@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/export/logto.js

@@ -0,0 +1,809 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportLogto = exportLogto;
+exports.normalizeEndpoint = normalizeEndpoint;
+exports.tenantOfEndpoint = tenantOfEndpoint;
+exports.managementResource = managementResource;
+exports.logtoRow = logtoRow;
+exports.tenantRows = tenantRows;
+exports.snapshotFromTables = snapshotFromTables;
+exports.logtoManagementHttp = logtoManagementHttp;
+exports.fetchLogtoSnapshot = fetchLogtoSnapshot;
+exports.parseLegacyExpression = parseLegacyExpression;
+exports.mapLogtoPassword = mapLogtoPassword;
+exports.mapLogtoUser = mapLogtoUser;
+exports.buildLogtoRecordSet = buildLogtoRecordSet;
+const tables_1 = require("./frameworks/tables");
+const record_set_1 = require("./record-set");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+/** Logto user columns the user record carries itself (the rest of `profile` lands in metadata). */
+const NAME_KEYS = new Set(['givenName', 'familyName']);
+/** The Management API's page size cap. */
+const PAGE = 100;
+/** TOTP as Logto runs it (otplib authenticator defaults). */
+const TOTP = { algorithm: 'SHA1', digits: 6, period: 30 };
+async function exportLogto(opts) {
+    const progress = opts.onProgress ?? (() => undefined);
+    const endpoint = opts.endpoint ? normalizeEndpoint(opts.endpoint) : undefined;
+    // A dump names its tenant (`default` when self-hosted); the API's is in a Cloud endpoint.
+    const tenantId = opts.tenantId ?? (!opts.tables && endpoint ? tenantOfEndpoint(endpoint) : null) ?? 'default';
+    let snap;
+    if (opts.tables) {
+        progress('database dump');
+        snap = snapshotFromTables(opts.tables, tenantId);
+        // The public signing keys, when the endpoint is known (never from the dump: logto_configs holds the PRIVATE keys).
+        if (endpoint)
+            snap.jwks = await readJwks(new vendor_http_1.VendorHttp({ vendor: 'Logto', baseUrl: endpoint, fetchImpl: opts.fetchImpl, sleep: opts.sleep, attempts: 2 })).catch(() => []);
+    }
+    else {
+        if (!endpoint)
+            throw new Error('Logto export needs a database dump (--set logto-dump=<dir>) or the Logto endpoint and a machine-to-machine app for the Management API.');
+        if (!opts.m2m)
+            throw new Error('The Logto Management API needs a machine-to-machine app id and secret (LOGTO_M2M_APP_ID / LOGTO_M2M_APP_SECRET).');
+        snap = await fetchLogtoSnapshot({ ...opts, endpoint, m2m: opts.m2m, tenantId, onProgress: progress });
+    }
+    return buildLogtoRecordSet(snap, { endpoint, tenantId, rpId: opts.rpId ?? (endpoint ? new URL(endpoint).hostname : undefined) });
+}
+/** `https://auth.example.com/` → `https://auth.example.com` (https only, no path). */
+function normalizeEndpoint(raw) {
+    const withScheme = /^https?:\/\//.test(raw.trim()) ? raw.trim() : `https://${raw.trim()}`;
+    const url = new URL(withScheme);
+    if (url.protocol !== 'https:' && url.hostname !== 'localhost')
+        throw new Error(`The Logto endpoint must be https: ${raw}`);
+    return `${url.protocol}//${url.host}`;
+}
+/** The Cloud tenant id of `https://abc123.logto.app`, or null for any other host. */
+function tenantOfEndpoint(endpoint) {
+    const m = /^https:\/\/([a-z0-9]+)\.logto\.app$/.exec(endpoint);
+    return m ? m[1] : null;
+}
+/** The Management API resource indicator of a tenant. */
+function managementResource(tenantId) {
+    return `https://${tenantId}.logto.app/api`;
+}
+// ── database dump ───────────────────────────────────────────────────────────
+/** JSONB columns (camelCase): a CSV dump carries them as JSON text. */
+const JSON_KEYS = new Set([
+    'profile',
+    'identities',
+    'customData',
+    'logtoConfig',
+    'mfaVerifications',
+    'config',
+    'domains',
+    'branding',
+    'color',
+    'metadata',
+    'detail',
+    'oidcClientMetadata',
+    'customClientMetadata',
+    'protectedAppMetadata',
+    'signIn',
+    'signUp',
+    'socialSignIn',
+    'socialSignInConnectorTargets',
+    'passwordPolicy',
+    'mfa',
+    'adaptiveMfa',
+    'trustedDevice',
+    'languageInfo',
+    'customContent',
+    'captchaPolicy',
+    'sentinelPolicy',
+    'emailBlocklistPolicy',
+    'verificationCodePolicy',
+    'forgotPasswordMethods',
+    'passkeySignIn',
+    'signUpProfileFields',
+    'passwordExpiration',
+    'usernamePolicy',
+]);
+/** A database row as the Management API would spell it: camelCase keys, JSONB parsed. */
+function logtoRow(row) {
+    const out = {};
+    for (const [k, v] of Object.entries(row)) {
+        const key = k.replace(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+        out[key] = JSON_KEYS.has(key) && typeof v === 'string' ? parseJson(v) : v;
+    }
+    return out;
+}
+function parseJson(v) {
+    const t = v.trim();
+    if (!t)
+        return undefined;
+    try {
+        return JSON.parse(t);
+    }
+    catch {
+        return v;
+    }
+}
+/** One table's rows of one tenant (a dump made with `where tenant_id = …` has every row already). */
+function tenantRows(tables, name, tenantId) {
+    return tables
+        .rows(name)
+        .filter((r) => {
+        const t = (0, tables_1.text)((0, tables_1.col)(r, 'tenant_id', 'tenantId'));
+        return t === undefined || t === tenantId;
+    })
+        .map(logtoRow);
+}
+function group(rows, key, value) {
+    const out = new Map();
+    for (const r of rows) {
+        const k = (0, record_set_1.str)(r[key]);
+        const v = (0, record_set_1.str)(r[value]);
+        if (!k || !v)
+            continue;
+        out.set(k, [...(out.get(k) ?? []), v]);
+    }
+    return out;
+}
+function snapshotFromTables(tables, tenantId) {
+    const t = (name) => tenantRows(tables, name, tenantId);
+    const roles = t('roles').filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
+    const roleIds = new Set(roles.map((r) => (0, record_set_1.str)(r.id)).filter((x) => !!x));
+    const scopeName = new Map(t('scopes').map((s) => [(0, record_set_1.str)(s.id) ?? '', (0, record_set_1.str)(s.name) ?? '']));
+    const orgScopeName = new Map(t('organization_scopes').map((s) => [(0, record_set_1.str)(s.id) ?? '', (0, record_set_1.str)(s.name) ?? '']));
+    const named = (ids, names) => (ids ?? []).map((id) => names.get(id)).filter((n) => !!n);
+    const rolePermissions = new Map();
+    for (const [roleId, scopeIds] of group(t('roles_scopes'), 'roleId', 'scopeId'))
+        rolePermissions.set(roleId, named(scopeIds, scopeName));
+    const userRoles = new Map();
+    for (const [userId, ids] of group(t('users_roles'), 'userId', 'roleId'))
+        userRoles.set(userId, ids.filter((id) => roleIds.has(id)));
+    const organizationRoles = t('organization_roles').filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
+    const orgScopes = group(t('organization_role_scope_relations'), 'organizationRoleId', 'organizationScopeId');
+    const orgResourceScopes = group(t('organization_role_resource_scope_relations'), 'organizationRoleId', 'scopeId');
+    const organizationRolePermissions = new Map();
+    for (const r of organizationRoles) {
+        const id = (0, record_set_1.str)(r.id);
+        if (id)
+            organizationRolePermissions.set(id, [...named(orgScopes.get(id), orgScopeName), ...named(orgResourceScopes.get(id), scopeName)]);
+    }
+    const memberRoles = new Map();
+    for (const r of t('organization_role_user_relations')) {
+        const k = `${(0, record_set_1.str)(r.organizationId)}:${(0, record_set_1.str)(r.userId)}`;
+        const role = (0, record_set_1.str)(r.organizationRoleId);
+        if (role)
+            memberRoles.set(k, [...(memberRoles.get(k) ?? []), role]);
+    }
+    const members = t('organization_user_relations')
+        .map((r) => ({ organizationId: (0, record_set_1.str)(r.organizationId) ?? '', userId: (0, record_set_1.str)(r.userId) ?? '' }))
+        .filter((m) => m.organizationId && m.userId)
+        .map((m) => ({ ...m, roleIds: memberRoles.get(`${m.organizationId}:${m.userId}`) ?? [] }));
+    const invitationRoles = group(t('organization_invitation_role_relations'), 'organizationInvitationId', 'organizationRoleId');
+    return {
+        source: 'database',
+        users: t('users'),
+        roles,
+        rolePermissions,
+        userRoles,
+        organizations: t('organizations'),
+        organizationRoles,
+        organizationRolePermissions,
+        members,
+        invitations: t('organization_invitations').map((row) => ({ row, roleIds: invitationRoles.get((0, record_set_1.str)(row.id) ?? '') ?? [] })),
+        organizationDomains: group(t('organization_jit_email_domains'), 'organizationId', 'emailDomain'),
+        ssoConnectors: t('sso_connectors'),
+        ssoIdentities: t('user_sso_identities'),
+        personalAccessTokens: t('personal_access_tokens'),
+        jwks: [],
+        hasFactors: true,
+    };
+}
+// ── Management API ──────────────────────────────────────────────────────────
+/** A Management API client: an M2M access token fetched (and refreshed) on this machine. */
+function logtoManagementHttp(o) {
+    const fetchImpl = o.fetchImpl ?? fetch;
+    const now = o.now ?? Date.now;
+    let cached = null;
+    const token = async () => {
+        if (cached && cached.until > now())
+            return cached.token;
+        const res = await fetchImpl(`${o.endpoint}/oidc/token`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+                authorization: `Basic ${Buffer.from(`${o.m2m.appId}:${o.m2m.appSecret}`).toString('base64')}`,
+            },
+            body: new URLSearchParams({ grant_type: 'client_credentials', resource: managementResource(o.tenantId), scope: 'all' }).toString(),
+        });
+        const body = (await res.json().catch(() => null));
+        const access = (0, record_set_1.str)(body?.access_token);
+        if (res.status !== 200 || !access) {
+            throw new vendor_http_1.VendorApiError('Logto', res.status, '/oidc/token', (0, record_set_1.str)(body?.error_description) ?? (0, record_set_1.str)(body?.error) ?? 'no access token (check the app id, secret and the Management API role)');
+        }
+        const ttl = typeof body?.expires_in === 'number' ? body.expires_in : 3600;
+        cached = { token: access, until: now() + Math.max(ttl - 60, 30) * 1000 };
+        return access;
+    };
+    return new vendor_http_1.VendorHttp({ vendor: 'Logto', baseUrl: o.endpoint, headers: async () => ({ authorization: `Bearer ${await token()}` }), fetchImpl: o.fetchImpl, sleep: o.sleep });
+}
+/** Every page of a paginated Management API listing (`page`, `page_size`). */
+async function pages(http, path) {
+    const out = [];
+    const sep = path.includes('?') ? '&' : '?';
+    for (let page = 1; page <= 100_000; page++) {
+        const { body } = await http.get(`${path}${sep}page=${page}&page_size=${PAGE}`);
+        const rows = (0, record_set_1.objs)(body);
+        out.push(...rows);
+        if (rows.length < PAGE)
+            break;
+    }
+    return out;
+}
+/** A listing an older Logto (or a narrower token) may not have: empty, with a warning. */
+async function optional(warnings, what, fn, empty) {
+    try {
+        return await fn();
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [401, 403, 404, 501].includes(err.status)) {
+            warnings.push(`${what} could not be read (${err.status}): skipped.`);
+            return empty;
+        }
+        throw err;
+    }
+}
+async function readJwks(http) {
+    const { body } = await http.get('/oidc/jwks');
+    return (0, record_set_1.objs)(body?.keys);
+}
+async function fetchLogtoSnapshot(o) {
+    const http = logtoManagementHttp({ endpoint: o.endpoint, m2m: o.m2m, tenantId: o.tenantId, fetchImpl: o.fetchImpl, sleep: o.sleep });
+    const warnings = o.warnings ?? [];
+    o.onProgress('users');
+    const users = await pages(http, '/api/users?includePasswordHash=true');
+    o.onProgress('roles');
+    const roles = (await pages(http, '/api/roles')).filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
+    const rolePermissions = new Map();
+    const userRoles = new Map();
+    for (const r of roles) {
+        const id = (0, record_set_1.str)(r.id);
+        if (!id)
+            continue;
+        const { body } = await http.get(`/api/roles/${encodeURIComponent(id)}/scopes`);
+        rolePermissions.set(id, (0, record_set_1.objs)(body).map((s) => (0, record_set_1.str)(s.name)).filter((s) => !!s));
+        for (const u of await pages(http, `/api/roles/${encodeURIComponent(id)}/users`)) {
+            const uid = (0, record_set_1.str)(u.id);
+            if (uid)
+                userRoles.set(uid, [...(userRoles.get(uid) ?? []), id]);
+        }
+    }
+    o.onProgress('organizations');
+    const organizations = await optional(warnings, 'Organizations', () => pages(http, '/api/organizations'), []);
+    const organizationRoles = (await optional(warnings, 'Organization roles', () => pages(http, '/api/organization-roles'), [])).filter((r) => (0, record_set_1.str)(r.type) !== 'MachineToMachine');
+    const organizationRolePermissions = new Map();
+    for (const r of organizationRoles) {
+        const id = (0, record_set_1.str)(r.id);
+        if (!id)
+            continue;
+        organizationRolePermissions.set(id, [...(0, record_set_1.objs)(r.scopes), ...(0, record_set_1.objs)(r.resourceScopes)].map((s) => (0, record_set_1.str)(s.name)).filter((s) => !!s));
+    }
+    const members = [];
+    const organizationDomains = new Map();
+    for (const org of organizations) {
+        const id = (0, record_set_1.str)(org.id);
+        if (!id)
+            continue;
+        for (const u of await pages(http, `/api/organizations/${encodeURIComponent(id)}/users`)) {
+            const uid = (0, record_set_1.str)(u.id);
+            if (uid)
+                members.push({ organizationId: id, userId: uid, roleIds: (0, record_set_1.objs)(u.organizationRoles).map((x) => (0, record_set_1.str)(x.id)).filter((x) => !!x) });
+        }
+        const domains = await optional(warnings, `JIT email domains of organization ${id}`, async () => (0, record_set_1.objs)((await http.get(`/api/organizations/${encodeURIComponent(id)}/jit/email-domains`)).body), []);
+        const list = domains.map((d) => (0, record_set_1.str)(d.emailDomain)).filter((d) => !!d);
+        if (list.length)
+            organizationDomains.set(id, list);
+    }
+    const invitations = (await optional(warnings, 'Organization invitations', async () => (0, record_set_1.objs)((await http.get('/api/organization-invitations')).body), [])).map((row) => ({
+        row,
+        roleIds: (0, record_set_1.objs)(row.organizationRoles).map((x) => (0, record_set_1.str)(x.id)).filter((x) => !!x),
+    }));
+    o.onProgress('enterprise SSO');
+    const ssoConnectors = await optional(warnings, 'SSO connectors', async () => (0, record_set_1.objs)((await http.get('/api/sso-connectors')).body), []);
+    const ssoIdentities = [];
+    if (ssoConnectors.length) {
+        // SSO identities only come with the single-user read.
+        for (const u of users) {
+            const uid = (0, record_set_1.str)(u.id);
+            if (!uid)
+                continue;
+            const { body } = await http.get(`/api/users/${encodeURIComponent(uid)}?includeSsoIdentities=true`);
+            for (const s of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.ssoIdentities : undefined))
+                ssoIdentities.push({ ...s, userId: (0, record_set_1.str)(s.userId) ?? uid });
+        }
+    }
+    const personalAccessTokens = [];
+    if (o.personalAccessTokens) {
+        o.onProgress('personal access tokens');
+        for (const u of users) {
+            const uid = (0, record_set_1.str)(u.id);
+            if (!uid)
+                continue;
+            const rows = await optional(warnings, 'Personal access tokens', async () => (0, record_set_1.objs)((await http.get(`/api/users/${encodeURIComponent(uid)}/personal-access-tokens`)).body), []);
+            for (const p of rows)
+                personalAccessTokens.push({ ...p, userId: (0, record_set_1.str)(p.userId) ?? uid });
+        }
+    }
+    o.onProgress('signing keys');
+    const jwks = await optional(warnings, 'The signing keys (/oidc/jwks)', () => readJwks(http), []);
+    return {
+        source: 'api',
+        users,
+        roles,
+        rolePermissions,
+        userRoles,
+        organizations,
+        organizationRoles,
+        organizationRolePermissions,
+        members,
+        invitations,
+        organizationDomains,
+        ssoConnectors,
+        ssoIdentities,
+        personalAccessTokens,
+        jwks,
+        hasFactors: false,
+        warnings: [...new Set(warnings)],
+    };
+}
+// ── passwords ───────────────────────────────────────────────────────────────
+const PLAIN_DIGESTS = new Set(['md5', 'sha1', 'sha256', 'sha512']);
+const PBKDF2_DIGESTS = new Set(['sha1', 'sha256', 'sha384', 'sha512']);
+const HEX = /^[0-9a-f]+$/i;
+/** A Logto `Legacy` expression `["algorithm", [args with "@"], "hash"]`, or null. */
+function parseLegacyExpression(value) {
+    let doc;
+    try {
+        doc = JSON.parse(value);
+    }
+    catch {
+        return null;
+    }
+    if (!Array.isArray(doc) || doc.length !== 3)
+        return null;
+    const [algorithm, args, hash] = doc;
+    if (typeof algorithm !== 'string' || typeof hash !== 'string' || !Array.isArray(args))
+        return null;
+    if (!args.every((a) => typeof a === 'string') || !args.includes('@'))
+        return null;
+    return { algorithm, args, hash };
+}
+/**
+ * A Logto password digest and its `password_encryption_method` → the bundle's
+ * password. Null when the user has none or Logto itself could not verify it.
+ */
+function mapLogtoPassword(digest, method) {
+    const d = typeof digest === 'string' ? digest.trim() : '';
+    if (!d)
+        return null;
+    switch ((0, record_set_1.str)(method)) {
+        case 'Argon2i':
+        case 'Argon2id':
+        case 'Argon2d':
+            return /^\$argon2(id|i|d)\$/.test(d) ? { algorithm: 'argon2', hash: d } : null;
+        case 'Bcrypt':
+            return { algorithm: 'bcrypt', hash: d };
+        // hash-wasm hex digests of the bare password.
+        case 'MD5':
+            return { algorithm: 'md5', hash: d, params: { encoding: 'hex' } };
+        case 'SHA1':
+            return { algorithm: 'sha1', hash: d, params: { encoding: 'hex' } };
+        case 'SHA256':
+            return { algorithm: 'sha256', hash: d, params: { encoding: 'hex' } };
+        case 'Legacy':
+            return mapLegacy(d);
+        default:
+            return null;
+    }
+}
+function mapLegacy(d) {
+    const e = parseLegacyExpression(d);
+    if (!e)
+        return null;
+    const { algorithm, args, hash } = e;
+    const at = args.indexOf('@');
+    // The plain shapes onto the registry's own verifiers.
+    if (PLAIN_DIGESTS.has(algorithm) && HEX.test(hash)) {
+        if (args.length === 1)
+            return { algorithm, hash, params: { encoding: 'hex' } };
+        const salt = args.length === 2 ? args[at === 0 ? 1 : 0] : '@';
+        if (salt !== '@')
+            return { algorithm: `${algorithm}_salted`, hash, salt, params: { salt_position: at === 0 ? 'suffix' : 'prefix', encoding: 'hex' } };
+    }
+    if ((algorithm === 'pbkdf2' || algorithm === 'pbkdf2Sync') && args.length === 5 && at === 4) {
+        const [salt, iterations, keylen, digest] = args;
+        const hexSalt = salt.startsWith('hex:') ? salt.slice(4) : undefined;
+        const ok = PBKDF2_DIGESTS.has(digest) && /^\d+$/.test(iterations) && /^\d+$/.test(keylen) && HEX.test(hash) && hash.length === Number(keylen) * 2 && (hexSalt === undefined || (HEX.test(hexSalt) && hexSalt.length % 2 === 0));
+        if (ok) {
+            return {
+                algorithm: 'pbkdf2',
+                hash,
+                salt: hexSalt ?? salt,
+                params: { digest, iterations: Number(iterations), key_length: Number(keylen), encoding: 'hex', salt_encoding: hexSalt === undefined ? 'utf8' : 'hex' },
+            };
+        }
+    }
+    if (algorithm === 'firebase-scrypt' && args.length === 6 && at === 5) {
+        const [salt, signerKey, separator, rounds, memCost] = args;
+        return { algorithm: 'scrypt_firebase', hash, salt, params: { signer_key: signerKey, salt_separator: separator, rounds: Number(rounds), mem_cost: Number(memCost) } };
+    }
+    // Everything else (several args around the password, other digests, PBKDF2
+    // variants, SHA-crypt) keeps the expression for the logto_legacy verifier.
+    return { algorithm: 'logto_legacy', hash: d };
+}
+// ── records ─────────────────────────────────────────────────────────────────
+/** A unique key per name within a scope (`Billing Admin` → `billing_admin`, then `billing_admin_x1y2`). */
+function keyer() {
+    const used = new Set();
+    return (name, id) => {
+        let key = (0, translate_kit_1.keyOf)(name);
+        if (used.has(key))
+            key = `${key}_${id.slice(-4).toLowerCase()}`;
+        used.add(key);
+        return key;
+    };
+}
+/** One Logto user → a user record (null when it has nothing to sign in with). */
+function mapLogtoUser(u, roles = []) {
+    const id = (0, record_set_1.str)(u.id);
+    if (!id)
+        return { user: null, passwordUnsupported: false };
+    const profile = (0, record_set_1.isObj)(u.profile) ? u.profile : {};
+    const primary = (0, record_set_1.str)(u.primaryEmail)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.primaryPhone);
+    const username = (0, record_set_1.str)(u.username);
+    // Logto keeps no verified flag: an address is only set once verified (or by an admin).
+    const emails = primary ? [{ email: primary, verified: true, primary: true }] : [];
+    if (!primary && !phone && !username) {
+        // A social-only account: the provider's address, unverified, so the user can be matched.
+        const social = Object.values((0, record_set_1.isObj)(u.identities) ? u.identities : {})
+            .map((i) => ((0, record_set_1.isObj)(i) && (0, record_set_1.isObj)(i.details) ? (0, record_set_1.str)(i.details.email)?.toLowerCase() : undefined))
+            .find((e) => e?.includes('@'));
+        if (social)
+            emails.push({ email: social, verified: false, primary: true });
+    }
+    const digest = u.passwordEncrypted ?? u.passwordDigest;
+    const method = u.passwordEncryptionMethod ?? u.passwordAlgorithm;
+    const password = mapLogtoPassword(digest, method);
+    const extraProfile = Object.fromEntries(Object.entries(profile).filter(([k, v]) => !NAME_KEYS.has(k) && v !== null && v !== undefined && v !== ''));
+    const suspended = (0, tables_1.bool)(u.isSuspended);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails,
+        phones: phone ? [{ phone, verified: true, primary: !primary }] : [],
+        username,
+        first_name: (0, record_set_1.str)(profile.givenName),
+        last_name: (0, record_set_1.str)(profile.familyName),
+        name: (0, record_set_1.str)(u.name),
+        image_url: (0, record_set_1.str)(u.avatar),
+        password: password ?? undefined,
+        roles,
+        banned: suspended ? true : undefined,
+        ban_reason: suspended ? 'Suspended in Logto' : undefined,
+        public_metadata: (0, record_set_1.bag)(u.customData),
+        private_metadata: (0, record_set_1.bag)({
+            ...(Object.keys(extraProfile).length ? { logto_profile: extraProfile } : {}),
+            ...((0, record_set_1.str)(u.applicationId) ? { logto_application_id: (0, record_set_1.str)(u.applicationId) } : {}),
+            ...((0, tables_1.bool)(u.isPasswordExpired) ? { logto_password_expired: true } : {}),
+        }),
+        created_at: (0, tables_1.time)(u.createdAt),
+        last_sign_in_at: (0, tables_1.time)(u.lastSignInAt),
+    });
+    const ok = !!(user.emails?.length || user.phones?.length || user.username);
+    return { user: ok ? user : null, passwordUnsupported: !password && typeof digest === 'string' && digest.trim() !== '' };
+}
+/** SAML providers vs OIDC ones (Logto's SsoProviderName). */
+const SAML_PROVIDERS = new Set(['SAML', 'AzureAD']);
+function mapSsoConnector(c, endpoint) {
+    const id = (0, record_set_1.str)(c.id);
+    const provider = (0, record_set_1.str)(c.providerName);
+    if (!id || !provider)
+        return null;
+    const config = (0, record_set_1.isObj)(c.config) ? c.config : {};
+    const domains = (0, record_set_1.strs)(c.domains);
+    const name = (0, record_set_1.str)(c.connectorName) ?? provider;
+    if (SAML_PROVIDERS.has(provider)) {
+        const mapping = (0, record_set_1.isObj)(config.attributeMapping) ? Object.fromEntries(Object.entries(config.attributeMapping).filter((e) => typeof e[1] === 'string')) : {};
+        return (0, record_set_1.compact)({
+            id,
+            name,
+            protocol: 'saml',
+            domains,
+            enabled: true,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(config.entityId),
+                idp_sso_url: (0, record_set_1.str)(config.signInEndpoint),
+                idp_certificate: (0, record_set_1.str)(config.x509Certificate),
+                idp_metadata_url: (0, record_set_1.str)(config.metadataUrl),
+                idp_metadata_xml: (0, record_set_1.str)(config.metadata),
+                // Logto's SP identifiers: the IdP must be updated when these change.
+                sp_entity_id: endpoint ? `${endpoint}/enterprise-sso/${id}` : undefined,
+                sp_acs_url: endpoint ? `${endpoint}/api/authn/single-sign-on/saml/${id}` : undefined,
+                attribute_mapping: Object.keys(mapping).length ? mapping : undefined,
+            }),
+        });
+    }
+    // OIDC, Okta, Azure AD (OIDC) and Google Workspace are OpenID Connect underneath.
+    const issuer = (0, record_set_1.str)(config.issuer) ?? (provider === 'GoogleWorkspace' ? 'https://accounts.google.com' : undefined);
+    return (0, record_set_1.compact)({
+        id,
+        name,
+        protocol: 'oidc',
+        domains,
+        enabled: true,
+        oidc: (0, record_set_1.compact)({
+            issuer,
+            client_id: (0, record_set_1.str)(config.clientId),
+            client_secret: (0, record_set_1.str)(config.clientSecret),
+            scopes: (0, record_set_1.str)(config.scope)?.split(/[ +]/).filter(Boolean),
+        }),
+    });
+}
+const INVITATION_STATUS = { Pending: 'pending', Accepted: 'accepted', Revoked: 'revoked', Expired: 'expired' };
+function buildLogtoRecordSet(snap, o) {
+    const set = new record_set_1.RecordSet();
+    for (const w of snap.warnings ?? [])
+        set.warn(w);
+    // ── roles ──
+    const appKey = keyer();
+    const appRoleKey = new Map();
+    const defaults = [];
+    for (const r of snap.roles) {
+        const id = (0, record_set_1.str)(r.id);
+        const name = (0, record_set_1.str)(r.name);
+        if (!id || !name)
+            continue;
+        const key = appKey(name, id);
+        appRoleKey.set(id, key);
+        if ((0, tables_1.bool)(r.isDefault))
+            defaults.push(name);
+        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'app', permissions: snap.rolePermissions.get(id) ?? [] }), `app:${key}`);
+    }
+    if (defaults.length) {
+        set.warn(`Logto gives every new user the default role(s) ${defaults.join(', ')}; Atlas does not assign roles at sign-up. Existing users keep them; give new users the role with an action or the Backend API.`);
+    }
+    const orgKey = keyer();
+    const orgRoleKey = new Map();
+    for (const r of snap.organizationRoles) {
+        const id = (0, record_set_1.str)(r.id);
+        const name = (0, record_set_1.str)(r.name);
+        if (!id || !name)
+            continue;
+        const key = orgKey(name, id);
+        orgRoleKey.set(id, key);
+        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'organization', permissions: snap.organizationRolePermissions.get(id) ?? [] }), `org:${key}`);
+    }
+    // ── organizations ──
+    const orgIds = new Set();
+    for (const org of snap.organizations) {
+        const id = (0, record_set_1.str)(org.id);
+        const name = (0, record_set_1.str)(org.name);
+        if (!id || !name)
+            continue;
+        orgIds.add(id);
+        const branding = (0, record_set_1.isObj)(org.branding) ? org.branding : {};
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            image_url: (0, record_set_1.str)(branding.logoUrl),
+            domains: snap.organizationDomains.get(id) ?? [],
+            public_metadata: (0, record_set_1.bag)({ ...((0, record_set_1.isObj)(org.customData) ? org.customData : {}), ...((0, record_set_1.str)(org.description) ? { description: (0, record_set_1.str)(org.description) } : {}) }),
+            private_metadata: (0, tables_1.bool)(org.isMfaRequired) ? { logto_mfa_required: true } : undefined,
+            created_at: (0, tables_1.time)(org.createdAt),
+        }));
+    }
+    if (snap.organizations.some((org) => (0, tables_1.bool)(org.isMfaRequired))) {
+        set.warn('Some organizations require MFA of their members in Logto (private_metadata.logto_mfa_required): set an organization MFA policy in Atlas.');
+    }
+    // ── enterprise SSO ──
+    const connectorProtocol = new Map();
+    const connectorName = new Map();
+    for (const c of snap.ssoConnectors) {
+        const record = mapSsoConnector(c, o.endpoint);
+        if (!record)
+            continue;
+        connectorProtocol.set(record.id, record.protocol);
+        connectorName.set(record.id, record.name ?? record.id);
+        set.add('sso_connection', record);
+    }
+    if (snap.ssoConnectors.some((c) => SAML_PROVIDERS.has((0, record_set_1.str)(c.providerName) ?? '')) && !o.endpoint) {
+        set.warn('The Logto endpoint was not given, so the SAML connections carry no SP entity id / ACS URL: pass --set logto-endpoint=<url> to record them.');
+    }
+    // ── users ──
+    const userIds = new Set();
+    const algorithms = {};
+    let unsupported = 0;
+    let hashless = 0;
+    for (const u of snap.users) {
+        const id = (0, record_set_1.str)(u.id);
+        const roles = (snap.userRoles.get(id ?? '') ?? []).map((r) => appRoleKey.get(r)).filter((k) => !!k);
+        const { user, passwordUnsupported } = mapLogtoUser(u, roles);
+        if (!user) {
+            set.omit('user', 'no email, phone number or username');
+            continue;
+        }
+        userIds.add(user.id);
+        set.add('user', user);
+        if (user.password)
+            algorithms[user.password.algorithm] = (algorithms[user.password.algorithm] ?? 0) + 1;
+        if (passwordUnsupported)
+            unsupported++;
+        if (!user.password && !passwordUnsupported && u.hasPassword === true)
+            hashless++;
+    }
+    if (unsupported)
+        set.warn(`${unsupported} user(s) have a password hash Logto itself cannot verify (unknown method or malformed Legacy expression): they reset their password, or move by lazy migration.`);
+    if (hashless) {
+        set.warn(`${hashless} user(s) have a password the Management API did not return (the Management API does not return hashes on every Logto version, or the token is read-only): turn on the logto lazy-migration preset, or export from the database.`);
+    }
+    if (snap.source === 'api' && userIds.size) {
+        set.warn('The Management API never returns MFA secrets (TOTP keys, WebAuthn credentials, backup codes): users with MFA enrol again in Atlas, or export from the database to keep them.');
+    }
+    // ── identities ──
+    for (const u of snap.users) {
+        const id = (0, record_set_1.str)(u.id);
+        if (!id || !userIds.has(id))
+            continue;
+        for (const [target, identity] of Object.entries((0, record_set_1.isObj)(u.identities) ? u.identities : {})) {
+            if (!(0, record_set_1.isObj)(identity))
+                continue;
+            const providerUserId = (0, record_set_1.str)(identity.userId);
+            if (!providerUserId)
+                continue;
+            const details = (0, record_set_1.isObj)(identity.details) ? identity.details : {};
+            set.add('identity', (0, record_set_1.compact)({ user_id: id, provider: target, provider_user_id: providerUserId, kind: 'oauth', email: (0, record_set_1.str)(details.email)?.toLowerCase(), profile: (0, record_set_1.bag)(details) }), `${target}:${providerUserId}`);
+        }
+    }
+    for (const s of snap.ssoIdentities) {
+        const userId = (0, record_set_1.str)(s.userId);
+        const connectorId = (0, record_set_1.str)(s.ssoConnectorId);
+        const identityId = (0, record_set_1.str)(s.identityId);
+        if (!userId || !userIds.has(userId) || !connectorId || !identityId)
+            continue;
+        if (!connectorProtocol.has(connectorId)) {
+            set.omit('identity', 'SSO identity of a connector the export does not carry');
+            continue;
+        }
+        const detail = (0, record_set_1.isObj)(s.detail) ? s.detail : {};
+        set.add('identity', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(s.id),
+            user_id: userId,
+            provider: connectorName.get(connectorId) ?? connectorId,
+            provider_user_id: identityId,
+            kind: connectorProtocol.get(connectorId),
+            sso_connection_id: connectorId,
+            email: (0, record_set_1.str)(detail.email)?.toLowerCase(),
+            profile: (0, record_set_1.bag)({ ...detail, ...((0, record_set_1.str)(s.issuer) ? { issuer: (0, record_set_1.str)(s.issuer) } : {}) }),
+        }), `sso:${connectorId}:${identityId}`);
+    }
+    // ── second factors and passkeys (database dumps) ──
+    if (snap.hasFactors) {
+        for (const u of snap.users) {
+            const userId = (0, record_set_1.str)(u.id);
+            if (!userId || !userIds.has(userId))
+                continue;
+            const factors = Array.isArray(u.mfaVerifications) ? (0, record_set_1.objs)(u.mfaVerifications) : [];
+            for (const f of factors)
+                addFactor(set, userId, f, o.rpId);
+        }
+    }
+    // ── memberships and invitations ──
+    let multiRole = 0;
+    let fallback = false;
+    for (const m of snap.members) {
+        if (!orgIds.has(m.organizationId) || !userIds.has(m.userId))
+            continue;
+        const keys = m.roleIds.map((r) => orgRoleKey.get(r)).filter((k) => !!k);
+        if (keys.length > 1)
+            multiRole++;
+        if (!keys.length)
+            fallback = true;
+        set.add('membership', { organization_id: m.organizationId, user_id: m.userId, role: keys[0] ?? 'member' }, `${m.organizationId}:${m.userId}`);
+    }
+    if (fallback && !set.list('role').some((r) => r.scope === 'organization' && r.key === 'member')) {
+        set.add('role', { key: 'member', name: 'Member', scope: 'organization' }, 'org:member');
+    }
+    if (multiRole) {
+        set.warn(`${multiRole} membership(s) hold several organization roles in Logto; Atlas keeps one role per membership (the first). Merge the permissions into one role where a member needs both.`);
+    }
+    for (const { row, roleIds } of snap.invitations) {
+        const id = (0, record_set_1.str)(row.id);
+        const email = (0, record_set_1.str)(row.invitee)?.toLowerCase();
+        const organizationId = (0, record_set_1.str)(row.organizationId);
+        if (!id || !email || !email.includes('@')) {
+            set.omit('invitation', 'the invitee is not an email address');
+            continue;
+        }
+        if (organizationId && !orgIds.has(organizationId))
+            continue;
+        set.add('invitation', (0, record_set_1.compact)({
+            id,
+            organization_id: organizationId,
+            email,
+            role: roleIds.map((r) => orgRoleKey.get(r)).find((k) => !!k),
+            status: INVITATION_STATUS[(0, record_set_1.str)(row.status) ?? ''],
+            inviter_user_id: (0, record_set_1.str)(row.inviterId),
+            expires_at: (0, tables_1.time)(row.expiresAt),
+            created_at: (0, tables_1.time)(row.createdAt),
+        }));
+    }
+    // ── personal access tokens ──
+    for (const p of snap.personalAccessTokens) {
+        const userId = (0, record_set_1.str)(p.userId);
+        const name = (0, record_set_1.str)(p.name);
+        const value = (0, record_set_1.str)(p.value);
+        if (!userId || !userIds.has(userId) || !name || !value)
+            continue;
+        set.add('api_key', (0, record_set_1.compact)({ id: `${userId}:${name}`, user_id: userId, name, hash: (0, tables_1.sha256Hex)(value), hash_algorithm: 'sha256', start: value.slice(0, 8), expires_at: (0, tables_1.time)(p.expiresAt), created_at: (0, tables_1.time)(p.createdAt) }));
+    }
+    // ── signing keys ──
+    for (const k of snap.jwks) {
+        const kid = (0, record_set_1.str)(k.kid);
+        if (kid)
+            set.add('jwks', { kid, jwk: k });
+    }
+    set.manifest = {
+        origin: o.endpoint ? new URL(o.endpoint).host : `Logto database (tenant ${o.tenantId})`,
+        ...(o.rpId ? { rpId: o.rpId } : {}),
+        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
+        settings: { tenant_id: o.tenantId, read_from: snap.source, password_algorithms: algorithms, totp: TOTP },
+    };
+    return set;
+}
+/** One `mfa_verifications` entry → a factor or a passkey. */
+function addFactor(set, userId, f, rpId) {
+    const type = (0, record_set_1.str)(f.type);
+    const created = (0, tables_1.time)(f.createdAt);
+    if (type === 'Totp') {
+        const secret = (0, record_set_1.str)(f.key)?.replace(/[\s=]/g, '').toUpperCase();
+        if (!secret || !/^[A-Z2-7]+$/.test(secret)) {
+            set.omit('mfa_factor', 'a TOTP key that is not base32');
+            return;
+        }
+        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'totp', secret_base32: secret, ...TOTP, verified: true, created_at: created }));
+    }
+    else if (type === 'BackupCode') {
+        const codes = (0, record_set_1.objs)(f.codes)
+            .filter((c) => !(0, record_set_1.str)(c.usedAt))
+            .map((c) => (0, record_set_1.str)(c.code))
+            .filter((c) => !!c);
+        if (!codes.length) {
+            set.omit('mfa_factor', 'every backup code already used');
+            return;
+        }
+        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, record_set_1.str)(f.id), user_id: userId, type: 'backup_codes', backup_codes: codes, verified: true, created_at: created }));
+    }
+    else if (type === 'WebAuthn') {
+        const credentialId = (0, tables_1.base64url)(f.credentialId);
+        const publicKey = (0, tables_1.base64url)(f.publicKey);
+        const rp = (0, record_set_1.str)(f.rpId) ?? rpId;
+        if (!credentialId || !publicKey) {
+            set.omit('passkey', 'a WebAuthn credential without its id or public key');
+            return;
+        }
+        if (!rp) {
+            set.omit('passkey', 'the relying-party id is unknown (pass --set logto-endpoint=<url> or --set rp-id=<host>)');
+            return;
+        }
+        set.add('passkey', (0, record_set_1.compact)({
+            id: (0, record_set_1.str)(f.id),
+            user_id: userId,
+            credential_id: credentialId,
+            public_key: publicKey,
+            sign_count: typeof f.counter === 'number' ? f.counter : undefined,
+            rp_id: rp,
+            transports: (0, record_set_1.strs)(f.transports),
+            name: (0, record_set_1.str)(f.name) ?? (0, record_set_1.str)(f.agent),
+            created_at: created,
+        }));
+    }
+    else {
+        set.omit('mfa_factor', `Logto factor type ${type ?? 'unknown'}`);
+    }
+}
+//# sourceMappingURL=logto.js.map