried on a later request
 			}
 		}
@@ -240,7 +248,8 @@ export class IdpSessionRevalidator {
 			if (droppedUnsafeRules) {
 				await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
 			}
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: claim mapping sync failed', idpSessionId: row.id })
 			// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or
 			// fail an already-vouched-for session. The transaction rolls back any partial apply.
 			await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
@@ -266,14 +275,14 @@ export class IdpSessionRevalidator {
 					// (consistent with the project_membership_* audit events).
 					targetPersonId: apiKeyRow.person_id ?? undefined,
 					identityProviderId: row.identityProviderId,
-					personTokenId: apiKeyRow.id,
 					success: true,
 					eventData,
 					ipAddress: requestInfo?.ip,
 					userAgent: requestInfo?.userAgent,
 				}),
 			)
-		} catch {
+		} catch (e) {
+			this.logger.error(e, { message: `IdP session revalidation: writing the ${type} audit entry failed`, idpSessionId: row.id })
 			// best-effort audit — never fail the request because the audit write failed
 		}
 	}
@@ -285,10 +294,10 @@ export class IdpSessionRevalidator {
 				invokedById: apiKeyRow.identity_id,
 				personId: apiKeyRow.person_id ?? undefined,
 				identityProviderId: row.identityProviderId,
-				personTokenId: apiKeyRow.id,
 				success: true,
 				ipAddress: requestInfo?.ip,
 				userAgent: requestInfo?.userAgent,
+				eventData: { apiKeyId: apiKeyRow.id },
 			}),
 		)
 	}
@@ -314,16 +323,17 @@ export class IdpSessionRevalidator {
 					invokedById: apiKeyRow.identity_id,
 					personId: apiKeyRow.person_id ?? undefined,
 					identityProviderId: row.identityProviderId,
-					personTokenId: apiKeyRow.id,
 					// not a security failure (the session is kept) — a fail-open marker the operator
 					// can alert on. `success: true` keeps it out of the failed-login funnels.
 					success: true,
 					errorCode,
 					ipAddress: requestInfo?.ip,
 					userAgent: requestInfo?.userAgent,
+					eventData: { apiKeyId: apiKeyRow.id },
 				}),
 			)
-		} catch {
+		} catch (e) {
+			this.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revalidation_failed audit entry failed', idpSessionId: row.id })
 			// best-effort observability — never fail the request because the audit write failed
 		}
 	}
@@ -336,23 +346,28 @@ export class IdpSessionRevalidator {
 		requestInfo?: ApiKeyRequestInfo,
 	): Promise<void> {
 		await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))
-		await dbContext.commandBus.execute(
-			new CreateAuthLogEntryCommand({
-				type: 'idp_session_revoked',
-				invokedById: apiKeyRow.identity_id,
-				personId: apiKeyRow.person_id ?? undefined,
-				identityProviderId: row.identityProviderId,
-				personTokenId: apiKeyRow.id,
-				success: false,
-				errorCode: reason,
-				ipAddress: requestInfo?.ip,
-				userAgent: requestInfo?.userAgent,
-				// the action payload belongs in `event_data` (where every other audit event puts
-				// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
-				// transport context (forwarder IP/UA).
-				eventData: { reason },
-			}),
-		)
+		try {
+			await dbContext.commandBus.execute(
+				new CreateAuthLogEntryCommand({
+					type: 'idp_session_revoked',
+					invokedById: apiKeyRow.identity_id,
+					personId: apiKeyRow.person_id ?? undefined,
+					identityProviderId: row.identityProviderId,
+					success: false,
+					errorCode: reason,
+					ipAddress: requestInfo?.ip,
+					userAgent: requestInfo?.userAgent,
+					// the action payload belongs in `event_data` (where every other audit event puts
+					// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
+					// transport context (forwarder IP/UA).
+					eventData: { reason, apiKeyId: apiKeyRow.id },
+				}),
+			)
+		} catch (e) {
+			this.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revoked audit entry failed', idpSessionId: row.id })
+			// best-effort audit: the key is already disabled, so the request must still be answered
+			// as revoked rather than fail on the audit write
+		}
 	}
 
 	private resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -2,7 +2,8 @@ import { executeTenantTest } from '../../../src/testTenant.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { expect, test } from 'bun:test'
 import { signInIDP } from './gql/signInIdp.js'
-import { sqlTransaction } from './sql/sqlTransaction.js'
+import { sqlNestedTransaction, sqlTransaction } from './sql/sqlTransaction.js'
+import { SQL } from '../../../src/tags.js'
 import { getIdpBySlugSql } from './sql/getIdpBySlugSql.js'
 import { getPersonByIdpSql } from './sql/getPersonByIdpSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
@@ -100,6 +101,104 @@ test('signs in idp with existing identity', async () => {
 	})
 })
 
+// Re-validation on, tokens returned, no encryption key: the token-bearing session is not stored and the
+// downgrade is audited. The entry must not carry the api_key id in person_token_id (FK to person_token,
+// #964); it goes to event_data. The insert runs in its own savepoint so a failure cannot abort sign-in.
+test('signs in idp without an encryption key and audits encryption_disabled without person_token_id', async () => {
+	const externalIdentifier = 'abcd'
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	const idpId = testUuid(20)
+	await executeTenantTest({
+		query: signInIDP({
+			identityProvider: 'mock',
+			idpResponse: {
+				url: 'test',
+			},
+			redirectUrl: 'test',
+			sessionData: {},
+		}),
+		executes: [
+			...sqlTransaction(
+				getIdpBySlugSql({
+					slug: 'mock',
+					response: {
+						id: idpId,
+						autoSignUp: false,
+						exclusive: false,
+						configuration: {
+							externalIdentifier,
+							idpSession: { tokens: { refresh_token: 'r' } },
+						},
+						disabledAt: null,
+						initReturnsConfig: false,
+						requireVerifiedEmail: false,
+						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
+						slug: 'mock',
+						type: 'mock',
+					},
+				}),
+				getPersonByIdpSql({
+					externalIdentifier,
+					identityProviderId: idpId,
+					response: {
+						email,
+						password: '123',
+						identityId,
+						personId,
+						roles: [],
+					},
+				}),
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({
+					apiKeyId,
+					identityId,
+				}),
+				...sqlNestedTransaction({
+					sql:
+						SQL`insert into "tenant"."person_auth_log" ("id", "invoked_by_id", "person_id", "type", "success", "error_code", "ip_address", "identity_provider_id", "metadata", "event_data")
+						values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+					parameters: [
+						() => true,
+						identityId,
+						personId,
+						'idp_session_revalidation_failed',
+						true,
+						'encryption_disabled',
+						'',
+						idpId,
+						() => true,
+						{ apiKeyId },
+					],
+					response: { rowCount: 1 },
+				}),
+			),
+			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
+			selectMembershipsSql({
+				identityId: identityId,
+				projectId,
+				membershipsResponse: [],
+			}),
+		],
+		return: (response: any) => {
+			expect(response.data.signInIDP.ok).toBe(true)
+			expect(response.data.signInIDP.result.token).toBe('0000000000000000000000000000000000000000')
+		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
+	})
+})
+
 test('does NOT link by e-mail when provider requires a verified e-mail and the claim is unverified', async () => {
 	const externalIdentifier = 'abcd'
 	const email = 'john@doe.com'

package/tests/cases/integration/mocked/sql/sqlTransaction.ts

@@ -15,3 +15,19 @@ export const sqlTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] =>
 		response: { rowCount: 1 },
 	},
 ]
+
+/**
+ * A nested `client.transaction()` inside an open transaction. Postgres runs it as a savepoint; the
+ * connection mock renders every transaction as BEGIN/COMMIT and sets no isolation level for it.
+ */
+export const sqlNestedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]

package/tests/cases/unit/apiKey/prolongApiKeyCommand.test.ts

@@ -99,7 +99,7 @@ test('throttles last_* within window for same IP+UA', async () => {
 	})
 })
 
-test('bypasses throttle when IP changes', async () => {
+test('throttles last_* within window when IP changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -111,6 +111,22 @@ test('bypasses throttle when IP changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
+		expectedQueries: [],
+	})
+})
+
+test('writes changed IP once the window has passed', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '198.51.100.7', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:58:59Z'),
+		},
 		expectedQueries: [
 			{
 				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
@@ -157,7 +173,7 @@ test('A19: unaffected when max_expires_at is null (today behavior)', async () =>
 	})
 })
 
-test('bypasses throttle when User-Agent changes', async () => {
+test('throttles last_* within window when User-Agent changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -169,12 +185,6 @@ test('bypasses throttle when User-Agent changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
-		expectedQueries: [
-			{
-				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
-				parameters: ['203.0.113.5', 'browser/2', now, 'api-key-id'],
-				response: { rowCount: 1 },
-			},
-		],
+		expectedQueries: [],
 	})
 })

package/tests/cases/unit/idp/claimIdpRevalidation.test.ts

@@ -0,0 +1,50 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers } from '../../../../src/index.js'
+import { ClaimIdpRevalidationCommand } from '../../../../src/model/commands/idp/ClaimIdpRevalidationCommand.js'
+
+const providers: Providers = {
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-05-26T12:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt: async value => ({ value, version: 1 }),
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const execute = async (expectedQuery: ExpectedQuery): Promise<boolean> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+
+	const claimed = await db.commandBus.execute(new ClaimIdpRevalidationCommand('idp-session-1', '30 seconds'))
+
+	expect(expectedQueries).toHaveLength(0)
+	return claimed
+}
+
+// The table must be schema-qualified: the tenant schema is not on the connection's search_path,
+// so an unqualified name makes the claim fail on every request, and the caller treats that as
+// "somebody else holds the claim" — re-validation then never runs at all.
+test('the claim is issued against the qualified tenant table', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 1 },
+	})
+
+	expect(claimed).toBe(true)
+})
+
+test('a session still inside the throttle window is not claimed', async () => {
+	const claimed = await execute({
+		sql: 'update "tenant"."idp_session" set "last_validated_at" = now() where "id" = ? and "last_validated_at" <= now() - ?::interval',
+		parameters: ['idp-session-1', '30 seconds'],
+		response: { rowCount: 0 },
+	})
+
+	expect(claimed).toBe(false)
+})