@checkstack/auth-common 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @checkstack/auth-common
 
+## 0.5.0
+
+### Minor Changes
+
+- d94121b: Add group-to-role mapping for SAML and LDAP authentication
+
+  **Features:**
+
+  - SAML and LDAP users can now be automatically assigned Checkstack roles based on their directory group memberships
+  - Configure group mappings in the authentication strategy settings with dynamic role dropdowns
+  - Managed role sync: roles configured in mappings are fully synchronized (added when user gains group, removed when user leaves group)
+  - Unmanaged roles (manually assigned, not in any mapping) are preserved during sync
+  - Optional default role for all users from a directory
+
+  **Bug Fix:**
+
+  - Fixed `x-options-resolver` not working for fields inside arrays with `.default([])` in DynamicForm schemas
+
+## 0.4.0
+
+### Minor Changes
+
+- df6ac7b: Added onboarding flow and user profile
+
 ## 0.3.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-common",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "type": "module",
   "exports": {
     ".": {

package/src/routes.ts

@@ -11,4 +11,6 @@ export const authRoutes = createRoutes("auth", {
   forgotPassword: "/forgot-password",
   resetPassword: "/reset-password",
   changePassword: "/change-password",
+  profile: "/profile",
+  onboarding: "/onboarding",
 });

package/src/rpc-contract.ts

@@ -68,6 +68,10 @@ const UpsertExternalUserInputSchema = z.object({
   accountId: z.string(),
   password: z.string(),
   autoUpdateUser: z.boolean().optional(),
+  /** Role IDs to assign based on current directory group membership */
+  syncRoles: z.array(z.string()).optional(),
+  /** All role IDs that are managed by directory mappings (used to remove roles when user leaves groups) */
+  managedRoleIds: z.array(z.string()).optional(),
 });
 
 const UpsertExternalUserOutputSchema = z.object({
@@ -109,6 +113,26 @@ export const authContract = {
     access: [],
   }).output(RegistrationStatusSchema),
 
+  getOnboardingStatus: proc({
+    operationType: "query",
+    userType: "anonymous",
+    access: [],
+  }).output(z.object({ needsOnboarding: z.boolean() })),
+
+  completeOnboarding: proc({
+    operationType: "mutation",
+    userType: "anonymous",
+    access: [],
+  })
+    .input(
+      z.object({
+        name: z.string().min(1),
+        email: z.string().email(),
+        password: z.string(),
+      }),
+    )
+    .output(z.object({ success: z.boolean() })),
+
   // ==========================================================================
   // AUTHENTICATED ENDPOINTS (userType: "authenticated")
   // ==========================================================================
@@ -119,6 +143,32 @@ export const authContract = {
     access: [],
   }).output(z.object({ accessRules: z.array(z.string()) })),
 
+  getCurrentUserProfile: proc({
+    operationType: "query",
+    userType: "user",
+    access: [],
+  }).output(
+    z.object({
+      id: z.string(),
+      name: z.string(),
+      email: z.string(),
+      hasCredentialAccount: z.boolean(),
+    }),
+  ),
+
+  updateCurrentUser: proc({
+    operationType: "mutation",
+    userType: "user",
+    access: [],
+  })
+    .input(
+      z.object({
+        name: z.string().min(1).optional(),
+        email: z.string().email().optional(),
+      }),
+    )
+    .output(z.void()),
+
   // ==========================================================================
   // USER MANAGEMENT (userType: "user" with access)
   // ==========================================================================
@@ -179,7 +229,7 @@ export const authContract = {
         name: z.string(),
         description: z.string().optional(),
         accessRules: z.array(z.string()),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -194,7 +244,7 @@ export const authContract = {
         name: z.string().optional(),
         description: z.string().optional(),
         accessRules: z.array(z.string()),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -226,7 +276,7 @@ export const authContract = {
         id: z.string(),
         enabled: z.boolean(),
         config: z.record(z.string(), z.unknown()).optional(),
-      })
+      }),
     )
     .output(z.object({ success: z.boolean() })),
 
@@ -301,7 +351,7 @@ export const authContract = {
           email: z.string(),
           name: z.string().nullable(),
         })
-        .optional()
+        .optional(),
     ),
 
   filterUsersByAccessRule: proc({
@@ -313,7 +363,7 @@ export const authContract = {
       z.object({
         userIds: z.array(z.string()),
         accessRule: z.string(),
-      })
+      }),
     )
     .output(z.array(z.string())),
 
@@ -335,8 +385,8 @@ export const authContract = {
         createdById: z.string(),
         createdAt: z.coerce.date(),
         lastUsedAt: z.coerce.date().optional().nullable(),
-      })
-    )
+      }),
+    ),
   ),
 
   createApplication: proc({
@@ -348,7 +398,7 @@ export const authContract = {
       z.object({
         name: z.string().min(1).max(100),
         description: z.string().max(500).optional(),
-      })
+      }),
     )
     .output(
       z.object({
@@ -361,7 +411,7 @@ export const authContract = {
           createdAt: z.coerce.date(),
         }),
         secret: z.string(),
-      })
+      }),
     ),
 
   updateApplication: proc({
@@ -375,7 +425,7 @@ export const authContract = {
         name: z.string().optional(),
         description: z.string().optional().nullable(),
         roles: z.array(z.string()).optional(),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -411,8 +461,8 @@ export const authContract = {
         description: z.string().optional().nullable(),
         memberCount: z.number(),
         isManager: z.boolean(),
-      })
-    )
+      }),
+    ),
   ),
 
   getTeam: proc({
@@ -428,13 +478,13 @@ export const authContract = {
           name: z.string(),
           description: z.string().optional().nullable(),
           members: z.array(
-            z.object({ id: z.string(), name: z.string(), email: z.string() })
+            z.object({ id: z.string(), name: z.string(), email: z.string() }),
           ),
           managers: z.array(
-            z.object({ id: z.string(), name: z.string(), email: z.string() })
+            z.object({ id: z.string(), name: z.string(), email: z.string() }),
           ),
         })
-        .optional()
+        .optional(),
     ),
 
   createTeam: proc({
@@ -446,7 +496,7 @@ export const authContract = {
       z.object({
         name: z.string().min(1).max(100),
         description: z.string().max(500).optional(),
-      })
+      }),
     )
     .output(z.object({ id: z.string() })),
 
@@ -460,7 +510,7 @@ export const authContract = {
         id: z.string(),
         name: z.string().optional(),
         description: z.string().optional().nullable(),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -517,8 +567,8 @@ export const authContract = {
           teamName: z.string(),
           canRead: z.boolean(),
           canManage: z.boolean(),
-        })
-      )
+        }),
+      ),
     ),
 
   setResourceTeamAccess: proc({
@@ -533,7 +583,7 @@ export const authContract = {
         teamId: z.string(),
         canRead: z.boolean().optional(),
         canManage: z.boolean().optional(),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -547,7 +597,7 @@ export const authContract = {
         resourceType: z.string(),
         resourceId: z.string(),
         teamId: z.string(),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -569,7 +619,7 @@ export const authContract = {
         resourceType: z.string(),
         resourceId: z.string(),
         teamOnly: z.boolean(),
-      })
+      }),
     )
     .output(z.void()),
 
@@ -590,7 +640,7 @@ export const authContract = {
         resourceId: z.string(),
         action: z.enum(["read", "manage"]),
         hasGlobalAccess: z.boolean(),
-      })
+      }),
     )
     .output(z.object({ hasAccess: z.boolean() })),
 
@@ -607,7 +657,7 @@ export const authContract = {
         resourceIds: z.array(z.string()),
         action: z.enum(["read", "manage"]),
         hasGlobalAccess: z.boolean(),
-      })
+      }),
     )
     .output(z.array(z.string())),