@contember/engine-tenant-api 2.2.0-alpha.7 → 2.2.0-alpha.9

package/tests/cases/unit/apiKey/verifyAndProlongReplica.test.ts

@@ -0,0 +1,170 @@
+import { expect, test } from 'bun:test'
+import {
+	ApiKey,
+	ApiKeyManager,
+	ApiKeyService,
+	AuthLogService,
+	AuthPolicyResolver,
+	computeTokenHash,
+	DatabaseContext,
+	IDPClaimSyncService,
+	IDPHandlerRegistry,
+	IdpSessionRevalidator,
+	Providers,
+	VerifyErrorCode,
+} from '../../../../src/index.js'
+import { Connection } from '@contember/database'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { createLogger, TestLoggerHandler } from '@contember/logger'
+import { emptySchema } from '@contember/schema-utils'
+
+const TOKEN = '0000000000000000000000000000000000000000'
+const NOW = new Date('2026-05-21T12:00:00Z')
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+const apiKeyRow = {
+	id: 'api-key-id',
+	type: ApiKey.Type.SESSION,
+	identity_id: 'identity-id',
+	disabled_at: null,
+	expires_at: new Date(NOW.getTime() + 30 * 60_000),
+	roles: ['editor'],
+	expiration: 30,
+	person_id: 'person-id',
+	last_ip: null,
+	last_user_agent: null,
+	last_used_at: null,
+	trust_forwarded_info: false,
+	issued_at: null,
+	idle_timeout: null,
+	max_expires_at: null,
+}
+
+const selectByToken = (rows: (typeof apiKeyRow)[]): ExpectedQuery => ({
+	sql:
+		`select "api_key"."id", "api_key"."type", "api_key"."identity_id", "api_key"."disabled_at", "api_key"."expires_at", "identity"."roles", "api_key"."expiration", "person"."id" as "person_id", "api_key"."last_ip", "api_key"."last_user_agent", "api_key"."last_used_at", "api_key"."trust_forwarded_info", "api_key"."issued_at", "api_key"."idle_timeout", "api_key"."max_expires_at" from "tenant"."api_key" inner join "tenant"."identity" as "identity" on "api_key"."identity_id" = "identity"."id" left join "tenant"."person" as "person" on "person"."identity_id" = "identity"."id" where "token_hash" = ?`,
+	parameters: [computeTokenHash(TOKEN)],
+	response: { rows },
+})
+
+// The prolong UPDATE runs detached on the primary once a key is accepted.
+const prolongUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "expires_at" = ? where "id" = ?`,
+	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+const selectIdpSession = (rows: Record<string, unknown>[]): ExpectedQuery => ({
+	sql:
+		`select "idp_session"."id", "idp_session"."identity_provider_id", "idp_session"."idp_session_id", "idp_session"."tokens", "idp_session"."tokens_version", "idp_session"."idp_expires_at", "idp_session"."token_obtained_at", "idp_session"."last_validated_at", "idp_session"."created_at", "identity_provider"."type" as "provider_type", "identity_provider"."configuration" as "provider_configuration", "identity_provider"."disabled_at" as "provider_disabled_at" from "tenant"."idp_session" inner join "tenant"."identity_provider" as "identity_provider" on "idp_session"."identity_provider_id" = "identity_provider"."id" where "api_key_id" = ?`,
+	parameters: ['api-key-id'],
+	response: { rows },
+})
+
+const disableUpdate: ExpectedQuery = {
+	sql: `update "tenant"."api_key" set "disabled_at" = ? where "id" = ?`,
+	parameters: [(val: unknown) => val instanceof Date, 'api-key-id'],
+	response: { rowCount: 1 },
+}
+
+const authLogInsert: ExpectedQuery = {
+	sql:
+		`insert into "tenant"."person_auth_log" ("id", "invoked_by_id", "person_id", "type", "success", "error_code", "identity_provider_id", "metadata", "event_data") values (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+	response: { rowCount: 1 },
+}
+
+const createDbContext = (connection: Connection.ConnectionType) =>
+	new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+
+const verify = async (primary: Connection.ConnectionType, replica: Connection.ConnectionType, idpSessionRevalidator?: IdpSessionRevalidator) => {
+	const manager = new ApiKeyManager(new ApiKeyService(), new AuthPolicyResolver(), new AuthLogService(), undefined, idpSessionRevalidator)
+	const response = await manager.verifyAndProlong(createDbContext(primary), createDbContext(replica), TOKEN)
+	// Let the setImmediate-scheduled prolong run before the connection mocks are torn down.
+	await new Promise(resolve => setImmediate(resolve))
+	return response
+}
+
+test('a key not yet replicated is found on the primary', async () => {
+	const primary = createConnectionMock([selectByToken([apiKeyRow]), prolongUpdate])
+	const replica = createConnectionMock([selectByToken([])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(true)
+	if (response.ok) {
+		expect(response.result.apiKeyId).toBe('api-key-id')
+	}
+})
+
+test('a key found on the replica does not query the primary', async () => {
+	const primary = createConnectionMock([prolongUpdate])
+	const replica = createConnectionMock([selectByToken([apiKeyRow])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(true)
+})
+
+test('a key missing on both the replica and the primary is not found', async () => {
+	const primary = createConnectionMock([selectByToken([])])
+	const replica = createConnectionMock([selectByToken([])])
+
+	const response = await verify(primary, replica)
+	expect(response.ok).toBe(false)
+	if (!response.ok) {
+		expect(response.error).toBe(VerifyErrorCode.NOT_FOUND)
+	}
+})
+
+test('without a replica, a missing key is looked up only once', async () => {
+	const connection = createConnectionMock([selectByToken([])])
+
+	const response = await verify(connection, connection)
+	expect(response.ok).toBe(false)
+})
+
+test('a key found only on the primary reads its IdP session from the primary', async () => {
+	const disabledIdpSession = {
+		id: 'idp-session-id',
+		identity_provider_id: 'idp-id',
+		idp_session_id: null,
+		tokens: null,
+		tokens_version: null,
+		idp_expires_at: null,
+		token_obtained_at: NOW,
+		last_validated_at: NOW,
+		created_at: NOW,
+		provider_type: 'oidc',
+		provider_configuration: { revalidation: { enabled: true } },
+		provider_disabled_at: NOW,
+	}
+	const primary = createConnectionMock([selectByToken([apiKeyRow]), selectIdpSession([disabledIdpSession]), disableUpdate, authLogInsert])
+	const replica = createConnectionMock([selectByToken([]), selectIdpSession([])])
+	const logHandler = new TestLoggerHandler()
+	const idpSessionRevalidator = new IdpSessionRevalidator(
+		new IDPHandlerRegistry(),
+		new IDPClaimSyncService({ getSchema: () => Promise.resolve(emptySchema) }),
+		createLogger(logHandler),
+	)
+
+	const response = await verify(primary, replica, idpSessionRevalidator)
+	expect(response.ok).toBe(false)
+	if (!response.ok) {
+		expect(response.error).toBe(VerifyErrorCode.DISABLED)
+	}
+	// The revocation audit entry is best-effort and only logged on failure.
+	expect(logHandler.messages).toEqual([])
+})

package/tests/cases/unit/idp/idpSessionRevalidator.test.ts

@@ -9,6 +9,7 @@ import { CreateAuthLogEntryCommand } from '../../../../src/model/commands/authLo
 import { ProjectBySlugQuery, ProjectMembershipByIdentityQuery } from '../../../../src/model/queries/index.js'
 import { Schema } from '@contember/schema'
 import { emptySchema } from '@contember/schema-utils'
+import { createLogger, Logger, TestLoggerHandler } from '@contember/logger'
 
 const NOW = new Date('2026-05-26T12:00:00Z')
 const t = (iso: string) => new Date(`2026-05-26T${iso}Z`)
@@ -20,8 +21,8 @@ const t = (iso: string) => new Date(`2026-05-26T${iso}Z`)
 // happy-path claim tests below grant the plain `editor` role on the existing `demo` project, so they need a
 // resolvable schema that defines that role (otherwise the apply-time backstop would drop the grant).
 const claimSyncSchema: Schema = { ...emptySchema, acl: { roles: { editor: { stages: '*', entities: {}, variables: {} } } } }
-const makeRevalidator = (registry: IDPHandlerRegistry) =>
-	new IdpSessionRevalidator(registry, new IDPClaimSyncService({ getSchema: () => Promise.resolve(claimSyncSchema) }))
+const makeRevalidator = (registry: IDPHandlerRegistry, logger: Logger = createLogger(new TestLoggerHandler())) =>
+	new IdpSessionRevalidator(registry, new IDPClaimSyncService({ getSchema: () => Promise.resolve(claimSyncSchema) }), logger)
 
 const apiKeyRow: any = {
 	id: 'api-key-1',
@@ -48,7 +49,7 @@ const baseRow = (overrides: Partial<IdpSessionRow> = {}): IdpSessionRow => ({
 	...overrides,
 })
 
-const createHarness = (row: IdpSessionRow | null, opts: { claim?: boolean } = {}) => {
+const createHarness = (row: IdpSessionRow | null, opts: { claim?: boolean; failAudit?: boolean } = {}) => {
 	const executed: any[] = []
 	const commandBus = {
 		execute: async (command: any) => {
@@ -56,6 +57,9 @@ const createHarness = (row: IdpSessionRow | null, opts: { claim?: boolean } = {}
 			if (command instanceof ClaimIdpRevalidationCommand) {
 				return opts.claim ?? true
 			}
+			if (opts.failAudit && command instanceof CreateAuthLogEntryCommand) {
+				throw new Error('audit insert failed')
+			}
 			if (command instanceof DisableApiKeyCommand) {
 				return true
 			}
@@ -155,7 +159,7 @@ describe('IdpSessionRevalidator — lifetime-driven phases', () => {
 		expect((log as any).data.success).toBe(false)
 		expect((log as any).data.errorCode).toBe('invalid_grant')
 		// the reason is the action payload → event_data (where the rest of the audit system reads it)
-		expect((log as any).data.eventData).toEqual({ reason: 'invalid_grant' })
+		expect((log as any).data.eventData).toEqual({ reason: 'invalid_grant', apiKeyId: 'api-key-1' })
 		expect((log as any).data.metadata).toBeUndefined()
 	})
 
@@ -269,6 +273,8 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		expect(log).toBeDefined()
 		expect((log as any).data.type).toBe('idp_session_revalidated')
 		expect((log as any).data.success).toBe(true)
+		expect((log as any).data.personTokenId).toBeUndefined()
+		expect((log as any).data.eventData).toEqual({ apiKeyId: 'api-key-1' })
 	})
 
 	test('records the originating request IP / user agent on both revoke and revalidated entries', async () => {
@@ -280,6 +286,8 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		const revokeLog = revoked.executed.find(c => c instanceof CreateAuthLogEntryCommand) as any
 		expect(revokeLog.data.ipAddress).toBe('203.0.113.7')
 		expect(revokeLog.data.userAgent).toBe('Mozilla/5.0 test')
+		expect(revokeLog.data.personTokenId).toBeUndefined()
+		expect(revokeLog.data.eventData).toEqual({ reason: 'invalid_grant', apiKeyId: 'api-key-1' })
 
 		const rotated = createHarness(baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } }))
 		await makeRevalidator(
@@ -304,6 +312,8 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		expect(log.data.errorCode).toBe('revalidation_error')
 		expect(log.data.success).toBe(true) // fail-open marker, not a security failure
 		expect(log.data.ipAddress).toBe('203.0.113.7')
+		expect(log.data.personTokenId).toBeUndefined()
+		expect(log.data.eventData).toEqual({ apiKeyId: 'api-key-1' })
 	})
 
 	test('corrupt stored config (fail open) is audited as idp_session_revalidation_failed / config_invalid', async () => {
@@ -352,6 +362,27 @@ describe('IdpSessionRevalidator — audit logging', () => {
 		expect(out).toBe('valid')
 	})
 
+	// person_auth_log.person_token_id references person_token(id), so an api_key id there fails the FK
+	// and the insert throws. The key is already disabled at that point: the request must still be
+	// answered as revoked, not surface the audit failure (#964).
+	for (
+		const [name, row] of [
+			['blocking revocation', baseRow({ session: { tokens: { refresh_token: 'r' }, expiresAt: t('11:30:00') } })],
+			['disabled provider', baseRow({ providerDisabledAt: t('11:30:00') })],
+		] as const
+	) {
+		test(`a failing audit write on ${name} still returns revoked and logs the error`, async () => {
+			const h = createHarness(row, { failAudit: true })
+			const logs = new TestLoggerHandler()
+			const out = await makeRevalidator(registryWith(async () => ({ status: 'revoked', reason: 'invalid_grant' })), createLogger(logs))
+				.revalidate(h.dbContext, h.readDbContext, apiKeyRow)
+			expect(out).toBe('revoked')
+			expect(h.executed.some(c => c instanceof DisableApiKeyCommand)).toBe(true)
+			expect(h.executed.some(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_session_revoked')).toBe(true)
+			expect(logs.messages.some(m => m.level.name === 'error' && m.error instanceof Error && m.error.message === 'audit insert failed')).toBe(true)
+		})
+	}
+
 	test('a no-op probe (valid, no rotated session) is NOT logged', async () => {
 		// userinfo / introspection return valid without an idpSession; logging every such tick
 		// (every minInterval) would flood the audit log, so it must stay silent.
@@ -461,6 +492,7 @@ describe('IdpSessionRevalidator — A09 claim mapping on refresh', () => {
 		expect(log).toBeDefined()
 		expect(log.data.success).toBe(true)
 		expect(log.data.eventData.after.memberships).toEqual([{ project: 'demo', role: 'editor', variables: [] }])
+		expect(log.data.personTokenId).toBeUndefined()
 	})
 
 	test('sticky mapping is skipped on refresh (always-only) — no membership write, no audit', async () => {
@@ -484,6 +516,7 @@ describe('IdpSessionRevalidator — A09 claim mapping on refresh', () => {
 		const log = h.executed.find(c => c instanceof CreateAuthLogEntryCommand && (c as any).data.type === 'idp_role_mapping_failed') as any
 		expect(log).toBeDefined()
 		expect(log.data.success).toBe(true)
+		expect(log.data.personTokenId).toBeUndefined()
 	})
 
 	test('refresh without fresh claims does not run claim sync', async () => {

package/tests/src/IdPMock.ts

@@ -17,6 +17,8 @@ export class IdPMock implements IdentityProviderHandler<any> {
 			// mirroring how real providers spread raw OIDC claims into the IDPResponse — lets tests
 			// drive claim-mapping (A09). `claimMapping` itself lives on the IdP config, not here.
 			...(configuration.claims ?? {}),
+			// Lets tests drive the federated-session branch of sign-in (re-validation state).
+			...(configuration.idpSession ? { idpSession: configuration.idpSession } : {}),
 		})
 	}
 

package/tests/src/testTenant.ts

@@ -143,6 +143,7 @@ export const executeTenantTest = async (test: Test) => {
 			connection,
 			readConnection: connection,
 			cryptoProviders: providers,
+			logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
 		})
 		.replaceService('mailer', () => mailer)
 		.setupService('idpRegistry', reg => {