@aglyn/tenant-data-admin 1.0.0-beta.143

package/src/lib/server/sso-drift-logic.js

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * Has an SSO domain stopped proving it belongs to the org routing it, and is
+ * that conclusion safe to act on? (AGL-1210)
+ *
+ * PURE, and in its own file with NO imports at all — not `dns`, not
+ * `firebase-admin`. `sso-provisioning.ts` re-exports everything here, so the
+ * public surface is unchanged, but the decision can be required by a test on
+ * either side of the app/lib boundary without dragging in the admin SDK. The
+ * console route's spec does exactly that: it fakes the I/O and runs the REAL
+ * decision, which is the only arrangement where "the route obeys the rule"
+ * means anything.
+ *
+ * The reasoning for the policy itself lives in `sso-provisioning.ts`, next to
+ * the probe it interprets. In one line: a DNS lookup cannot distinguish "the
+ * record is gone" from "nobody answered", so the third state below is what
+ * stops a resolver blip from being read as every customer deleting their TXT
+ * record at the same instant.
+ */ /**
+ * What a re-verification lookup actually established.
+ *
+ * The third state is the whole point. A resolver that did not answer has told
+ * us nothing, and "nothing" must not be counted as "gone".
+ */ /**
+ * Consecutive conclusive failures before a domain is REPORTED as drifted.
+ *
+ * Three, against a weekly sweep, is a three-week signal. Exported so the
+ * threshold is one named number rather than a literal buried in a loop, and so
+ * a test can state the boundary it is checking.
+ */ export const SSO_DRIFT_FAILURES_BEFORE_REPORT = 3;
+/**
+ * And the wall-clock floor the same run must clear, independent of the count.
+ *
+ * Belt AND braces, because the two guard different mistakes. The count alone
+ * can be run up in three minutes by a staff member re-running the sweep by
+ * hand, or by a scheduler firing more often than anyone intended — and "we
+ * checked three times" reads as diligence while meaning nothing. The age alone
+ * would report a domain that failed once a month ago and has answered every
+ * time since. A report needs both.
+ */ export const SSO_DRIFT_MIN_AGE_MS = 14 * 24 * 60 * 60000;
+/**
+ * Should this probe change anything, and has the domain drifted?
+ *
+ * `hold` is the load-bearing arm. An `unreachable` probe neither increments
+ * the count nor resets it — an outage must not manufacture evidence, and must
+ * not launder away evidence already gathered either. The run simply pauses,
+ * and the next conclusive answer continues it.
+ *
+ * Note what this function CANNOT return: there is no `revoke`. Detection is
+ * the whole of its vocabulary, and revocation stays a human act.
+ */ export function assessDomainDrift(probe, prior, nowMs, failuresBeforeReport = SSO_DRIFT_FAILURES_BEFORE_REPORT, minAgeMs = SSO_DRIFT_MIN_AGE_MS) {
+    // Read defensively: these come straight off a Firestore document, and with
+    // `strictNullChecks` off the compiler will not mention that they might be
+    // undefined, NaN, or a value written before this feature existed.
+    const priorCount = Number(prior == null ? void 0 : prior.consecutiveFailures) || 0;
+    const priorFirst = Number.isFinite(prior == null ? void 0 : prior.firstFailureAtMs) && prior.firstFailureAtMs > 0 ? prior.firstFailureAtMs : null;
+    if (probe.status === 'unreachable') {
+        return {
+            action: 'hold',
+            consecutiveFailures: priorCount,
+            firstFailureAtMs: priorFirst
+        };
+    }
+    if (probe.status === 'proven') {
+        return {
+            action: 'clear',
+            consecutiveFailures: 0,
+            firstFailureAtMs: null
+        };
+    }
+    const consecutiveFailures = priorCount + 1;
+    const firstFailureAtMs = priorFirst != null ? priorFirst : nowMs;
+    const oldEnough = nowMs - firstFailureAtMs >= minAgeMs;
+    return {
+        action: consecutiveFailures >= failuresBeforeReport && oldEnough ? 'report' : 'count',
+        consecutiveFailures,
+        firstFailureAtMs
+    };
+}
+
+//# sourceMappingURL=sso-drift-logic.js.map

package/src/lib/server/sso-drift-logic.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../../libs/tenant/data/admin/src/lib/server/sso-drift-logic.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * Has an SSO domain stopped proving it belongs to the org routing it, and is\n * that conclusion safe to act on? (AGL-1210)\n *\n * PURE, and in its own file with NO imports at all — not `dns`, not\n * `firebase-admin`. `sso-provisioning.ts` re-exports everything here, so the\n * public surface is unchanged, but the decision can be required by a test on\n * either side of the app/lib boundary without dragging in the admin SDK. The\n * console route's spec does exactly that: it fakes the I/O and runs the REAL\n * decision, which is the only arrangement where \"the route obeys the rule\"\n * means anything.\n *\n * The reasoning for the policy itself lives in `sso-provisioning.ts`, next to\n * the probe it interprets. In one line: a DNS lookup cannot distinguish \"the\n * record is gone\" from \"nobody answered\", so the third state below is what\n * stops a resolver blip from being read as every customer deleting their TXT\n * record at the same instant.\n */\n\n/**\n * What a re-verification lookup actually established.\n *\n * The third state is the whole point. A resolver that did not answer has told\n * us nothing, and \"nothing\" must not be counted as \"gone\".\n */\nexport type DomainProbeStatus =\n  /** The record is there and matches this org's token. */\n  | 'proven'\n  /** We got an ANSWER, and the token is not in it. Conclusive. */\n  | 'missing'\n  /** Nobody answered. Not evidence of anything, in either direction. */\n  | 'unreachable'\n\nexport interface DomainProbe {\n  status: DomainProbeStatus\n  /** What the lookup saw — the difference between \"gone\" and \"changed\". */\n  records: string[]\n}\n\n/**\n * Consecutive conclusive failures before a domain is REPORTED as drifted.\n *\n * Three, against a weekly sweep, is a three-week signal. Exported so the\n * threshold is one named number rather than a literal buried in a loop, and so\n * a test can state the boundary it is checking.\n */\nexport const SSO_DRIFT_FAILURES_BEFORE_REPORT = 3\n\n/**\n * And the wall-clock floor the same run must clear, independent of the count.\n *\n * Belt AND braces, because the two guard different mistakes. The count alone\n * can be run up in three minutes by a staff member re-running the sweep by\n * hand, or by a scheduler firing more often than anyone intended — and \"we\n * checked three times\" reads as diligence while meaning nothing. The age alone\n * would report a domain that failed once a month ago and has answered every\n * time since. A report needs both.\n */\nexport const SSO_DRIFT_MIN_AGE_MS = 14 * 24 * 60 * 60_000\n\n/** The drift bookkeeping carried on a claim between sweeps. */\nexport interface DomainDriftState {\n  /** Conclusive failures in a row. Reset by any single `proven`. */\n  consecutiveFailures: number\n  /** When the current run of failures began. Null when there is no run. */\n  firstFailureAtMs: number | null\n}\n\nexport type DomainDriftAction =\n  /** Proven. Any failure run ends here. */\n  | 'clear'\n  /** Unreachable. Change nothing at all — this is not evidence. */\n  | 'hold'\n  /** Conclusive failure, but not yet enough of them for long enough. */\n  | 'count'\n  /** Enough, for long enough. Tell people. Still revoke nothing. */\n  | 'report'\n\nexport interface DomainDriftVerdict {\n  action: DomainDriftAction\n  /** The run length AFTER this probe. Unchanged on `hold`. */\n  consecutiveFailures: number\n  /** Start of the run after this probe, for the next sweep to carry. */\n  firstFailureAtMs: number | null\n}\n\n/**\n * Should this probe change anything, and has the domain drifted?\n *\n * `hold` is the load-bearing arm. An `unreachable` probe neither increments\n * the count nor resets it — an outage must not manufacture evidence, and must\n * not launder away evidence already gathered either. The run simply pauses,\n * and the next conclusive answer continues it.\n *\n * Note what this function CANNOT return: there is no `revoke`. Detection is\n * the whole of its vocabulary, and revocation stays a human act.\n */\nexport function assessDomainDrift(\n  probe: DomainProbe,\n  prior: DomainDriftState,\n  nowMs: number,\n  failuresBeforeReport: number = SSO_DRIFT_FAILURES_BEFORE_REPORT,\n  minAgeMs: number = SSO_DRIFT_MIN_AGE_MS,\n): DomainDriftVerdict {\n  // Read defensively: these come straight off a Firestore document, and with\n  // `strictNullChecks` off the compiler will not mention that they might be\n  // undefined, NaN, or a value written before this feature existed.\n  const priorCount = Number(prior?.consecutiveFailures) || 0\n  const priorFirst =\n    Number.isFinite(prior?.firstFailureAtMs) && prior.firstFailureAtMs > 0\n      ? prior.firstFailureAtMs\n      : null\n\n  if (probe.status === 'unreachable') {\n    return {\n      action: 'hold',\n      consecutiveFailures: priorCount,\n      firstFailureAtMs: priorFirst,\n    }\n  }\n  if (probe.status === 'proven') {\n    return { action: 'clear', consecutiveFailures: 0, firstFailureAtMs: null }\n  }\n\n  const consecutiveFailures = priorCount + 1\n  const firstFailureAtMs = priorFirst ?? nowMs\n  const oldEnough = nowMs - firstFailureAtMs >= minAgeMs\n  return {\n    action:\n      consecutiveFailures >= failuresBeforeReport && oldEnough\n        ? 'report'\n        : 'count',\n    consecutiveFailures,\n    firstFailureAtMs,\n  }\n}\n"],"names":["SSO_DRIFT_FAILURES_BEFORE_REPORT","SSO_DRIFT_MIN_AGE_MS","assessDomainDrift","probe","prior","nowMs","failuresBeforeReport","minAgeMs","priorCount","Number","consecutiveFailures","priorFirst","isFinite","firstFailureAtMs","status","action","oldEnough"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;CAiBC,GAED;;;;;CAKC,GAeD;;;;;;CAMC,GACD,OAAO,MAAMA,mCAAmC,EAAC;AAEjD;;;;;;;;;CASC,GACD,OAAO,MAAMC,uBAAuB,KAAK,KAAK,KAAK,MAAM;AA4BzD;;;;;;;;;;CAUC,GACD,OAAO,SAASC,kBACdC,KAAkB,EAClBC,KAAuB,EACvBC,KAAa,EACbC,uBAA+BN,gCAAgC,EAC/DO,WAAmBN,oBAAoB;IAEvC,2EAA2E;IAC3E,0EAA0E;IAC1E,kEAAkE;IAClE,MAAMO,aAAaC,OAAOL,yBAAAA,MAAOM,mBAAmB,KAAK;IACzD,MAAMC,aACJF,OAAOG,QAAQ,CAACR,yBAAAA,MAAOS,gBAAgB,KAAKT,MAAMS,gBAAgB,GAAG,IACjET,MAAMS,gBAAgB,GACtB;IAEN,IAAIV,MAAMW,MAAM,KAAK,eAAe;QAClC,OAAO;YACLC,QAAQ;YACRL,qBAAqBF;YACrBK,kBAAkBF;QACpB;IACF;IACA,IAAIR,MAAMW,MAAM,KAAK,UAAU;QAC7B,OAAO;YAAEC,QAAQ;YAASL,qBAAqB;YAAGG,kBAAkB;QAAK;IAC3E;IAEA,MAAMH,sBAAsBF,aAAa;IACzC,MAAMK,mBAAmBF,qBAAAA,aAAcN;IACvC,MAAMW,YAAYX,QAAQQ,oBAAoBN;IAC9C,OAAO;QACLQ,QACEL,uBAAuBJ,wBAAwBU,YAC3C,WACA;QACNN;QACAG;IACF;AACF"}

package/src/lib/server/sso-enforcement.d.ts

@@ -0,0 +1,204 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * SSO enforcement sweep (AGL-1129): when an org turns on `sso.enforced`,
+ * every account in its GCIP tenant loses any sign-in method that is not the
+ * org's own IdP.
+ *
+ * AGL-1128 stopped SSO-governed accounts from linking NEW consumer providers.
+ * This is the grandfathering half: an account that linked Google before
+ * enforcement keeps a way in that the customer's IdP cannot see or revoke, and
+ * a bypass that predates the switch is still a bypass.
+ *
+ * Runs against the TENANT pool via `authForPool` — project-level Admin SDK
+ * calls cannot see, let alone mutate, these accounts (AGL-1122).
+ *
+ * Three properties this must have, in order of how badly they bite:
+ *
+ *  1. **Never unlink down to zero.** An account whose only provider is the one
+ *     we are about to remove would be orphaned — reachable by nobody, not even
+ *     the IdP. Skipped and reported, never assumed away: being in the tenant
+ *     does not prove the SAML link is present.
+ *  2. **Revoke refresh tokens for accounts it actually changed.** Unlinking
+ *     does not end a live session, so without this the bypass simply has a
+ *     clock on it. Only for accounts that changed — a sweep that revoked
+ *     everyone would sign out the org's whole staff on a no-op run.
+ *  3. **Idempotent.** Re-running is the natural way to catch accounts created
+ *     between the flag flip and the sweep, so a second run must be a no-op
+ *     rather than a second round of revocations.
+ *  4. **Never leave the ORG with no way in** (AGL-1888). Property 1 protects
+ *     one account at a time and is blind to the org-level failure: strip every
+ *     account down to the SAML link and the pool is perfectly consistent right
+ *     up until the IdP stops answering, at which point nobody can sign in and
+ *     we cannot let them back in either. The `aglyn-org-y5v14` tenant is in
+ *     that state today. So enforcement REFUSES unless the org keeps a way in
+ *     that does
+ *     not depend on the IdP: either a DESIGNATED break-glass account inside
+ *     the pool, or an org owner who lives OUTSIDE it
+ *     ({@link findBreakGlassOrgOwners}). The second is what makes the first
+ *     satisfiable at all — nothing inside a pool we provisioned can hold a
+ *     password, so for a while this guard could only ever say no.
+ */
+import type { UserRecord } from 'firebase-admin/auth';
+import { type SsoBreakGlassOwner } from './sso-break-glass-owners';
+export interface SsoEnforcementOptions {
+    /** Staff uid recorded on the audit rows; `system` for an automated run. */
+    actorUid?: string;
+    /** Report what would change without touching anything. */
+    dryRun?: boolean;
+    /**
+     * Run even when `sso.enforced` is false. ONLY for a rehearsal against a
+     * throwaway account — the flag is the customer's instruction, and acting
+     * without it removes sign-in methods nobody asked us to remove.
+     */
+    force?: boolean;
+}
+/** Why an account with removable providers was left alone. */
+export type SsoEnforcementSkip = 'would-orphan' | 'break-glass';
+export interface SsoEnforcementAccount {
+    uid: string;
+    email: string | null;
+    /** Providers removed (or that would be, in a dry run). */
+    unlinked: string[];
+    /** Providers left in place. */
+    kept: string[];
+    /** Why an account with removable providers was left alone. */
+    skipped?: SsoEnforcementSkip;
+}
+/**
+ * Whether this org would still have a way in if its IdP stopped answering
+ * (AGL-1888).
+ */
+export interface SsoLockoutAssessment {
+    /**
+     * True when the org keeps at least one way in that its IdP does not
+     * mediate: a DESIGNATED break-glass account inside the pool, or an org
+     * owner outside it.
+     */
+    safe: boolean;
+    /** Designated break-glass uids that actually retain a non-IdP credential. */
+    retainedBy: string[];
+    /**
+     * Designated uids that do NOT protect anybody — either absent from the pool,
+     * or holding nothing but the IdP link. Named rather than silently ignored:
+     * a designation that protects nothing is worse than none, because it reads
+     * as protection.
+     */
+    ineffective: string[];
+    /**
+     * Org owners in the PROJECT pool (AGL-1888 option (a)). The sweep cannot
+     * see these accounts, so an IdP that stops answering cannot lock them out.
+     * Named, not counted: the admin has to recognise the person.
+     */
+    ownersOutsidePool: SsoBreakGlassOwner[];
+    /**
+     * The owner lookup could not be completed. `ownersOutsidePool` is then
+     * INCOMPLETE rather than empty, so the refusal must say we could not check
+     * instead of asserting the org has nobody. Never makes an org safe.
+     */
+    ownerLookupFailed: boolean;
+}
+export interface SsoEnforcementResult {
+    orgId: string;
+    tenantId: string;
+    providerId: string;
+    dryRun: boolean;
+    /** Accounts walked. */
+    scanned: number;
+    /** Accounts whose providers changed (0 on a converged re-run). */
+    changed: number;
+    accounts: SsoEnforcementAccount[];
+    /** True when the tenant holds more accounts than one sweep walks. */
+    truncated: boolean;
+    /**
+     * Whether the org retains a way in that does not depend on its IdP
+     * (AGL-1888). Present on the DRY RUN too — that is the point, since the
+     * rehearsal is where an org is supposed to discover it needs one.
+     */
+    lockout: SsoLockoutAssessment;
+}
+export declare class SsoEnforcementError extends Error {
+}
+/**
+ * Strip non-IdP sign-in methods from every account in an org's SSO tenant.
+ *
+ * Throws when the org has no active SSO config, or when `sso.enforced` is
+ * false without `force` — enforcement is the customer's switch, and running
+ * this without it would be us deciding to remove their people's sign-in
+ * methods on our own.
+ */
+export declare function enforceSsoSignInMethods(orgId: string, options?: SsoEnforcementOptions): Promise<SsoEnforcementResult>;
+/**
+ * What one account loses, decided without mutating anything so the dry run
+ * and the real run cannot disagree.
+ *
+ * `password` counts as a provider to strip: an email/password credential on a
+ * governed account is exactly the sort of standing bypass enforcement is
+ * bought to remove, and it is not the org's IdP.
+ *
+ * @param breakGlass uids the org has DESIGNATED to keep their other sign-in
+ *        methods (AGL-1888). Deliberately a parameter rather than a lookup:
+ *        this function is the whole decision and stays pure, so the rehearsal
+ *        and the real run cannot diverge on it either.
+ */
+export declare function planAccount(record: UserRecord, providerId: string, breakGlass?: ReadonlySet<string>): SsoEnforcementAccount;
+/**
+ * Would this org still have a way in after the sweep? (AGL-1888)
+ *
+ * Pure, and over the PLANNED accounts rather than the raw records, so it
+ * answers the question about the state enforcement is actually about to
+ * create rather than the one it is in now.
+ *
+ * ONLY A DESIGNATED ACCOUNT COUNTS. An account that happens to retain a
+ * password because it is misconfigured — the `would-orphan` case, which has no
+ * IdP link at all — is not break-glass: nobody chose it, it may be a stale
+ * record or a service account, and an org protected by an accident it does not
+ * know about is not protected. Requiring the designation is what makes this a
+ * control rather than a coincidence.
+ *
+ * A designation only counts when the account actually holds something OTHER
+ * than the org's IdP. Naming an account whose sole credential is the SAML link
+ * is the most natural way to get this wrong — it looks like a break-glass
+ * account and provides nothing, because it fails in exactly the situation it
+ * exists for.
+ *
+ * THE SECOND WAY IN IS NOT IN THE POOL AT ALL (AGL-1888 option (a)). An org
+ * owner holding a project-level credential is invisible to the sweep — the
+ * enforcement pass lists `authForPool(tenantId)` and never touches the
+ * project pool — so a lapsed certificate cannot reach them. No designation is
+ * required for those: nobody has to be told to keep the key they already
+ * hold, and requiring a tick would put the requirement back out of reach for
+ * exactly the org that already satisfies it. Whether such an owner exists is
+ * decided by {@link findBreakGlassOrgOwners}, which is where the seven
+ * conditions live; this function only counts what it is handed, so that the
+ * rehearsal and the real run cannot disagree.
+ *
+ * `ownerLookupFailed` deliberately does NOT make an org safe. It exists so a
+ * refusal can distinguish "you have nobody" from "we could not check" — an
+ * error swallowed into an empty list renders as a measured zero, and nothing
+ * about it looks wrong.
+ */
+export declare function assessSsoLockoutRisk(accounts: readonly SsoEnforcementAccount[], providerId: string, breakGlass: readonly string[], ownersOutsidePool?: readonly SsoBreakGlassOwner[], ownerLookupFailed?: boolean): SsoLockoutAssessment;
+/**
+ * The refusal an org sees when enforcing would lock it out of itself.
+ *
+ * Says what to do, because a refusal that only says no sends someone to turn
+ * the guard off. Deliberately free of a product name — this string is read by
+ * self-host operators too.
+ */
+export declare const SSO_LOCKOUT_REFUSAL: string;
+export default enforceSsoSignInMethods;

package/src/lib/server/sso-enforcement.js

@@ -0,0 +1,309 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * SSO enforcement sweep (AGL-1129): when an org turns on `sso.enforced`,
+ * every account in its GCIP tenant loses any sign-in method that is not the
+ * org's own IdP.
+ *
+ * AGL-1128 stopped SSO-governed accounts from linking NEW consumer providers.
+ * This is the grandfathering half: an account that linked Google before
+ * enforcement keeps a way in that the customer's IdP cannot see or revoke, and
+ * a bypass that predates the switch is still a bypass.
+ *
+ * Runs against the TENANT pool via `authForPool` — project-level Admin SDK
+ * calls cannot see, let alone mutate, these accounts (AGL-1122).
+ *
+ * Three properties this must have, in order of how badly they bite:
+ *
+ *  1. **Never unlink down to zero.** An account whose only provider is the one
+ *     we are about to remove would be orphaned — reachable by nobody, not even
+ *     the IdP. Skipped and reported, never assumed away: being in the tenant
+ *     does not prove the SAML link is present.
+ *  2. **Revoke refresh tokens for accounts it actually changed.** Unlinking
+ *     does not end a live session, so without this the bypass simply has a
+ *     clock on it. Only for accounts that changed — a sweep that revoked
+ *     everyone would sign out the org's whole staff on a no-op run.
+ *  3. **Idempotent.** Re-running is the natural way to catch accounts created
+ *     between the flag flip and the sweep, so a second run must be a no-op
+ *     rather than a second round of revocations.
+ *  4. **Never leave the ORG with no way in** (AGL-1888). Property 1 protects
+ *     one account at a time and is blind to the org-level failure: strip every
+ *     account down to the SAML link and the pool is perfectly consistent right
+ *     up until the IdP stops answering, at which point nobody can sign in and
+ *     we cannot let them back in either. The `aglyn-org-y5v14` tenant is in
+ *     that state today. So enforcement REFUSES unless the org keeps a way in
+ *     that does
+ *     not depend on the IdP: either a DESIGNATED break-glass account inside
+ *     the pool, or an org owner who lives OUTSIDE it
+ *     ({@link findBreakGlassOrgOwners}). The second is what makes the first
+ *     satisfiable at all — nothing inside a pool we provisioned can hold a
+ *     password, so for a while this guard could only ever say no.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { FieldValue } from "firebase-admin/firestore";
+import { authForPool } from "./auth-pools.js";
+import { findBreakGlassOrgOwners } from "./sso-break-glass-owners.js";
+import { invalidateTokenRevocationCache } from "./token-revocation.js";
+import firebaseAdmin from "./firebase-admin.js";
+import { notifyUsers } from "./notifications.js";
+const firestore = ()=>firebaseAdmin.app().firestore();
+/** How many tenant accounts one sweep will walk. Enterprise pools are small. */ const TENANT_USER_CAP = 1000;
+export class SsoEnforcementError extends Error {
+}
+/**
+ * Strip non-IdP sign-in methods from every account in an org's SSO tenant.
+ *
+ * Throws when the org has no active SSO config, or when `sso.enforced` is
+ * false without `force` — enforcement is the customer's switch, and running
+ * this without it would be us deciding to remove their people's sign-in
+ * methods on our own.
+ */ export async function enforceSsoSignInMethods(orgId, options = {}) {
+    const { actorUid = 'system', dryRun = false, force = false } = options;
+    const db = firestore();
+    const orgSnapshot = await db.collection('orgs').doc(orgId).get();
+    if (!orgSnapshot.exists) {
+        throw new SsoEnforcementError(`No such organization: ${orgId}`);
+    }
+    const sso = orgSnapshot.get('sso');
+    const tenantId = sso == null ? void 0 : sso.tenantId;
+    const providerId = sso == null ? void 0 : sso.providerId;
+    if (!tenantId || !providerId) {
+        throw new SsoEnforcementError(`${orgId} has no SSO tenant configured`);
+    }
+    if ((sso == null ? void 0 : sso.status) !== 'active') {
+        var _ref;
+        throw new SsoEnforcementError(`${orgId} SSO status is "${(_ref = sso == null ? void 0 : sso.status) != null ? _ref : 'unset'}", not active`);
+    }
+    if (!(sso == null ? void 0 : sso.enforced) && !force) {
+        throw new SsoEnforcementError(`${orgId} has sso.enforced = false — nothing to enforce`);
+    }
+    const breakGlassUids = Array.isArray(sso == null ? void 0 : sso.breakGlassUids) ? sso.breakGlassUids.map(String).filter(Boolean) : [];
+    const pool = authForPool(tenantId);
+    const page = await pool.listUsers(TENANT_USER_CAP);
+    const accounts = [];
+    const changedUids = [];
+    const breakGlass = new Set(breakGlassUids);
+    for (const record of page.users){
+        const summary = planAccount(record, providerId, breakGlass);
+        accounts.push(summary);
+    }
+    // The half the pool cannot supply (AGL-1888 option (a)). Run for the DRY
+    // RUN too: the rehearsal is where an org learns whether it may enforce, and
+    // a rehearsal that skipped this would report a lockout risk the real run
+    // then disagrees with.
+    const ownerLookup = await findBreakGlassOrgOwners(orgId, providerId, tenantId);
+    const lockout = assessSsoLockoutRisk(accounts, providerId, breakGlassUids, ownerLookup.owners, ownerLookup.unavailable);
+    // THE PRE-FLIGHT (AGL-1888). Planned first, refused before a single
+    // `updateUser` — this is the whole reason the plan is computed separately
+    // from being carried out. Half a sweep is the worst outcome available: the
+    // accounts already stripped are stripped, and the org is locked out with no
+    // record of how far it got.
+    //
+    // The dry run is exempt, and has to be. The rehearsal is exactly how an org
+    // FINDS OUT it needs a break-glass account, so refusing to rehearse would
+    // leave them guessing at the requirement they are being held to.
+    //
+    // No override parameter. An `acknowledgeLockoutRisk: true` a caller can pass
+    // is not a guard, it is a spelling of the guard being off — and the caller
+    // that would pass it is the one already convinced enforcement is fine.
+    if (!dryRun && !lockout.safe) {
+        throw new SsoEnforcementError(SSO_LOCKOUT_REFUSAL);
+    }
+    for (const summary of accounts){
+        const record = page.users.find((user)=>user.uid === summary.uid);
+        if (!record) continue;
+        if (!summary.unlinked.length || summary.skipped) continue;
+        if (!dryRun) {
+            await pool.updateUser(record.uid, {
+                providersToUnlink: summary.unlinked
+            });
+            // Only for accounts that actually changed (property 2 above). An
+            // existing session outlives the unlink otherwise.
+            await pool.revokeRefreshTokens(record.uid);
+            // This process refuses the old token NOW (AGL-1881); every other one
+            // converges within TOKEN_REVOCATION_TTL_MS.
+            invalidateTokenRevocationCache(record.uid, tenantId);
+            await db.collection('adminAudit').add({
+                actorUid,
+                action: 'org.sso.enforceSignInMethods',
+                target: `users/${record.uid}`,
+                before: {
+                    providers: providerIdsOf(record)
+                },
+                after: {
+                    providers: summary.kept,
+                    orgId,
+                    tenantId,
+                    unlinked: summary.unlinked,
+                    tokensRevoked: true
+                },
+                at: FieldValue.serverTimestamp()
+            });
+        }
+        changedUids.push(record.uid);
+    }
+    if (!dryRun && changedUids.length) {
+        // Explaining it beats a mysteriously missing button on their next visit.
+        await notifyUsers(changedUids, {
+            type: 'system.signInMethodRemoved',
+            title: 'Your sign-in methods changed',
+            body: 'Your organization now requires single sign-on, so other sign-in ' + 'methods have been removed from your account. Sign in through your ' + 'organization instead.',
+            orgId,
+            link: '/manage/user'
+        });
+    }
+    return {
+        orgId,
+        tenantId,
+        providerId,
+        dryRun,
+        scanned: page.users.length,
+        changed: changedUids.length,
+        accounts,
+        truncated: Boolean(page.pageToken),
+        lockout
+    };
+}
+const providerIdsOf = (record)=>{
+    var _record_providerData;
+    return ((_record_providerData = record.providerData) != null ? _record_providerData : []).map((info)=>info == null ? void 0 : info.providerId).filter((id)=>Boolean(id));
+};
+/**
+ * What one account loses, decided without mutating anything so the dry run
+ * and the real run cannot disagree.
+ *
+ * `password` counts as a provider to strip: an email/password credential on a
+ * governed account is exactly the sort of standing bypass enforcement is
+ * bought to remove, and it is not the org's IdP.
+ *
+ * @param breakGlass uids the org has DESIGNATED to keep their other sign-in
+ *        methods (AGL-1888). Deliberately a parameter rather than a lookup:
+ *        this function is the whole decision and stays pure, so the rehearsal
+ *        and the real run cannot diverge on it either.
+ */ export function planAccount(record, providerId, breakGlass = new Set()) {
+    var _record_email;
+    const providers = providerIdsOf(record);
+    const unlinked = providers.filter((id)=>id !== providerId);
+    const kept = providers.filter((id)=>id === providerId);
+    const summary = {
+        uid: record.uid,
+        email: (_record_email = record.email) != null ? _record_email : null,
+        unlinked,
+        kept
+    };
+    // Property 1: an account with nothing but removable providers keeps them.
+    // It is misconfigured, not a bypass to close, and orphaning it would turn a
+    // security tightening into a lockout with no way back.
+    if (unlinked.length && !kept.length) {
+        return _extends({}, summary, {
+            unlinked: [],
+            kept: providers,
+            skipped: 'would-orphan'
+        });
+    }
+    // Property 4 (AGL-1888): a designated break-glass account keeps everything.
+    //
+    // This IS a standing bypass of SSO enforcement, and it is meant to be —
+    // that is what makes it a way back in when the IdP stops answering. The
+    // alternative is the state the `aglyn-org-y5v14` tenant is in today: every
+    // account in the pool holds nothing but a SAML link, and a lapsed
+    // certificate or a deleted SAML app locks the organization out of itself
+    // permanently.
+    //
+    // Checked AFTER the orphan rule so the two cannot disagree about an account
+    // that is both, and it changes nothing for a break-glass account that has
+    // no removable provider anyway — `skipped` marks a decision, so it is set
+    // only where there was something to decide.
+    if (unlinked.length && breakGlass.has(record.uid)) {
+        return _extends({}, summary, {
+            unlinked: [],
+            kept: providers,
+            skipped: 'break-glass'
+        });
+    }
+    return summary;
+}
+/**
+ * Would this org still have a way in after the sweep? (AGL-1888)
+ *
+ * Pure, and over the PLANNED accounts rather than the raw records, so it
+ * answers the question about the state enforcement is actually about to
+ * create rather than the one it is in now.
+ *
+ * ONLY A DESIGNATED ACCOUNT COUNTS. An account that happens to retain a
+ * password because it is misconfigured — the `would-orphan` case, which has no
+ * IdP link at all — is not break-glass: nobody chose it, it may be a stale
+ * record or a service account, and an org protected by an accident it does not
+ * know about is not protected. Requiring the designation is what makes this a
+ * control rather than a coincidence.
+ *
+ * A designation only counts when the account actually holds something OTHER
+ * than the org's IdP. Naming an account whose sole credential is the SAML link
+ * is the most natural way to get this wrong — it looks like a break-glass
+ * account and provides nothing, because it fails in exactly the situation it
+ * exists for.
+ *
+ * THE SECOND WAY IN IS NOT IN THE POOL AT ALL (AGL-1888 option (a)). An org
+ * owner holding a project-level credential is invisible to the sweep — the
+ * enforcement pass lists `authForPool(tenantId)` and never touches the
+ * project pool — so a lapsed certificate cannot reach them. No designation is
+ * required for those: nobody has to be told to keep the key they already
+ * hold, and requiring a tick would put the requirement back out of reach for
+ * exactly the org that already satisfies it. Whether such an owner exists is
+ * decided by {@link findBreakGlassOrgOwners}, which is where the seven
+ * conditions live; this function only counts what it is handed, so that the
+ * rehearsal and the real run cannot disagree.
+ *
+ * `ownerLookupFailed` deliberately does NOT make an org safe. It exists so a
+ * refusal can distinguish "you have nobody" from "we could not check" — an
+ * error swallowed into an empty list renders as a measured zero, and nothing
+ * about it looks wrong.
+ */ export function assessSsoLockoutRisk(accounts, providerId, breakGlass, ownersOutsidePool = [], ownerLookupFailed = false) {
+    const designated = [
+        ...new Set(breakGlass.filter(Boolean))
+    ];
+    const byUid = new Map(accounts.map((account)=>[
+            account.uid,
+            account
+        ]));
+    const retainedBy = [];
+    const ineffective = [];
+    for (const uid of designated){
+        const account = byUid.get(uid);
+        const protects = Boolean(account == null ? void 0 : account.kept.some((id)=>id !== providerId));
+        if (protects) retainedBy.push(uid);
+        else ineffective.push(uid);
+    }
+    const owners = [
+        ...ownersOutsidePool
+    ];
+    return {
+        safe: retainedBy.length > 0 || owners.length > 0,
+        retainedBy,
+        ineffective,
+        ownersOutsidePool: owners,
+        ownerLookupFailed
+    };
+}
+/**
+ * The refusal an org sees when enforcing would lock it out of itself.
+ *
+ * Says what to do, because a refusal that only says no sends someone to turn
+ * the guard off. Deliberately free of a product name — this string is read by
+ * self-host operators too.
+ */ export const SSO_LOCKOUT_REFUSAL = 'Enforcing single sign-on would remove every sign-in method that does not ' + 'go through your identity provider, and this organization would be left ' + 'with no way in that survives your identity provider failing. If its ' + 'certificate lapses or its application is removed, nobody would be able ' + 'to sign in and we could not let you back in either. Give the ' + 'organization one of two things first: an owner who signs in outside your ' + 'identity pool, or a designated break-glass account inside it that keeps ' + 'a password.';
+export default enforceSsoSignInMethods;
+
+//# sourceMappingURL=sso-enforcement.js.map