@contember/engine-tenant-api 2.2.0-alpha.7 → 2.2.0-alpha.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.2.0-alpha.7",
+  "version": "2.2.0-alpha.9",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.2.0-alpha.7",
-    "@contember/config-loader": "2.2.0-alpha.7",
-    "@contember/database": "2.2.0-alpha.7",
-    "@contember/database-migrations": "2.2.0-alpha.7",
-    "@contember/dic": "2.2.0-alpha.7",
-    "@contember/graphql-utils": "2.2.0-alpha.7",
-    "@contember/logger": "2.2.0-alpha.7",
-    "@contember/schema": "2.2.0-alpha.7",
-    "@contember/schema-utils": "2.2.0-alpha.7",
-    "@contember/typesafe": "2.2.0-alpha.7",
+    "@contember/authorization": "2.2.0-alpha.9",
+    "@contember/config-loader": "2.2.0-alpha.9",
+    "@contember/database": "2.2.0-alpha.9",
+    "@contember/database-migrations": "2.2.0-alpha.9",
+    "@contember/dic": "2.2.0-alpha.9",
+    "@contember/graphql-utils": "2.2.0-alpha.9",
+    "@contember/logger": "2.2.0-alpha.9",
+    "@contember/schema": "2.2.0-alpha.9",
+    "@contember/schema-utils": "2.2.0-alpha.9",
+    "@contember/typesafe": "2.2.0-alpha.9",
     "@graphql-tools/utils": "^11.0.0",
     "graphql-tag": "^2.12.6",
     "jose": "^6.2.1",
@@ -46,7 +46,7 @@
     "otpauth": "^9.5.0"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.2.0-alpha.7",
+    "@contember/database-tester": "2.2.0-alpha.9",
     "@graphql-tools/schema": "^10.0.31",
     "@types/mustache": "^4.2.6",
     "@types/node": "^24.12.0",

package/src/TenantContainer.ts

@@ -1,3 +1,4 @@
+import { Logger } from '@contember/logger'
 import { AccessEvaluator, Authorizator } from '@contember/authorization'
 import { Connection, DatabaseConfig } from '@contember/database'
 import { Builder } from '@contember/dic'
@@ -148,6 +149,7 @@ export interface TenantContainerArgs {
 	projectInitializer: ProjectInitializer
 	tenantCredentials: TenantCredentials
 	cryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>
+	logger: Logger
 }
 
 export class TenantContainerFactory {
@@ -199,7 +201,10 @@ export class TenantContainerFactory {
 				return idpRegistry
 			})
 			.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))
-			.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))
+			.addService(
+				'idpSessionRevalidator',
+				({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger),
+			)
 			.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))
 			.addService('unpersistedApiKeyManager', () =>
 				UnpersistedApiKeyManager.createForRootTokens({
@@ -255,7 +260,7 @@ export class TenantContainerFactory {
 			)
 			.addService(
 				'idpSignInManager',
-				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),
+				({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger),
 			)
 			.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))
 			.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())

package/src/model/commands/apiKey/ProlongApiKeyCommand.ts

@@ -4,9 +4,11 @@ import { ApiKeyHelper } from './ApiKeyHelper.js'
 import { QueryBuilder, UpdateBuilder } from '@contember/database'
 
 /**
- * Tracking writes (`last_used_at`) are throttled to at most once per this window, so
- * an idle check must add this slack to avoid prematurely expiring an active session
- * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
+ * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per
+ * this window, even when the IP or User-Agent changes: a key shared by several service replicas
+ * alternates between their addresses, and writing every change makes its row a lock hotspot.
+ * An idle check must add this slack to avoid prematurely expiring an active session whose
+ * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).
  */
 export const PROLONG_THROTTLE_MS = 60_000
 
@@ -51,7 +53,7 @@ export class ProlongApiKeyCommand implements Command<void> {
 
 		const requestIp = this.requestInfo?.ip || null
 		const requestUserAgent = this.requestInfo?.userAgent || null
-		const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)
+		const updateTracking = this.shouldUpdateTracking(now)
 
 		if (!updateExpiration && !updateTracking) {
 			return
@@ -74,17 +76,14 @@ export class ProlongApiKeyCommand implements Command<void> {
 		await qb.execute(db)
 	}
 
-	private shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {
+	private shouldUpdateTracking(now: Date): boolean {
 		if (!this.requestInfo) {
 			return false
 		}
-		const last = this.tracking
-		if (!last || last.lastUsedAt === null) {
+		const lastUsedAt = this.tracking?.lastUsedAt
+		if (!lastUsedAt) {
 			return true
 		}
-		if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
-			return true
-		}
-		return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
+		return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS
 	}
 }

package/src/model/commands/authLog/CreateAuthLogEntryCommand.ts

@@ -42,6 +42,7 @@ namespace CreateAuthLogEntryCommand {
 		invokedById?: string
 		personInputIdentifier?: string
 		personId?: string
+		/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */
 		personTokenId?: string
 		success: boolean
 		errorCode?: string

package/src/model/service/IDPSignInManager.ts

@@ -13,12 +13,14 @@ import { IdentityProviderRow } from '../queries/idp/types.js'
 import { AuthLogService } from './AuthLogService.js'
 import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'
 import { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'
+import { Logger } from '@contember/logger'
 
 class IDPSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
 		private readonly idpRegistry: IDPHandlerRegistry,
 		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {}
 
 	async signInIDP(
@@ -101,7 +103,8 @@ class IDPSignInManager {
 			let claimMappingFailed = false
 			try {
 				mapping = parseClaimMapping(provider.configuration)
-			} catch {
+			} catch (e) {
+				this.logger.warn(e, { message: 'IdP sign-in: claim mapping configuration is invalid', identityProviderId: provider.id })
 				claimMappingFailed = true
 			}
 			let claimMappingAudit: ClaimMappingAudit | null = null
@@ -146,19 +149,28 @@ class IDPSignInManager {
 					// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)
 					// so the operator can see that a session they expected to be continuously
 					// re-validated is in fact not protected, instead of failing closed at sign-in.
-					await db.commandBus.execute(
-						new CreateAuthLogEntryCommand({
-							type: 'idp_session_revalidation_failed',
-							invokedById: personRow.identity_id,
-							personId: personRow.id,
-							identityProviderId: provider.id,
-							personTokenId: apiKeyId,
-							success: true,
-							errorCode: 'encryption_disabled',
-							ipAddress: requestInfo?.ip,
-							userAgent: requestInfo?.userAgent,
-						}),
-					)
+					// Best-effort, in a savepoint: a failed insert would otherwise abort the whole
+					// sign-in transaction, and a lost audit row must not block the sign-in.
+					try {
+						await db.commandBus.transaction(bus =>
+							bus.execute(
+								new CreateAuthLogEntryCommand({
+									type: 'idp_session_revalidation_failed',
+									invokedById: personRow.identity_id,
+									personId: personRow.id,
+									identityProviderId: provider.id,
+									success: true,
+									errorCode: 'encryption_disabled',
+									ipAddress: requestInfo?.ip,
+									userAgent: requestInfo?.userAgent,
+									eventData: { apiKeyId },
+								}),
+							)
+						)
+					} catch (e) {
+						this.logger.error(e, { message: 'IdP sign-in: writing the encryption_disabled audit entry failed', identityProviderId: provider.id })
+						// the savepoint is rolled back, the sign-in transaction stays usable
+					}
 				}
 			}
 

package/src/model/service/apiKey/ApiKeyManager.ts

@@ -45,10 +45,11 @@ export class ApiKeyManager {
 			return new ResponseOk(unpersistedResult)
 		}
 
-		const apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))
-		if (apiKeyRow === null) {
+		const fetchedApiKey = await this.fetchApiKeyByToken(dbContext, readDbContext, token)
+		if (fetchedApiKey === null) {
 			return new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')
 		}
+		const apiKeyRow = fetchedApiKey.row
 
 		if (apiKeyRow.disabled_at !== null) {
 			return new ResponseError(
@@ -120,8 +121,9 @@ export class ApiKeyManager {
 		// response (revocation lands on the next request); in `blocking` mode it can revoke
 		// the current request. No-op for password sessions and IdPs without revalidation.
 		// `effectiveInfo` is passed so the audit entries record the originating request's IP/UA.
+		// The idp_session row is written together with the api_key, so it is read from where the key was found.
 		if (this.idpSessionRevalidator) {
-			const outcome = await this.idpSessionRevalidator.revalidate(dbContext, readDbContext, apiKeyRow, effectiveInfo)
+			const outcome = await this.idpSessionRevalidator.revalidate(dbContext, fetchedApiKey.sourceDbContext, apiKeyRow, effectiveInfo)
 			if (outcome === 'revoked') {
 				return new ResponseError(VerifyErrorCode.DISABLED, 'IdP session was revoked')
 			}
@@ -158,6 +160,20 @@ export class ApiKeyManager {
 		)
 	}
 
+	private async fetchApiKeyByToken(dbContext: DatabaseContext, readDbContext: DatabaseContext, token: string): Promise<FetchedApiKey | null> {
+		const query = new ApiKeyByTokenQuery(token)
+		const replicaRow = await readDbContext.queryHandler.fetch(query)
+		if (replicaRow !== null) {
+			return { row: replicaRow, sourceDbContext: readDbContext }
+		}
+		if (readDbContext.client.connection === dbContext.client.connection) {
+			return null
+		}
+		// A token issued moments ago (sign-in, createSessionToken) may not have reached the read replica yet.
+		const primaryRow = await dbContext.queryHandler.fetch(query)
+		return primaryRow !== null ? { row: primaryRow, sourceDbContext: dbContext } : null
+	}
+
 	async createSessionApiKey(
 		dbContext: DatabaseContext,
 		identityId: string,
@@ -298,6 +314,11 @@ export class ApiKeyManager {
 	}
 }
 
+type FetchedApiKey = {
+	row: ApiKeyRow
+	sourceDbContext: DatabaseContext
+}
+
 export type VerifyResponse = Response<VerifyResult, VerifyErrorCode>
 
 export class VerifyResult {

package/src/model/service/idp/IdpSessionRevalidator.ts

@@ -10,6 +10,7 @@ import { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogE
 import { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'
 import { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'
 import { IDPClaimSyncService } from './IDPClaimSyncService.js'
+import { Logger } from '@contember/logger'
 import { parseClaimMapping } from './ClaimMapping.js'
 import { JSONValue } from '@contember/schema'
 
@@ -46,6 +47,7 @@ export class IdpSessionRevalidator {
 	constructor(
 		private readonly idpRegistry: IDPHandlerRegistry,
 		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {
 	}
 
@@ -88,7 +90,8 @@ export class IdpSessionRevalidator {
 		let claimed: boolean
 		try {
 			claimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: claim failed', idpSessionId: row.id })
 			// invalid interval string or transient DB error — fail open, retry next request
 			return 'valid'
 		}
@@ -106,7 +109,9 @@ export class IdpSessionRevalidator {
 		// here; otherwise it becomes an unhandledRejection and can take the worker down. The
 		// session is simply kept and re-tried on a later request (the claim floor throttles).
 		setImmediate(() => {
-			this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})
+			this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(e => {
+				this.logger.error(e, { message: 'IdP session revalidation: background run failed', idpSessionId: row.id })
+			})
 		})
 		return 'valid'
 	}
@@ -146,7 +151,8 @@ export class IdpSessionRevalidator {
 		let config: {}
 		try {
 			config = handler.validateConfiguration(row.providerConfiguration)
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: stored configuration is invalid', idpSessionId: row.id })
 			// corrupt stored config — must NOT revoke; keep the session and retry later. Audit
 			// it so the operator can tell "vouched for" apart from "silently broken" (without an
 			// entry, a config typo disables re-validation invisibly for the life of every session).
@@ -157,7 +163,8 @@ export class IdpSessionRevalidator {
 		let result: RevalidationResult
 		try {
 			result = await handler.revalidate!(config, row.session)
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: identity provider call failed', idpSessionId: row.id })
 			// transient failure (network / IdP down) — must NOT revoke; keep the session and retry
 			// on a later request (the claim floor prevents hammering the IdP). Audited (throttled
 			// to one entry per claim window) so a prolonged IdP outage is visible rather than a
@@ -185,7 +192,8 @@ export class IdpSessionRevalidator {
 			try {
 				await dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))
 				await this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)
-			} catch {
+			} catch (e) {
+				this.logger.error(e, { message: 'IdP session revalidation: persisting the rotated session failed', idpSessionId: row.id })
 				// fall through — session stays valid, persist retried on a later request
 			}
 		}
@@ -240,7 +248,8 @@ export class IdpSessionRevalidator {
 			if (droppedUnsafeRules) {
 				await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
 			}
-		} catch {
+		} catch (e) {
+			this.logger.warn(e, { message: 'IdP session revalidation: claim mapping sync failed', idpSessionId: row.id })
 			// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or
 			// fail an already-vouched-for session. The transaction rolls back any partial apply.
 			await this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)
@@ -266,14 +275,14 @@ export class IdpSessionRevalidator {
 					// (consistent with the project_membership_* audit events).
 					targetPersonId: apiKeyRow.person_id ?? undefined,
 					identityProviderId: row.identityProviderId,
-					personTokenId: apiKeyRow.id,
 					success: true,
 					eventData,
 					ipAddress: requestInfo?.ip,
 					userAgent: requestInfo?.userAgent,
 				}),
 			)
-		} catch {
+		} catch (e) {
+			this.logger.error(e, { message: `IdP session revalidation: writing the ${type} audit entry failed`, idpSessionId: row.id })
 			// best-effort audit — never fail the request because the audit write failed
 		}
 	}
@@ -285,10 +294,10 @@ export class IdpSessionRevalidator {
 				invokedById: apiKeyRow.identity_id,
 				personId: apiKeyRow.person_id ?? undefined,
 				identityProviderId: row.identityProviderId,
-				personTokenId: apiKeyRow.id,
 				success: true,
 				ipAddress: requestInfo?.ip,
 				userAgent: requestInfo?.userAgent,
+				eventData: { apiKeyId: apiKeyRow.id },
 			}),
 		)
 	}
@@ -314,16 +323,17 @@ export class IdpSessionRevalidator {
 					invokedById: apiKeyRow.identity_id,
 					personId: apiKeyRow.person_id ?? undefined,
 					identityProviderId: row.identityProviderId,
-					personTokenId: apiKeyRow.id,
 					// not a security failure (the session is kept) — a fail-open marker the operator
 					// can alert on. `success: true` keeps it out of the failed-login funnels.
 					success: true,
 					errorCode,
 					ipAddress: requestInfo?.ip,
 					userAgent: requestInfo?.userAgent,
+					eventData: { apiKeyId: apiKeyRow.id },
 				}),
 			)
-		} catch {
+		} catch (e) {
+			this.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revalidation_failed audit entry failed', idpSessionId: row.id })
 			// best-effort observability — never fail the request because the audit write failed
 		}
 	}
@@ -336,23 +346,28 @@ export class IdpSessionRevalidator {
 		requestInfo?: ApiKeyRequestInfo,
 	): Promise<void> {
 		await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))
-		await dbContext.commandBus.execute(
-			new CreateAuthLogEntryCommand({
-				type: 'idp_session_revoked',
-				invokedById: apiKeyRow.identity_id,
-				personId: apiKeyRow.person_id ?? undefined,
-				identityProviderId: row.identityProviderId,
-				personTokenId: apiKeyRow.id,
-				success: false,
-				errorCode: reason,
-				ipAddress: requestInfo?.ip,
-				userAgent: requestInfo?.userAgent,
-				// the action payload belongs in `event_data` (where every other audit event puts
-				// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
-				// transport context (forwarder IP/UA).
-				eventData: { reason },
-			}),
-		)
+		try {
+			await dbContext.commandBus.execute(
+				new CreateAuthLogEntryCommand({
+					type: 'idp_session_revoked',
+					invokedById: apiKeyRow.identity_id,
+					personId: apiKeyRow.person_id ?? undefined,
+					identityProviderId: row.identityProviderId,
+					success: false,
+					errorCode: reason,
+					ipAddress: requestInfo?.ip,
+					userAgent: requestInfo?.userAgent,
+					// the action payload belongs in `event_data` (where every other audit event puts
+					// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
+					// transport context (forwarder IP/UA).
+					eventData: { reason, apiKeyId: apiKeyRow.id },
+				}),
+			)
+		} catch (e) {
+			this.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revoked audit entry failed', idpSessionId: row.id })
+			// best-effort audit: the key is already disabled, so the request must still be answered
+			// as revoked rather than fail on the audit write
+		}
 	}
 
 	private resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -2,7 +2,8 @@ import { executeTenantTest } from '../../../src/testTenant.js'
 import { testUuid } from '../../../src/testUuid.js'
 import { expect, test } from 'bun:test'
 import { signInIDP } from './gql/signInIdp.js'
-import { sqlTransaction } from './sql/sqlTransaction.js'
+import { sqlNestedTransaction, sqlTransaction } from './sql/sqlTransaction.js'
+import { SQL } from '../../../src/tags.js'
 import { getIdpBySlugSql } from './sql/getIdpBySlugSql.js'
 import { getPersonByIdpSql } from './sql/getPersonByIdpSql.js'
 import { createSessionKeySql } from './sql/createSessionKeySql.js'
@@ -100,6 +101,104 @@ test('signs in idp with existing identity', async () => {
 	})
 })
 
+// Re-validation on, tokens returned, no encryption key: the token-bearing session is not stored and the
+// downgrade is audited. The entry must not carry the api_key id in person_token_id (FK to person_token,
+// #964); it goes to event_data. The insert runs in its own savepoint so a failure cannot abort sign-in.
+test('signs in idp without an encryption key and audits encryption_disabled without person_token_id', async () => {
+	const externalIdentifier = 'abcd'
+	const email = 'john@doe.com'
+	const identityId = testUuid(2)
+	const personId = testUuid(7)
+	const projectId = testUuid(10)
+	const apiKeyId = testUuid(1)
+	const idpId = testUuid(20)
+	await executeTenantTest({
+		query: signInIDP({
+			identityProvider: 'mock',
+			idpResponse: {
+				url: 'test',
+			},
+			redirectUrl: 'test',
+			sessionData: {},
+		}),
+		executes: [
+			...sqlTransaction(
+				getIdpBySlugSql({
+					slug: 'mock',
+					response: {
+						id: idpId,
+						autoSignUp: false,
+						exclusive: false,
+						configuration: {
+							externalIdentifier,
+							idpSession: { tokens: { refresh_token: 'r' } },
+						},
+						disabledAt: null,
+						initReturnsConfig: false,
+						requireVerifiedEmail: false,
+						assumeEmailVerified: false,
+						disableLocalAuthentication: false,
+						slug: 'mock',
+						type: 'mock',
+					},
+				}),
+				getPersonByIdpSql({
+					externalIdentifier,
+					identityProviderId: idpId,
+					response: {
+						email,
+						password: '123',
+						identityId,
+						personId,
+						roles: [],
+					},
+				}),
+				getConfigSql(),
+				getIdentityByIdSql({ identityId }),
+				getAuthPoliciesSql(),
+				createSessionKeySql({
+					apiKeyId,
+					identityId,
+				}),
+				...sqlNestedTransaction({
+					sql:
+						SQL`insert into "tenant"."person_auth_log" ("id", "invoked_by_id", "person_id", "type", "success", "error_code", "ip_address", "identity_provider_id", "metadata", "event_data")
+						values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+					parameters: [
+						() => true,
+						identityId,
+						personId,
+						'idp_session_revalidation_failed',
+						true,
+						'encryption_disabled',
+						'',
+						idpId,
+						() => true,
+						{ apiKeyId },
+					],
+					response: { rowCount: 1 },
+				}),
+			),
+			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
+			selectMembershipsSql({
+				identityId: identityId,
+				projectId,
+				membershipsResponse: [],
+			}),
+		],
+		return: (response: any) => {
+			expect(response.data.signInIDP.ok).toBe(true)
+			expect(response.data.signInIDP.result.token).toBe('0000000000000000000000000000000000000000')
+		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
+	})
+})
+
 test('does NOT link by e-mail when provider requires a verified e-mail and the claim is unverified', async () => {
 	const externalIdentifier = 'abcd'
 	const email = 'john@doe.com'

package/tests/cases/integration/mocked/sql/sqlTransaction.ts

@@ -15,3 +15,19 @@ export const sqlTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] =>
 		response: { rowCount: 1 },
 	},
 ]
+
+/**
+ * A nested `client.transaction()` inside an open transaction. Postgres runs it as a savepoint; the
+ * connection mock renders every transaction as BEGIN/COMMIT and sets no isolation level for it.
+ */
+export const sqlNestedTransaction = (...queries: ExpectedQuery[]): ExpectedQuery[] => [
+	{
+		sql: SQL`BEGIN;`,
+		response: { rowCount: 1 },
+	},
+	...queries,
+	{
+		sql: SQL`COMMIT;`,
+		response: { rowCount: 1 },
+	},
+]

package/tests/cases/unit/apiKey/prolongApiKeyCommand.test.ts

@@ -99,7 +99,7 @@ test('throttles last_* within window for same IP+UA', async () => {
 	})
 })
 
-test('bypasses throttle when IP changes', async () => {
+test('throttles last_* within window when IP changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -111,6 +111,22 @@ test('bypasses throttle when IP changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
+		expectedQueries: [],
+	})
+})
+
+test('writes changed IP once the window has passed', async () => {
+	const now = new Date('2026-05-12T12:00:00Z')
+	const currentExpiration = new Date('2026-05-12T12:29:30Z')
+	await exec({
+		now,
+		currentExpiration,
+		requestInfo: { ip: '198.51.100.7', userAgent: 'curl' },
+		tracking: {
+			lastIp: '203.0.113.5',
+			lastUserAgent: 'curl',
+			lastUsedAt: new Date('2026-05-12T11:58:59Z'),
+		},
 		expectedQueries: [
 			{
 				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
@@ -157,7 +173,7 @@ test('A19: unaffected when max_expires_at is null (today behavior)', async () =>
 	})
 })
 
-test('bypasses throttle when User-Agent changes', async () => {
+test('throttles last_* within window when User-Agent changes', async () => {
 	const now = new Date('2026-05-12T12:00:00Z')
 	const currentExpiration = new Date('2026-05-12T12:29:30Z')
 	await exec({
@@ -169,12 +185,6 @@ test('bypasses throttle when User-Agent changes', async () => {
 			lastUserAgent: 'curl',
 			lastUsedAt: new Date('2026-05-12T11:59:50Z'),
 		},
-		expectedQueries: [
-			{
-				sql: `update "tenant"."api_key" set "last_ip" = ?, "last_user_agent" = ?, "last_used_at" = ? where "id" = ?`,
-				parameters: ['203.0.113.5', 'browser/2', now, 'api-key-id'],
-				response: { rowCount: 1 },
-			},
-		],
+		expectedQueries: [],
 	})
 })

package/tests/cases/unit/apiKey/unpersistedApiKeyManager.test.ts

@@ -122,7 +122,7 @@ test('verifyAndProlong falls through to the database for a non-matching token',
 	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), unpersisted)
 
 	const tokenHash = computeTokenHash('some-db-token')
-	const readDbContext = createDbContext([
+	const dbContext = createDbContext([
 		{
 			sql:
 				'select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?',
@@ -130,8 +130,7 @@ test('verifyAndProlong falls through to the database for a non-matching token',
 			response: { rows: [] },
 		},
 	])
-	const dbContext = createDbContext([])
 
-	const response = await manager.verifyAndProlong(dbContext, readDbContext, 'some-db-token')
+	const response = await manager.verifyAndProlong(dbContext, dbContext, 'some-db-token')
 	expect(response.ok).toBe(false)
 })