@atlasauth/cli 0.25.0 → 0.26.0

package/dist/migrate/export/record-set.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bag = exports.strs = exports.objs = exports.str = exports.isObj = exports.RecordSet = void 0;
+exports.e164 = e164;
+exports.compact = compact;
+const migrate_1 = require("@atlasauth/migrate");
+/**
+ * What a vendor exporter gathered, grouped by canonical model. A vendor API
+ * hands data back in ITS order (users carry their identities, organizations
+ * their members); the bundle needs canonical order, so exporters collect here
+ * and the writer replays {@link RecordSet.ordered}.
+ */
+class RecordSet {
+    rows = new Map();
+    seen = new Map();
+    warnings = [];
+    omitted = {};
+    /** Manifest fields the exporter learned (origin, providers, settings, rpId). */
+    manifest = {};
+    /**
+     * Add a row. With `key`, a second row with the same key is dropped (a member
+     * reached through two listings, a role seen on two organizations).
+     */
+    add(model, data, key) {
+        if (key !== undefined) {
+            const keys = this.seen.get(model) ?? new Set();
+            if (keys.has(key))
+                return;
+            keys.add(key);
+            this.seen.set(model, keys);
+        }
+        const list = this.rows.get(model) ?? [];
+        list.push(data);
+        this.rows.set(model, list);
+    }
+    warn(message) {
+        if (!this.warnings.includes(message))
+            this.warnings.push(message);
+    }
+    omit(model, reason, count = 1) {
+        const o = this.omitted[model] ?? { count: 0, reason };
+        o.count += count;
+        this.omitted[model] = o;
+    }
+    count(model) {
+        return this.rows.get(model)?.length ?? 0;
+    }
+    list(model) {
+        return (this.rows.get(model) ?? []);
+    }
+    /** Every row, in the order the bundle writer requires. */
+    *ordered() {
+        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
+            for (const data of this.rows.get(model) ?? [])
+                yield { model, data };
+        }
+    }
+    counts() {
+        const out = {};
+        for (const model of migrate_1.CANONICAL_MODEL_ORDER) {
+            const n = this.rows.get(model)?.length ?? 0;
+            if (n)
+                out[model] = n;
+        }
+        return out;
+    }
+}
+exports.RecordSet = RecordSet;
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+exports.isObj = isObj;
+const str = (v) => typeof v === 'string' && v.trim() ? v.trim() : typeof v === 'number' && Number.isFinite(v) ? String(v) : undefined;
+exports.str = str;
+const objs = (v) => (Array.isArray(v) ? v.filter(exports.isObj) : []);
+exports.objs = objs;
+const strs = (v) => Array.isArray(v) ? v.map((x) => (0, exports.str)(x)).filter((x) => x !== undefined) : [];
+exports.strs = strs;
+/** A metadata bag, only when it has keys. */
+const bag = (v) => ((0, exports.isObj)(v) && Object.keys(v).length > 0 ? v : undefined);
+exports.bag = bag;
+/** E.164 or nothing: vendors store numbers with spaces/dashes; anything else is dropped. */
+function e164(raw) {
+    const s = (0, exports.str)(raw);
+    if (!s)
+        return undefined;
+    const digits = s.replace(/[\s().-]/g, '');
+    const withPlus = digits.startsWith('+') ? digits : digits.startsWith('00') ? `+${digits.slice(2)}` : `+${digits}`;
+    return /^\+[1-9]\d{6,14}$/.test(withPlus) ? withPlus : undefined;
+}
+/** Drop undefined fields so a record carries only what the vendor had. */
+function compact(o) {
+    for (const k of Object.keys(o)) {
+        const v = o[k];
+        if (v === undefined || (Array.isArray(v) && v.length === 0))
+            delete o[k];
+    }
+    return o;
+}
+//# sourceMappingURL=record-set.js.map

package/dist/migrate/export/record-set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-set.js","sourceRoot":"","sources":["../../../src/migrate/export/record-set.ts"],"names":[],"mappings":";;;AAoFA,oBAMC;AAED,0BAMC;AAlGD,gDAK4B;AAE5B;;;;;GAKG;AACH,MAAa,SAAS;IACH,IAAI,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC5C,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,QAAQ,GAAa,EAAE,CAAC;IACxB,OAAO,GAAsD,EAAE,CAAC;IACzE,gFAAgF;IAChF,QAAQ,GAAqG,EAAE,CAAC;IAEhH;;;OAGG;IACH,GAAG,CAA2B,KAAQ,EAAE,IAA4B,EAAE,GAAY;QAChF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YACvD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO;YAC1B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,KAAK,GAAG,CAAC;QAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACtD,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAqB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,CAA2B,KAAQ;QACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAkC,CAAC;IACvE,CAAC;IAED,0DAA0D;IAC1D,CAAC,OAAO;QACN,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;gBAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,+BAAqB,EAAE,CAAC;YAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC;gBAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAzDD,8BAyDC;AAKM,MAAM,KAAK,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAA3F,QAAA,KAAK,SAAsF;AACjG,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CACpD,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AADxG,QAAA,GAAG,OACqG;AAC9G,MAAM,IAAI,GAAG,CAAC,CAAU,EAAS,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAAxE,QAAA,IAAI,QAAoE;AAC9E,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,WAAG,EAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAD9E,QAAA,IAAI,QAC0E;AAC3F,6CAA6C;AACtC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAmB,EAAE,CAAC,CAAC,IAAA,aAAK,EAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAA/F,QAAA,GAAG,OAA4F;AAC5G,4FAA4F;AAC5F,SAAgB,IAAI,CAAC,GAAY;IAC/B,MAAM,CAAC,GAAG,IAAA,WAAG,EAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAClH,OAAO,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AACD,0EAA0E;AAC1E,SAAgB,OAAO,CAAmB,CAAI;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAmB,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/migrate/export/source-lines.d.ts

@@ -0,0 +1,17 @@
+import type { ReportStatus } from '../framework/plugin';
+import type { ConfigBuilder } from './translate-kit';
+/**
+ * Report lines that point at a config FILE the owner keeps (appwrite.json,
+ * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
+ * report reads `nhost/nhost.toml:42` instead of a bare setting path.
+ */
+/**
+ * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
+ * in a JSON text, found by walking the quoted keys in order. Undefined when a
+ * key is missing (the report then names only the setting path).
+ */
+export declare function jsonKeyLine(text: string, path: string[]): number | undefined;
+/** The 1-based line of a character offset. */
+export declare function lineAt(text: string, offset: number): number;
+/** Add a report line with a file location (when the line is known). */
+export declare function addAt(b: ConfigBuilder, file: string | undefined, line: number | undefined, status: ReportStatus, area: string, setting: string, note: string, atlas?: string): void;

package/dist/migrate/export/source-lines.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jsonKeyLine = jsonKeyLine;
+exports.lineAt = lineAt;
+exports.addAt = addAt;
+/**
+ * Report lines that point at a config FILE the owner keeps (appwrite.json,
+ * nhost.toml, pb_schema.json): the 1-based line a setting sits on, so the
+ * report reads `nhost/nhost.toml:42` instead of a bare setting path.
+ */
+/**
+ * The line of a JSON key path (`["settings", "auth", "security", "duration"]`)
+ * in a JSON text, found by walking the quoted keys in order. Undefined when a
+ * key is missing (the report then names only the setting path).
+ */
+function jsonKeyLine(text, path) {
+    let at = 0;
+    for (const key of path) {
+        const i = text.indexOf(`"${key}"`, at);
+        if (i < 0)
+            return undefined;
+        at = i + key.length + 2;
+    }
+    return lineAt(text, at);
+}
+/** The 1-based line of a character offset. */
+function lineAt(text, offset) {
+    let line = 1;
+    for (let i = 0; i < offset && i < text.length; i++)
+        if (text.charCodeAt(i) === 10)
+            line++;
+    return line;
+}
+/** Add a report line with a file location (when the line is known). */
+function addAt(b, file, line, status, area, setting, note, atlas) {
+    b.add(status, area, setting, note, atlas);
+    if (file && line) {
+        const entry = b.report[b.report.length - 1];
+        entry.file = file;
+        entry.line = line;
+    }
+}
+//# sourceMappingURL=source-lines.js.map

package/dist/migrate/export/source-lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-lines.js","sourceRoot":"","sources":["../../../src/migrate/export/source-lines.ts"],"names":[],"mappings":";;AAcA,kCAQC;AAGD,wBAIC;AAGD,sBAOC;AApCD;;;;GAIG;AAEH;;;;GAIG;AACH,SAAgB,WAAW,CAAC,IAAY,EAAE,IAAc;IACtD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5B,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1B,CAAC;AAED,8CAA8C;AAC9C,SAAgB,MAAM,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,CAAC;IAC1F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,SAAgB,KAAK,CAAC,CAAgB,EAAE,IAAwB,EAAE,IAAwB,EAAE,MAAoB,EAAE,IAAY,EAAE,OAAe,EAAE,IAAY,EAAE,KAAc;IAC3K,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QAClB,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/migrate/export/sso-metadata.d.ts

@@ -0,0 +1,47 @@
+import type { SsoConnectionRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+export interface SamlIdp {
+    entityId: string;
+    ssoUrl?: string;
+    ssoBinding?: string;
+    certificates: string[];
+    nameIdFormat?: string;
+    wantAuthnRequestsSigned?: boolean;
+}
+/** Every identity provider in a metadata document. Throws on a document with none. */
+export declare function parseSamlMetadata(xml: string): SamlIdp[];
+export interface SsoConnectionOptions {
+    name?: string;
+    domains?: string[];
+    organizationId?: string;
+    metadataUrl?: string;
+    id?: string;
+}
+export declare function samlConnections(xml: string, o?: SsoConnectionOptions): {
+    connections: SsoConnectionRecord[];
+    warnings: string[];
+};
+export interface OidcDiscovery {
+    issuer: string;
+    authorization_endpoint?: string;
+    token_endpoint?: string;
+    userinfo_endpoint?: string;
+    jwks_uri?: string;
+    scopes_supported: string[];
+    grant_types_supported: string[];
+    id_token_signing_alg_values_supported: string[];
+}
+/** The discovery URL for an issuer or a discovery URL. */
+export declare function discoveryUrl(input: string): string;
+export declare function parseDiscovery(doc: unknown, requested: string): OidcDiscovery;
+export declare function fetchDiscovery(fetchImpl: typeof fetch, input: string): Promise<OidcDiscovery>;
+export declare function oidcConnection(d: OidcDiscovery, o?: SsoConnectionOptions & {
+    clientId?: string;
+    clientSecret?: string;
+}): SsoConnectionRecord;
+/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
+export declare function connectionSet(connections: SsoConnectionRecord[], origin: string, organization?: {
+    id: string;
+    name: string;
+}): RecordSet;
+export type { Obj };

package/dist/migrate/export/sso-metadata.js

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSamlMetadata = parseSamlMetadata;
+exports.samlConnections = samlConnections;
+exports.discoveryUrl = discoveryUrl;
+exports.parseDiscovery = parseDiscovery;
+exports.fetchDiscovery = fetchDiscovery;
+exports.oidcConnection = oidcConnection;
+exports.connectionSet = connectionSet;
+const record_set_1 = require("./record-set");
+/**
+ * The SSO connections any identity provider hands over as standard documents:
+ * SAML 2.0 IdP metadata (an EntityDescriptor, or an EntitiesDescriptor
+ * federation) and an OpenID Connect discovery document. Used by the `saml` and
+ * `oidc` routes, and by every vendor whose enterprise connections are
+ * described by one of the two.
+ */
+// ── SAML metadata ───────────────────────────────────────────────────────────
+const attr = (tag, name) => {
+    const m = new RegExp(`\\b${name}\\s*=\\s*("([^"]*)"|'([^']*)')`).exec(tag);
+    const v = m ? (m[2] ?? m[3]) : undefined;
+    return v === undefined ? undefined : decodeXml(v);
+};
+function decodeXml(s) {
+    return s.replace(/&(lt|gt|amp|quot|apos|#x[0-9a-f]+|#\d+);/gi, (_, e) => {
+        const l = e.toLowerCase();
+        if (l === 'lt')
+            return '<';
+        if (l === 'gt')
+            return '>';
+        if (l === 'amp')
+            return '&';
+        if (l === 'quot')
+            return '"';
+        if (l === 'apos')
+            return "'";
+        return String.fromCodePoint(l.startsWith('#x') ? parseInt(l.slice(2), 16) : parseInt(l.slice(1), 10));
+    });
+}
+/** Elements by local name, ignoring any namespace prefix (`md:`, `ds:`, none). */
+function elements(xml, local) {
+    const out = [];
+    const re = new RegExp(`<(?:[A-Za-z0-9_-]+:)?${local}\\b([^>]*?)(/>|>([\\s\\S]*?)</(?:[A-Za-z0-9_-]+:)?${local}\\s*>)`, 'g');
+    for (let m = re.exec(xml); m; m = re.exec(xml))
+        out.push({ tag: m[1], body: m[3] ?? '' });
+    return out;
+}
+/** Every identity provider in a metadata document. Throws on a document with none. */
+function parseSamlMetadata(xml) {
+    if (/<!DOCTYPE|<!ENTITY/i.test(xml))
+        throw new Error('The metadata contains a DOCTYPE / ENTITY declaration, which is refused.');
+    const idps = [];
+    const scoped = elements(xml, 'EntityDescriptor');
+    // An EntityDescriptor nested in an EntitiesDescriptor is matched by the regex too; a lone one matches once.
+    for (const ed of scoped) {
+        const idp = elements(ed.body, 'IDPSSODescriptor')[0];
+        const entityId = attr(`${ed.tag}`, 'entityID');
+        if (!idp || !entityId)
+            continue;
+        const services = elements(idp.body, 'SingleSignOnService').map((s) => ({ binding: attr(s.tag, 'Binding') ?? '', location: attr(s.tag, 'Location') }));
+        const pick = services.find((s) => s.binding.endsWith('HTTP-Redirect') && s.location) ?? services.find((s) => s.binding.endsWith('HTTP-POST') && s.location) ?? services.find((s) => s.location);
+        const certs = [];
+        for (const k of elements(idp.body, 'KeyDescriptor')) {
+            if (attr(k.tag, 'use') === 'encryption')
+                continue;
+            for (const c of elements(k.body, 'X509Certificate')) {
+                const b64 = c.body.replace(/\s+/g, '');
+                if (/^[A-Za-z0-9+/=]+$/.test(b64) && !certs.includes(b64))
+                    certs.push(b64);
+            }
+        }
+        idps.push((0, record_set_1.compact)({
+            entityId,
+            ssoUrl: pick?.location,
+            ssoBinding: pick?.binding,
+            certificates: certs,
+            nameIdFormat: elements(idp.body, 'NameIDFormat')[0]?.body.trim() || undefined,
+            wantAuthnRequestsSigned: attr(idp.tag, 'WantAuthnRequestsSigned') === 'true' ? true : undefined,
+        }));
+    }
+    if (!idps.length)
+        throw new Error('No identity provider (IDPSSODescriptor) found in the SAML metadata.');
+    return idps;
+}
+const pem = (b64) => `-----BEGIN CERTIFICATE-----\n${b64.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----\n`;
+function samlConnections(xml, o = {}) {
+    const idps = parseSamlMetadata(xml);
+    const warnings = [];
+    const connections = idps.map((idp, i) => {
+        // compact() drops an empty certificate list.
+        const certificates = idp.certificates ?? [];
+        if (!idp.ssoUrl)
+            warnings.push(`${idp.entityId}: no SingleSignOnService in the metadata.`);
+        if (!certificates.length)
+            warnings.push(`${idp.entityId}: no signing certificate in the metadata; Atlas cannot verify its assertions.`);
+        if (certificates.length > 1)
+            warnings.push(`${idp.entityId}: ${certificates.length} signing certificates; the first is imported, add the others in the dashboard when the IdP rolls its key.`);
+        return (0, record_set_1.compact)({
+            id: o.id ?? (idps.length > 1 ? `${slug(idp.entityId)}-${i + 1}` : slug(idp.entityId)),
+            name: o.name ?? hostName(idp.entityId),
+            organization_id: o.organizationId,
+            protocol: 'saml',
+            domains: o.domains,
+            enabled: true,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: idp.entityId,
+                idp_sso_url: idp.ssoUrl,
+                idp_certificate: certificates[0] ? pem(certificates[0]) : undefined,
+                idp_metadata_url: o.metadataUrl,
+                idp_metadata_xml: idps.length === 1 ? xml : undefined,
+            }),
+        });
+    });
+    return { connections, warnings };
+}
+const slug = (s) => s.replace(/^https?:\/\//, '').replace(/[^A-Za-z0-9]+/g, '-').replace(/^-+|-+$/g, '').toLowerCase().slice(0, 64) || 'saml';
+const hostName = (entityId) => {
+    try {
+        return new URL(entityId).host;
+    }
+    catch {
+        return entityId.slice(0, 64);
+    }
+};
+/** The discovery URL for an issuer or a discovery URL. */
+function discoveryUrl(input) {
+    const u = input.trim().replace(/\/+$/, '');
+    if (!/^https:\/\//i.test(u))
+        throw new Error('The OpenID Connect issuer must be an https:// URL.');
+    return u.endsWith('/.well-known/openid-configuration') ? u : `${u}/.well-known/openid-configuration`;
+}
+function parseDiscovery(doc, requested) {
+    if (!(0, record_set_1.isObj)(doc) || !(0, record_set_1.str)(doc.issuer))
+        throw new Error('The discovery document has no issuer.');
+    const issuer = (0, record_set_1.str)(doc.issuer);
+    const want = requested.replace(/\/\.well-known\/openid-configuration$/, '').replace(/\/+$/, '');
+    // RFC 8414 §3.3: the issuer in the document must equal the one it was fetched for.
+    if (issuer.replace(/\/+$/, '') !== want)
+        throw new Error(`The discovery document names issuer ${issuer}, not ${want}.`);
+    return {
+        issuer,
+        authorization_endpoint: (0, record_set_1.str)(doc.authorization_endpoint),
+        token_endpoint: (0, record_set_1.str)(doc.token_endpoint),
+        userinfo_endpoint: (0, record_set_1.str)(doc.userinfo_endpoint),
+        jwks_uri: (0, record_set_1.str)(doc.jwks_uri),
+        scopes_supported: (0, record_set_1.strs)(doc.scopes_supported),
+        grant_types_supported: (0, record_set_1.strs)(doc.grant_types_supported),
+        id_token_signing_alg_values_supported: (0, record_set_1.strs)(doc.id_token_signing_alg_values_supported),
+    };
+}
+async function fetchDiscovery(fetchImpl, input) {
+    const url = discoveryUrl(input);
+    const res = await fetchImpl(url, { headers: { accept: 'application/json' }, redirect: 'error' });
+    if (res.status !== 200)
+        throw new Error(`${url} answered ${res.status}.`);
+    return parseDiscovery(await res.json().catch(() => null), input.trim().replace(/\/\.well-known\/openid-configuration$/, ''));
+}
+function oidcConnection(d, o = {}) {
+    const scopes = ['openid', 'email', 'profile'].filter((s) => d.scopes_supported.length === 0 || d.scopes_supported.includes(s));
+    return (0, record_set_1.compact)({
+        id: o.id ?? slug(d.issuer),
+        name: o.name ?? hostName(d.issuer),
+        organization_id: o.organizationId,
+        protocol: 'oidc',
+        domains: o.domains,
+        enabled: true,
+        oidc: (0, record_set_1.compact)({ issuer: d.issuer, discovery_url: discoveryUrl(d.issuer), client_id: o.clientId, client_secret: o.clientSecret, scopes }),
+    });
+}
+/** The records an SSO-only route writes: the connection, and an organization when it belongs to one. */
+function connectionSet(connections, origin, organization) {
+    const set = new record_set_1.RecordSet();
+    set.manifest = { origin };
+    if (organization)
+        set.add('organization', { id: organization.id, name: organization.name, slug: slug(organization.name) }, organization.id);
+    for (const c of connections)
+        set.add('sso_connection', organization ? { ...c, organization_id: organization.id } : c, c.id);
+    return set;
+}
+//# sourceMappingURL=sso-metadata.js.map

package/dist/migrate/export/sso-metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-metadata.js","sourceRoot":"","sources":["../../../src/migrate/export/sso-metadata.ts"],"names":[],"mappings":";;AAiDA,8CA8BC;AAYD,0CA0BC;AAyBD,oCAIC;AAED,wCAgBC;AAED,wCAKC;AAED,wCAWC;AAGD,sCAMC;AAhMD,6CAA8E;AAE9E;;;;;;GAMG;AAEH,+EAA+E;AAE/E,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAsB,EAAE;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,gCAAgC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,4CAA4C,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE;QAC9E,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,GAAG,CAAC;QAC5B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,CAAC;QAC7B,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAa;IAC1C,MAAM,GAAG,GAAyC,EAAE,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,wBAAwB,KAAK,qDAAqD,KAAK,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5H,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC3F,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAChI,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACjD,4GAA4G;IAC5G,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ;YAAE,SAAS;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtJ,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAChM,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,YAAY;gBAAE,SAAS;YAClD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBACpD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBACvC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAA,oBAAO,EAAC;YAChB,QAAQ;YACR,MAAM,EAAE,IAAI,EAAE,QAAQ;YACtB,UAAU,EAAE,IAAI,EAAE,OAAO;YACzB,YAAY,EAAE,KAAK;YACnB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,SAAS;YAC7E,uBAAuB,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SACrF,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzG,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,gCAAgC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B,CAAC;AAU9H,SAAgB,eAAe,CAAC,GAAW,EAAE,IAA0B,EAAE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAuB,EAAE;QAC3D,6CAA6C;QAC7C,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,2CAA2C,CAAC,CAAC;QAC3F,IAAI,CAAC,YAAY,CAAC,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,+EAA+E,CAAC,CAAC;QACxI,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,MAAM,2GAA2G,CAAC,CAAC;QAC/L,OAAO,IAAA,oBAAO,EAAC;YACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrF,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;YACtC,eAAe,EAAE,CAAC,CAAC,cAAc;YACjC,QAAQ,EAAE,MAAe;YACzB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAA,oBAAO,EAAC;gBACZ,aAAa,EAAE,GAAG,CAAC,QAAQ;gBAC3B,WAAW,EAAE,GAAG,CAAC,MAAM;gBACvB,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnE,gBAAgB,EAAE,CAAC,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC;SACoB,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC;AACtJ,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAE,EAAE;IACpC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC;AAeF,0DAA0D;AAC1D,SAAgB,YAAY,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC;AACvG,CAAC;AAED,SAAgB,cAAc,CAAC,GAAY,EAAE,SAAiB;IAC5D,IAAI,CAAC,IAAA,kBAAK,EAAC,GAAG,CAAC,IAAI,CAAC,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC9F,MAAM,MAAM,GAAG,IAAA,gBAAG,EAAC,GAAG,CAAC,MAAM,CAAE,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,mFAAmF;IACnF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,SAAS,IAAI,GAAG,CAAC,CAAC;IACxH,OAAO;QACL,MAAM;QACN,sBAAsB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,sBAAsB,CAAC;QACvD,cAAc,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,cAAc,CAAC;QACvC,iBAAiB,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,QAAQ,EAAE,IAAA,gBAAG,EAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,gBAAgB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC;QAC5C,qBAAqB,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qBAAqB,CAAC;QACtD,qCAAqC,EAAE,IAAA,iBAAI,EAAC,GAAG,CAAC,qCAAqC,CAAC;KACvF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,SAAuB,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IACjG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/H,CAAC;AAED,SAAgB,cAAc,CAAC,CAAgB,EAAE,IAAyE,EAAE;IAC1H,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/H,OAAO,IAAA,oBAAO,EAAC;QACb,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAClC,eAAe,EAAE,CAAC,CAAC,cAAc;QACjC,QAAQ,EAAE,MAAe;QACzB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,OAAO,EAAE,IAAI;QACb,IAAI,EAAE,IAAA,oBAAO,EAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;KAClH,CAAC,CAAC;AAC5B,CAAC;AAED,wGAAwG;AACxG,SAAgB,aAAa,CAAC,WAAkC,EAAE,MAAc,EAAE,YAA2C;IAC3H,MAAM,GAAG,GAAG,IAAI,sBAAS,EAAE,CAAC;IAC5B,GAAG,CAAC,QAAQ,GAAG,EAAE,MAAM,EAAE,CAAC;IAC1B,IAAI,YAAY;QAAE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5I,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/migrate/export/stytch-config.d.ts

@@ -0,0 +1,22 @@
+import type { TranslationResult } from '../framework/plugin';
+import { type Obj } from './record-set';
+import { type StytchProduct } from './stytch';
+import { type VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate stytch config` — what Stytch's project API exposes: the RBAC
+ * policy (roles, resources and their actions) and, for B2B, the organizations
+ * with their SSO connections. Password strength, session duration, OAuth
+ * providers, MFA and branding are dashboard-only settings: the report lists
+ * each as manual, with where to find it. The bridge and lazy-migration presets
+ * are carried to the next step.
+ */
+export interface StytchConfigSnapshot {
+    projectId: string;
+    product: StytchProduct;
+    roles: Obj[];
+    resources: Obj[];
+    organizations: number;
+    ssoConnections: number;
+}
+export declare function fetchStytchConfig(http: VendorHttp, projectId: string, product: StytchProduct): Promise<StytchConfigSnapshot>;
+export declare function translateStytchConfig(snap: StytchConfigSnapshot): TranslationResult;

package/dist/migrate/export/stytch-config.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchStytchConfig = fetchStytchConfig;
+exports.translateStytchConfig = translateStytchConfig;
+const record_set_1 = require("./record-set");
+const stytch_1 = require("./stytch");
+const translate_kit_1 = require("./translate-kit");
+const vendor_http_1 = require("./vendor-http");
+async function optionalGet(http, path) {
+    try {
+        const body = (await http.get(path)).body;
+        return (0, record_set_1.isObj)(body) ? body : null;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && [400, 403, 404].includes(err.status))
+            return null;
+        throw err;
+    }
+}
+async function fetchStytchConfig(http, projectId, product) {
+    // The consumer policy endpoint is UNCONFIRMED; a project without it just reports no roles.
+    const res = await optionalGet(http, product === 'b2b' ? '/v1/b2b/rbac/policy' : '/v1/rbac/policy');
+    const policy = res && (0, record_set_1.isObj)(res.policy) ? res.policy : {};
+    let organizations = 0;
+    let ssoConnections = 0;
+    if (product === 'b2b') {
+        try {
+            const { body } = await http.post('/v1/b2b/organizations/search', { limit: 1000 });
+            const orgs = (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.organizations : undefined);
+            organizations = orgs.length;
+            for (const o of orgs) {
+                const id = (0, record_set_1.str)(o.organization_id);
+                const sso = id ? await optionalGet(http, `/v1/b2b/sso/${encodeURIComponent(id)}`) : null;
+                if (sso)
+                    ssoConnections += (0, record_set_1.objs)(sso.saml_connections).length + (0, record_set_1.objs)(sso.oidc_connections).length;
+            }
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError))
+                throw err;
+        }
+    }
+    return { projectId, product, roles: (0, record_set_1.objs)(policy.roles), resources: (0, record_set_1.objs)(policy.resources), organizations, ssoConnections };
+}
+function translateStytchConfig(snap) {
+    const b = new translate_kit_1.ConfigBuilder();
+    const permissions = new Set();
+    for (const r of snap.resources) {
+        const resource = (0, record_set_1.str)(r.resource_id);
+        if (resource)
+            for (const a of (0, record_set_1.strs)(r.actions))
+                permissions.add(`${resource}:${a}`);
+    }
+    let roles = 0;
+    for (const r of snap.roles) {
+        const id = (0, record_set_1.str)(r.role_id);
+        if (!id)
+            continue;
+        const key = (0, stytch_1.stytchRoleKey)(id);
+        const perms = (0, record_set_1.objs)(r.permissions).flatMap((p) => (0, record_set_1.strs)(p.actions).map((a) => `${(0, record_set_1.str)(p.resource_id) ?? '*'}:${a}`));
+        for (const p of perms)
+            if (!p.startsWith('*:'))
+                permissions.add(p);
+        // Built-in roles already exist in Atlas as admin and member.
+        if (key !== id)
+            continue;
+        roles++;
+        b.roles[id] = key;
+        b.push('roles', { key, name: key, description: (0, record_set_1.str)(r.description) ?? '', permissions: perms });
+    }
+    for (const key of permissions)
+        b.push('permissions', { key, name: key, description: '' });
+    if (permissions.size)
+        b.add('mapped', 'authorization', 'RBAC resources and actions', `${permissions.size} permission(s), keyed resource:action.`, 'permissions');
+    if (roles)
+        b.add('mapped', 'authorization', 'custom roles', `${roles} role(s); members keep the same role id as their Atlas role key. stytch_admin and stytch_member map to Atlas's admin and member.`, 'roles');
+    if (snap.roles.length === 0)
+        b.add('manual', 'authorization', 'RBAC policy', 'No RBAC policy was returned; default roles carry over as admin and member.');
+    if (snap.ssoConnections)
+        b.add('mapped', 'enterprise', `${snap.ssoConnections} SSO connection(s) in ${snap.organizations} organization(s)`, 'Move with the data export as Atlas SSO connections.', 'sso_connections');
+    if (snap.product === 'b2b')
+        b.add('manual', 'organizations', 'organization MFA policy, allowed auth methods, JIT provisioning', 'Per-organization settings are kept in the exported organization metadata; set the matching policy on each Atlas organization.');
+    for (const [setting, where] of [
+        ['password strength (zxcvbn / LUDS) and breach check', 'Dashboard → Authentication → Passwords; set Atlas password rules under auth_config.password'],
+        ['session duration and JWT lifetime', 'Dashboard → Sessions; set the Atlas session lifetime'],
+        ['OAuth providers (client ids and secrets)', 'Dashboard → OAuth; use the same OAuth apps in Atlas so imported accounts relink'],
+        ['redirect URLs and authorized domains', 'Dashboard → Redirect URLs, SDK configuration'],
+        ['multi-factor authentication (TOTP, SMS)', 'Dashboard → Authentication → MFA'],
+        ['email templates, SMS and branding', 'Dashboard → Email templates, Branding'],
+        ['custom claims and JWT templates', 'Dashboard → Sessions → JWT templates'],
+        ['webhooks', 'Dashboard → Webhooks (create Atlas webhook endpoints)'],
+    ]) {
+        b.add('manual', 'settings not in the API', setting, `Stytch does not expose this through the project API; copy it from ${where}.`);
+    }
+    const test = snap.projectId.startsWith('project-test-');
+    const vars = { project_id: snap.projectId, ...(test ? { api_host: 'test.stytch.com' } : {}), ...(snap.product === 'b2b' ? { jwks_path: 'b2b/sessions' } : {}) };
+    return b.result(`Stytch project ${snap.projectId}`, {
+        bridge: { preset: 'stytch', vars },
+        lazy: { preset: 'stytch', config: { project_id: snap.projectId, product: snap.product } },
+    });
+}
+//# sourceMappingURL=stytch-config.js.map

package/dist/migrate/export/stytch-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stytch-config.js","sourceRoot":"","sources":["../../../src/migrate/export/stytch-config.ts"],"names":[],"mappings":";;AAkCA,8CAqBC;AAED,sDAgDC;AAvGD,6CAAgE;AAChE,qCAA6D;AAC7D,mDAAgD;AAChD,+CAAgE;AAmBhE,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9C,OAAO,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,4BAAc,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,IAAgB,EAAE,SAAiB,EAAE,OAAsB;IACjG,2FAA2F;IAC3F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACnG,MAAM,MAAM,GAAQ,GAAG,IAAI,IAAA,kBAAK,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAM,8BAA8B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,IAAA,iBAAI,EAAC,IAAA,kBAAK,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,eAAe,CAAC,CAAC;gBAClC,MAAM,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzF,IAAI,GAAG;oBAAE,cAAc,IAAI,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,IAAA,iBAAI,EAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC;YACnG,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,4BAAc,CAAC;gBAAE,MAAM,GAAG,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAA,iBAAI,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC;AAC7H,CAAC;AAED,SAAgB,qBAAqB,CAAC,IAA0B;IAC9D,MAAM,CAAC,GAAG,IAAI,6BAAa,EAAE,CAAC;IAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,IAAI,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,GAAG,GAAG,IAAA,sBAAa,EAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,iBAAI,EAAC,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,iBAAI,EAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAClH,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,6DAA6D;QAC7D,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,KAAK,EAAE,CAAC;QACR,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,IAAA,gBAAG,EAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAU,CAAC,CAAC;IACzG,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW;QAAE,CAAC,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,EAAU,CAAC,CAAC;IAClG,IAAI,WAAW,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,4BAA4B,EAAE,GAAG,WAAW,CAAC,IAAI,wCAAwC,EAAE,aAAa,CAAC,CAAC;IACjK,IAAI,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,kIAAkI,EAAE,OAAO,CAAC,CAAC;IACjN,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,EAAE,4EAA4E,CAAC,CAAC;IAE3J,IAAI,IAAI,CAAC,cAAc;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,cAAc,yBAAyB,IAAI,CAAC,aAAa,kBAAkB,EAAE,qDAAqD,EAAE,iBAAiB,CAAC,CAAC;IACtN,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,EAAE,iEAAiE,EAAE,+HAA+H,CAAC,CAAC;IAEjQ,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC7B,CAAC,oDAAoD,EAAE,6FAA6F,CAAC;QACrJ,CAAC,mCAAmC,EAAE,sDAAsD,CAAC;QAC7F,CAAC,0CAA0C,EAAE,iFAAiF,CAAC;QAC/H,CAAC,sCAAsC,EAAE,8CAA8C,CAAC;QACxF,CAAC,yCAAyC,EAAE,kCAAkC,CAAC;QAC/E,CAAC,mCAAmC,EAAE,uCAAuC,CAAC;QAC9E,CAAC,iCAAiC,EAAE,sCAAsC,CAAC;QAC3E,CAAC,UAAU,EAAE,uDAAuD,CAAC;KAC7D,EAAE,CAAC;QACX,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,yBAAyB,EAAE,OAAO,EAAE,qEAAqE,KAAK,GAAG,CAAC,CAAC;IACrI,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,IAAI,GAA2B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACxL,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QAClC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE;KAC1F,CAAC,CAAC;AACL,CAAC"}

package/dist/migrate/export/stytch.d.ts

@@ -0,0 +1,68 @@
+import type { PasswordHash, UserRecord } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+import { VendorHttp } from './vendor-http';
+/**
+ * `atlas migrate export stytch` — Stytch (consumer and B2B) onto the canonical
+ * bundle models, from the Stytch API with the project id and secret (on this
+ * machine only).
+ *
+ *   consumer   `POST /v1/users/search` (cursor paging, 1000 per page): emails
+ *              and phone numbers with their verified flags, name, OAuth
+ *              providers, metadata, roles, lock state.
+ *   B2B        `POST /v1/b2b/organizations/search`, then per organization
+ *              `POST /v1/b2b/organizations/members/search`, `GET /v1/b2b/sso/{org}`
+ *              and the RBAC policy (`GET /v1/b2b/rbac/policy`).
+ *
+ * Stytch members belong to ONE organization each (`member_id` is per
+ * organization). Atlas users are people, so members sharing an email become one
+ * user: the earliest member's id is the user id (the session JWT `sub` of that
+ * member maps to it) and the others' ids are kept in `private_metadata`.
+ *
+ * Password hashes never leave Stytch through the API: they come from the export
+ * Stytch support sends on request (support@stytch.com), given as `--stytch-hashes`
+ * (CSV, JSON or NDJSON). Until then the `stytch` lazy-migration preset checks
+ * passwords against Stytch on first sign-in. TOTP secrets, passkeys and crypto
+ * wallets are not exported.
+ */
+export type StytchProduct = 'consumer' | 'b2b';
+export interface StytchExportOptions {
+    projectId: string;
+    secret: string;
+    /** Detected from the project when omitted. */
+    product?: StytchProduct;
+    /** Override `https://api.stytch.com` (live) / `https://test.stytch.com` (test), e.g. a custom domain. */
+    baseUrl?: string;
+    /** The support-provided password export (CSV, JSON array or NDJSON text). */
+    hashesText?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** The API host for a project id: live projects are on api.stytch.com, test projects on test.stytch.com. */
+export declare function stytchBaseUrl(projectId: string): string;
+/** HTTP Basic credentials for the project. */
+export declare function stytchAuthorization(projectId: string, secret: string): string;
+export declare function stytchHttp(o: Pick<StytchExportOptions, 'projectId' | 'secret' | 'baseUrl' | 'fetchImpl' | 'sleep'>): VendorHttp;
+/** Is this a B2B project? Its organization search answers; a consumer project refuses the endpoint. */
+export declare function detectStytchProduct(http: VendorHttp): Promise<StytchProduct>;
+/** Stytch's cursor paging: `results_metadata.next_cursor` until it is null. */
+export declare function stytchSearch(http: VendorHttp, path: string, body: Obj, key: string): Promise<Obj[]>;
+export declare function exportStytch(opts: StytchExportOptions): Promise<RecordSet>;
+/** One Stytch user object → a user record; null with nothing to sign in with. */
+export declare function mapStytchUser(u: Obj): UserRecord | null;
+export declare function stytchRoleKey(roleId: string): string;
+/**
+ * Parse the password export Stytch support sends: a JSON array (or an object
+ * holding one under `users` / `members` / `results`), NDJSON, or CSV with a
+ * header row. Keys are lower-cased; a nested `scrypt_config` etc. is flattened.
+ */
+export declare function parseStytchHashes(text: string): Obj[];
+/**
+ * One row of the support export → the bundle's password hash. Field names
+ * follow Stytch's own password-migration API (`hash`, `hash_type`, and the
+ * `scrypt_config` / `pbkdf_2_config` / salt fields), which is the format the
+ * export mirrors (UNCONFIRMED: Stytch support documents it per request).
+ */
+export declare function stytchPasswordHash(row: Obj): PasswordHash | {
+    reason: string;
+};