@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/idp/IDPClaimSyncService.cjs

@@ -0,0 +1,261 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ClaimMapping = require("./ClaimMapping.cjs");
+const ClaimMappingEvaluator = require("./ClaimMappingEvaluator.cjs");
+const ClaimMappingValidation = require("./ClaimMappingValidation.cjs");
+const schema = require("@contember/schema");
+const schemaUtils = require("@contember/schema-utils");
+require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../type/ApiKey.cjs");
+const ProjectMembershipByIdentityQuery = require("../../queries/membership/ProjectMembershipByIdentityQuery.cjs");
+const ProjectBySlugQuery = require("../../queries/project/ProjectBySlugQuery.cjs");
+require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/CustomRolePermissions.cjs");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/TargetIdentityPermission.cjs");
+require("node:crypto");
+const CreateOrUpdateProjectMembershipCommand = require("../../commands/membership/CreateOrUpdateProjectMembershipCommand.cjs");
+const RemoveProjectMembershipCommand = require("../../commands/membership/RemoveProjectMembershipCommand.cjs");
+class IDPClaimSyncService {
+  constructor(projectSchemaResolver) {
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async sync(db, mapping, claims, identity, isNewPerson, options = {}) {
+    if (mapping.rules.length === 0) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const syncPolicy = mapping.syncPolicy ?? ClaimMapping.DEFAULT_SYNC_POLICY;
+    const unmatched = options.allowRemoval === false ? "keep" : mapping.unmatched ?? ClaimMapping.DEFAULT_UNMATCHED;
+    if (syncPolicy === "sticky" && !isNewPerson) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const { safe: rules, dropped, aclByProject } = await this.dropUnsafeRules(db, mapping.rules);
+    const evaluated = ClaimMappingEvaluator.evaluateClaimMapping({ ...mapping, rules }, claims);
+    const { safe: memberships, dropped: droppedMemberships } = this.dropUnsafeEvaluatedMemberships(evaluated, aclByProject);
+    const droppedUnsafeRules = dropped.length > 0 || droppedMemberships.length > 0;
+    const vocabularyMemberships = /* @__PURE__ */ new Map();
+    for (const rule of rules) {
+      if (rule.grantMembership) {
+        const roles = vocabularyMemberships.get(rule.grantMembership.project) ?? /* @__PURE__ */ new Set();
+        roles.add(rule.grantMembership.role);
+        vocabularyMemberships.set(rule.grantMembership.project, roles);
+      }
+    }
+    const before = await this.snapshot(db, identity.id, vocabularyMemberships);
+    await this.applyMemberships(db, identity.id, memberships, vocabularyMemberships, unmatched);
+    const after = await this.snapshot(db, identity.id, vocabularyMemberships);
+    if (snapshotEquals(before, after)) {
+      return { audit: null, droppedUnsafeRules };
+    }
+    return { audit: { before, after, syncPolicy, unmatched }, droppedUnsafeRules };
+  }
+  /**
+   * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+   * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+   * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+   * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+   * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+   * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+   *
+   * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+   * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+   * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+   * disambiguate via the tenant `project` table:
+   *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+   *     it, so nothing is written). KEEP the rule for when the project is created later.
+   *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+   *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+   *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+   *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+   *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+   *
+   * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+   * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+   */
+  async dropUnsafeRules(db, rules) {
+    const aclByProject = /* @__PURE__ */ new Map();
+    const projectExistsBySlug = /* @__PURE__ */ new Map();
+    const safe = [];
+    const dropped = [];
+    for (const rule of rules) {
+      const membership = rule.grantMembership;
+      if (!membership) {
+        safe.push(rule);
+        continue;
+      }
+      if (!aclByProject.has(membership.project)) {
+        const schema2 = await this.projectSchemaResolver.getSchema(membership.project);
+        aclByProject.set(membership.project, schema2?.acl ?? null);
+      }
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (acl === null) {
+        if (!projectExistsBySlug.has(membership.project)) {
+          const project = await db.queryHandler.fetch(new ProjectBySlugQuery.ProjectBySlugQuery(membership.project));
+          projectExistsBySlug.set(membership.project, project != null);
+        }
+        if (projectExistsBySlug.get(membership.project)) {
+          dropped.push(rule);
+        } else {
+          safe.push(rule);
+        }
+        continue;
+      }
+      let unsafe;
+      try {
+        unsafe = ClaimMappingValidation.validateClaimMappingMembership(acl, membership).length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(rule);
+      } else {
+        safe.push(rule);
+      }
+    }
+    return { safe, dropped, aclByProject };
+  }
+  /**
+   * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+   * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+   * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+   * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+   * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+   * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+   * missing variable there denies, never escalates).
+   *
+   * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+   * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+   * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+   * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+   * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+   * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+   * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+   * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+   * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+   *
+   * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+   * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+   * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+   * the bare grant is then never written; under `remove` it is absent from the granted set, so
+   * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+   * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+   * `idp_role_mapping_failed` fail-open marker.
+   */
+  dropUnsafeEvaluatedMemberships(memberships, aclByProject) {
+    const resolver = new schemaUtils.MembershipResolver();
+    const safe = [];
+    const dropped = [];
+    for (const membership of memberships) {
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (membership.role !== schema.ProjectRole.ADMIN || acl === null) {
+        safe.push(membership);
+        continue;
+      }
+      const written = {
+        role: membership.role,
+        variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, values: [...it.values] }))
+      };
+      let unsafe;
+      try {
+        unsafe = resolver.resolve(acl, [written], schemaUtils.MembershipResolver.UnknownIdentity, false).errors.length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(membership);
+      } else {
+        safe.push(membership);
+      }
+    }
+    return { safe, dropped };
+  }
+  // Membership writes are driven through the low-level commands directly (as InviteManager also does),
+  // not via ProjectMemberManager (the "normal" add/update-member path): A09 needs semantics that path does
+  // not offer — empty-value hard-delete avoidance under `keep`, and vocabulary-bounded removal under `remove`.
+  async applyMemberships(db, identityId, grantedMemberships, vocabularyMemberships, unmatched) {
+    const byProject = /* @__PURE__ */ new Map();
+    for (const membership of grantedMemberships) {
+      const list = byProject.get(membership.project) ?? [];
+      list.push(membership);
+      byProject.set(membership.project, list);
+    }
+    const projectSlugs = unmatched === "remove" ? /* @__PURE__ */ new Set([...vocabularyMemberships.keys(), ...byProject.keys()]) : new Set(byProject.keys());
+    for (const projectSlug of projectSlugs) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery.ProjectBySlugQuery(projectSlug));
+      if (!project) {
+        continue;
+      }
+      const memberships = byProject.get(projectSlug) ?? [];
+      const grantedRoles = new Set(memberships.map((it) => it.role));
+      if (unmatched === "remove") {
+        const vocabularyRoles = vocabularyMemberships.get(projectSlug) ?? /* @__PURE__ */ new Set();
+        const existing = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery.ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+        for (const membership of existing) {
+          if (vocabularyRoles.has(membership.role) && !grantedRoles.has(membership.role)) {
+            await db.commandBus.execute(new RemoveProjectMembershipCommand.RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          }
+        }
+      }
+      for (const membership of memberships) {
+        if (unmatched === "remove" && membership.variables.some((it) => it.values.length === 0)) {
+          await db.commandBus.execute(new RemoveProjectMembershipCommand.RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          continue;
+        }
+        await db.commandBus.execute(
+          new CreateOrUpdateProjectMembershipCommand.CreateOrUpdateProjectMembershipCommand(
+            project.id,
+            identityId,
+            {
+              role: membership.role,
+              // Drop variables with no values: an unset variable simply isn't applied (a role with no
+              // variables is fine — it sends none). Under `keep` this is the only empty-handling; under
+              // `remove` an empty DECLARED variable already revoked the whole membership above. Because the
+              // filtered list never carries an empty `set`, the command's hard-delete-on-empty never fires
+              // here — so `keep` never revokes a grant, and `remove`'s revocation stays explicit above.
+              variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, set: [...it.values] }))
+            }
+          )
+        );
+      }
+    }
+  }
+  /**
+   * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+   * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+   * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+   * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+   * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+   * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+   * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+   * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+   * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+   * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+   * still detected as a change and audited.
+   */
+  async snapshot(db, identityId, vocabularyMemberships) {
+    const memberships = [];
+    for (const [slug, roles] of vocabularyMemberships) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery.ProjectBySlugQuery(slug));
+      if (!project) {
+        continue;
+      }
+      const rows = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery.ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+      for (const row of rows) {
+        if (roles.has(row.role)) {
+          memberships.push({ project: slug, role: row.role, variables: row.variables });
+        }
+      }
+    }
+    return { memberships: sortMemberships(memberships) };
+  }
+}
+const sortMemberships = (memberships) => [...memberships].map((membership) => ({
+  project: membership.project,
+  role: membership.role,
+  variables: [...membership.variables].map((variable) => ({ name: variable.name, values: [...variable.values].sort() })).sort((a, b) => a.name.localeCompare(b.name))
+})).sort((a, b) => a.project.localeCompare(b.project) || a.role.localeCompare(b.role));
+const snapshotEquals = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+exports.IDPClaimSyncService = IDPClaimSyncService;
+//# sourceMappingURL=IDPClaimSyncService.cjs.map

package/dist/production/src/model/service/idp/IDPClaimSyncService.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPClaimSyncService.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPClaimSyncService.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ClaimMapping, ClaimMappingRule, DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED } from './ClaimMapping.js'\nimport { evaluateClaimMapping, MappedMembership } from './ClaimMappingEvaluator.js'\nimport { validateClaimMappingMembership } from './ClaimMappingValidation.js'\nimport { ProjectSchemaResolver } from '../../type/index.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { MembershipResolver } from '@contember/schema-utils'\nimport { ProjectBySlugQuery, ProjectMembershipByIdentityQuery } from '../../queries/index.js'\nimport { CreateOrUpdateProjectMembershipCommand, RemoveProjectMembershipCommand } from '../../commands/index.js'\n\nexport type ClaimMappingSnapshot = {\n\treadonly memberships: readonly MappedMembership[]\n}\n\nexport type ClaimMappingAudit = {\n\treadonly before: ClaimMappingSnapshot\n\treadonly after: ClaimMappingSnapshot\n\treadonly syncPolicy: NonNullable<ClaimMapping['syncPolicy']>\n\treadonly unmatched: NonNullable<ClaimMapping['unmatched']>\n}\n\nexport type ClaimMappingSyncResult = {\n\t/** Membership before/after delta — present only when the apply actually changed grants. */\n\treadonly audit: ClaimMappingAudit | null\n\t/** True when the apply-time safety backstop dropped one or more configured rules (a fail-open marker for the caller's audit). */\n\treadonly droppedUnsafeRules: boolean\n}\n\n/**\n * Applies an IdP's `claimMapping` (A09) after a person has been resolved: evaluates the declarative\n * rules against the IdP claims and grants the resulting project memberships, honouring the per-IdP\n * `syncPolicy` (`always` vs `sticky`) and `unmatched` (`keep` vs `remove`) settings. The mapping\n * grants project memberships only — never global/tenant roles (see {@link ClaimMapping}).\n *\n * Runs at sign-in (inside the sign-in transaction) and, for `always` mappings, again on each OIDC\n * session refresh (see `IdpSessionRevalidator`). Returns a {@link ClaimMappingSyncResult}: an\n * `{ before, after }` audit delta (`null` when nothing changed) plus `droppedUnsafeRules` (true when the\n * apply-time safety backstop dropped a configured rule). The caller emits the `idp_role_mapped` audit\n * from the delta and the `idp_role_mapping_failed` fail-open marker from `droppedUnsafeRules` — audit\n * lives at the caller layer, never here.\n *\n * The caller parses the mapping (via {@link parseClaimMapping}) and decides the fail-open policy: a\n * malformed config is caught by the caller before this runs, while a DB error raised here propagates\n * so the surrounding transaction rolls back the partial apply (no half-applied grants).\n */\nexport class IDPClaimSyncService {\n\tconstructor(\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {\n\t}\n\n\tasync sync(\n\t\tdb: DatabaseContext,\n\t\tmapping: ClaimMapping,\n\t\tclaims: Record<string, unknown>,\n\t\tidentity: { id: string },\n\t\tisNewPerson: boolean,\n\t\toptions: { allowRemoval?: boolean } = {},\n\t): Promise<ClaimMappingSyncResult> {\n\t\tif (mapping.rules.length === 0) {\n\t\t\treturn { audit: null, droppedUnsafeRules: false }\n\t\t}\n\n\t\tconst syncPolicy = mapping.syncPolicy ?? DEFAULT_SYNC_POLICY\n\t\t// `unmatched: 'remove'` reconciliation is only safe when the claim surface is COMPLETE: a rule that\n\t\t// matched at sign-in but is missing from a partial surface would strip a legitimate membership with no\n\t\t// IdP change. At sign-in the surface is always complete, so the caller leaves removal enabled. On the\n\t\t// OIDC refresh path the caller passes `allowRemoval` per surface completeness (see IdpSessionRevalidator):\n\t\t// a `method: 'refresh'` that rebuilt sign-in's id-token + userinfo surface enables removal (refresh then\n\t\t// reconciles exactly like sign-in); a partial surface (userinfo-only probe, or a failed userinfo fetch)\n\t\t// disables it so refresh stays additive-only. The audit below reflects this effective value.\n\t\tconst unmatched = options.allowRemoval === false ? 'keep' : (mapping.unmatched ?? DEFAULT_UNMATCHED)\n\n\t\t// `sticky`: only apply at account creation; an existing account keeps whatever it has. This is\n\t\t// also what bounds refresh-sync to `always` mappings — a refresh passes `isNewPerson: false`.\n\t\tif (syncPolicy === 'sticky' && !isNewPerson) {\n\t\t\treturn { audit: null, droppedUnsafeRules: false }\n\t\t}\n\n\t\t// Apply-time safety backstop (A09): re-validate each granted membership against the project's LIVE\n\t\t// ACL schema and drop any that fails (fail-closed) — condition-injection above all, but ANY error\n\t\t// (unknown role/variable, a malformed condition value, an unsafe predefined). Config-time validation\n\t\t// (`IDPManager.assertValidClaimMapping`) is the primary guard, but it is skipped when the target\n\t\t// project does not exist yet, is never re-run when it is later created, and a variable's ACL type can\n\t\t// drift (e.g. entity → condition) after the mapping was authored. A dropped rule is removed from BOTH\n\t\t// the granted set and the removal vocabulary below (both derived from `rules`), so an unsafe rule\n\t\t// neither grants nor drives reconciliation. The caller is told a drop happened (`droppedUnsafeRules`)\n\t\t// so it can emit the `idp_role_mapping_failed` fail-open marker.\n\t\tconst { safe: rules, dropped, aclByProject } = await this.dropUnsafeRules(db, mapping.rules)\n\n\t\t// Apply-time safety backstop, part 2 (A09): RUNTIME re-validation of the EVALUATED memberships.\n\t\t// `dropUnsafeRules` above only sees each rule's static CONFIG shape, so — like config-time validation —\n\t\t// it tolerates a missing membership variable (an A09 grant may set only some of a role's variables).\n\t\t// Once the claims are evaluated we know each membership EXACTLY as it would be written, and can\n\t\t// fail-close on the one case that tolerance makes unsafe: an `admin` grant whose claim-derived scoping\n\t\t// variable resolved empty, which would otherwise persist a bare, UNSCOPED `admin` membership (see\n\t\t// {@link dropUnsafeEvaluatedMemberships}). Both drop sets feed the `droppedUnsafeRules` fail-open marker.\n\t\tconst evaluated = evaluateClaimMapping({ ...mapping, rules }, claims)\n\t\tconst { safe: memberships, dropped: droppedMemberships } = this.dropUnsafeEvaluatedMemberships(evaluated, aclByProject)\n\t\tconst droppedUnsafeRules = dropped.length > 0 || droppedMemberships.length > 0\n\n\t\t// The mapping's membership \"vocabulary\": every (project, role) any rule could grant a membership\n\t\t// for. Removal is strictly bounded to this set so memberships and variable names managed outside\n\t\t// the mapping are never stripped, even under `unmatched: 'remove'`.\n\t\tconst vocabularyMemberships = new Map<string, Set<string>>()\n\t\tfor (const rule of rules) {\n\t\t\tif (rule.grantMembership) {\n\t\t\t\tconst roles = vocabularyMemberships.get(rule.grantMembership.project) ?? new Set<string>()\n\t\t\t\troles.add(rule.grantMembership.role)\n\t\t\t\tvocabularyMemberships.set(rule.grantMembership.project, roles)\n\t\t\t}\n\t\t}\n\t\tconst before = await this.snapshot(db, identity.id, vocabularyMemberships)\n\n\t\tawait this.applyMemberships(db, identity.id, memberships, vocabularyMemberships, unmatched)\n\n\t\tconst after = await this.snapshot(db, identity.id, vocabularyMemberships)\n\n\t\tif (snapshotEquals(before, after)) {\n\t\t\treturn { audit: null, droppedUnsafeRules }\n\t\t}\n\n\t\treturn { audit: { before, after, syncPolicy, unmatched }, droppedUnsafeRules }\n\t}\n\n\t/**\n\t * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule\n\t * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL\n\t * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed\n\t * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot\n\t * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per\n\t * project. The dropped set is returned so the caller can emit a fail-open audit marker.\n\t *\n\t * When `getSchema` returns no ACL it does NOT mean \"the project does not exist\": it returns undefined both\n\t * for a project that has no row yet AND for one whose row exists but whose container / content schema is\n\t * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we\n\t * disambiguate via the tenant `project` table:\n\t *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips\n\t *     it, so nothing is written). KEEP the rule for when the project is created later.\n\t *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership\n\t *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an\n\t *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could\n\t *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This\n\t *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.\n\t *\n\t * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop\n\t * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.\n\t */\n\tprivate async dropUnsafeRules(\n\t\tdb: DatabaseContext,\n\t\trules: readonly ClaimMappingRule[],\n\t): Promise<{ safe: ClaimMappingRule[]; dropped: ClaimMappingRule[]; aclByProject: Map<string, Acl.Schema | null> }> {\n\t\tconst aclByProject = new Map<string, Acl.Schema | null>()\n\t\tconst projectExistsBySlug = new Map<string, boolean>()\n\t\tconst safe: ClaimMappingRule[] = []\n\t\tconst dropped: ClaimMappingRule[] = []\n\t\tfor (const rule of rules) {\n\t\t\tconst membership = rule.grantMembership\n\t\t\tif (!membership) {\n\t\t\t\tsafe.push(rule)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!aclByProject.has(membership.project)) {\n\t\t\t\tconst schema = await this.projectSchemaResolver.getSchema(membership.project)\n\t\t\t\taclByProject.set(membership.project, schema?.acl ?? null)\n\t\t\t}\n\t\t\tconst acl = aclByProject.get(membership.project) ?? null\n\t\t\tif (acl === null) {\n\t\t\t\tif (!projectExistsBySlug.has(membership.project)) {\n\t\t\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(membership.project))\n\t\t\t\t\tprojectExistsBySlug.set(membership.project, project != null)\n\t\t\t\t}\n\t\t\t\t// project row exists but its ACL is unresolvable → can't prove the grant safe → drop (fail-closed);\n\t\t\t\t// no row yet → genuinely inert, keep for a project created later.\n\t\t\t\tif (projectExistsBySlug.get(membership.project)) {\n\t\t\t\t\tdropped.push(rule)\n\t\t\t\t} else {\n\t\t\t\t\tsafe.push(rule)\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tlet unsafe: boolean\n\t\t\ttry {\n\t\t\t\tunsafe = validateClaimMappingMembership(acl, membership).length > 0\n\t\t\t} catch {\n\t\t\t\tunsafe = true\n\t\t\t}\n\t\t\tif (unsafe) {\n\t\t\t\tdropped.push(rule)\n\t\t\t} else {\n\t\t\t\tsafe.push(rule)\n\t\t\t}\n\t\t}\n\t\treturn { safe, dropped, aclByProject }\n\t}\n\n\t/**\n\t * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`\n\t * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing\n\t * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's\n\t * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just\n\t * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,\n\t * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a\n\t * missing variable there denies, never escalates).\n\t *\n\t * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the\n\t * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity\n\t * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the\n\t * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves\n\t * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`\n\t * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a\n\t * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would\n\t * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization\n\t * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)\n\t *\n\t * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty\n\t * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver\n\t * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`\n\t * the bare grant is then never written; under `remove` it is absent from the granted set, so\n\t * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial\n\t * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the\n\t * `idp_role_mapping_failed` fail-open marker.\n\t */\n\tprivate dropUnsafeEvaluatedMemberships(\n\t\tmemberships: readonly MappedMembership[],\n\t\taclByProject: ReadonlyMap<string, Acl.Schema | null>,\n\t): { safe: MappedMembership[]; dropped: MappedMembership[] } {\n\t\tconst resolver = new MembershipResolver()\n\t\tconst safe: MappedMembership[] = []\n\t\tconst dropped: MappedMembership[] = []\n\t\tfor (const membership of memberships) {\n\t\t\tconst acl = aclByProject.get(membership.project) ?? null\n\t\t\t// Only `admin` is privileged by role name independent of its variables (see above). A null ACL means\n\t\t\t// the project has no row yet — an existing-but-unresolvable project had its rule dropped upstream, so\n\t\t\t// it never reaches here — so the grant is inert (`applyMemberships` skips the missing project): keep it.\n\t\t\tif (membership.role !== ProjectRole.ADMIN || acl === null) {\n\t\t\t\tsafe.push(membership)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\t// Validate the membership as it will be persisted: `applyMemberships` filters out empty-valued\n\t\t\t// variables before the write, so an unset required (non-fallback) variable surfaces here as\n\t\t\t// `VARIABLE_EMPTY`, exactly as the direct add-member path reports and rejects it. Any error ⇒ unsafe.\n\t\t\tconst written: Acl.Membership = {\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.filter(it => it.values.length > 0).map(it => ({ name: it.name, values: [...it.values] })),\n\t\t\t}\n\t\t\tlet unsafe: boolean\n\t\t\ttry {\n\t\t\t\tunsafe = resolver.resolve(acl, [written], MembershipResolver.UnknownIdentity, false).errors.length > 0\n\t\t\t} catch {\n\t\t\t\tunsafe = true\n\t\t\t}\n\t\t\tif (unsafe) {\n\t\t\t\tdropped.push(membership)\n\t\t\t} else {\n\t\t\t\tsafe.push(membership)\n\t\t\t}\n\t\t}\n\t\treturn { safe, dropped }\n\t}\n\n\t// Membership writes are driven through the low-level commands directly (as InviteManager also does),\n\t// not via ProjectMemberManager (the \"normal\" add/update-member path): A09 needs semantics that path does\n\t// not offer — empty-value hard-delete avoidance under `keep`, and vocabulary-bounded removal under `remove`.\n\tprivate async applyMemberships(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tgrantedMemberships: readonly MappedMembership[],\n\t\tvocabularyMemberships: ReadonlyMap<string, ReadonlySet<string>>,\n\t\tunmatched: NonNullable<ClaimMapping['unmatched']>,\n\t): Promise<void> {\n\t\t// Group granted memberships by project so each project is resolved (slug -> id) only once.\n\t\tconst byProject = new Map<string, MappedMembership[]>()\n\t\tfor (const membership of grantedMemberships) {\n\t\t\tconst list = byProject.get(membership.project) ?? []\n\t\t\tlist.push(membership)\n\t\t\tbyProject.set(membership.project, list)\n\t\t}\n\n\t\t// Under `remove`, reconcile every project in the mapping's membership vocabulary — not only the\n\t\t// projects granted this sign-in — so a membership whose claim disappeared entirely (its project is\n\t\t// then absent from `byProject`) is still revoked. `keep` only ever touches the projects it grants.\n\t\tconst projectSlugs = unmatched === 'remove'\n\t\t\t? new Set([...vocabularyMemberships.keys(), ...byProject.keys()])\n\t\t\t: new Set(byProject.keys())\n\n\t\tfor (const projectSlug of projectSlugs) {\n\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(projectSlug))\n\t\t\tif (!project) {\n\t\t\t\t// Mapping references a project that does not exist (or was deleted) — skip it rather\n\t\t\t\t// than fail the whole sign-in. The audit's before/after won't reflect it.\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tconst memberships = byProject.get(projectSlug) ?? []\n\t\t\tconst grantedRoles = new Set(memberships.map(it => it.role))\n\n\t\t\tif (unmatched === 'remove') {\n\t\t\t\t// Removal is bounded to the mapping's own membership vocabulary (project::role named by some\n\t\t\t\t// rule): a role the mapping could grant but doesn't this sign-in is stripped, while a\n\t\t\t\t// membership role no rule names (managed outside the mapping) is left untouched.\n\t\t\t\tconst vocabularyRoles = vocabularyMemberships.get(projectSlug) ?? new Set<string>()\n\t\t\t\tconst existing = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\t\t\tfor (const membership of existing) {\n\t\t\t\t\tif (vocabularyRoles.has(membership.role) && !grantedRoles.has(membership.role)) {\n\t\t\t\t\t\tawait db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role))\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tfor (const membership of memberships) {\n\t\t\t\t// Under `remove` the IdP is the source of truth, and the system does NOT allow an empty membership\n\t\t\t\t// variable — the direct add-member path hard-deletes a membership whose variable resolves to no\n\t\t\t\t// values (`CreateOrUpdateProjectMembershipCommand` deletes such a row), and the membership\n\t\t\t\t// resolver reports a missing/empty variable as VARIABLE_EMPTY. So a DECLARED variable that resolves\n\t\t\t\t// to no values means the grant is empty-scoped and meaningless: REVOKE the whole membership,\n\t\t\t\t// consistently with that invariant, rather than leaving a role with a missing/empty variable. (CORR-1:\n\t\t\t\t// clearing the variable to `[]` instead would, for a `condition` variable, parse to `{ or: [] }` =\n\t\t\t\t// allow-all — the opposite of revoking.) Under `keep` we never revoke, so an empty variable is simply\n\t\t\t\t// not applied below and the grant stays.\n\t\t\t\tif (unmatched === 'remove' && membership.variables.some(it => it.values.length === 0)) {\n\t\t\t\t\tawait db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role))\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\n\t\t\t\tawait db.commandBus.execute(\n\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(\n\t\t\t\t\t\tproject.id,\n\t\t\t\t\t\tidentityId,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\trole: membership.role,\n\t\t\t\t\t\t\t// Drop variables with no values: an unset variable simply isn't applied (a role with no\n\t\t\t\t\t\t\t// variables is fine — it sends none). Under `keep` this is the only empty-handling; under\n\t\t\t\t\t\t\t// `remove` an empty DECLARED variable already revoked the whole membership above. Because the\n\t\t\t\t\t\t\t// filtered list never carries an empty `set`, the command's hard-delete-on-empty never fires\n\t\t\t\t\t\t\t// here — so `keep` never revokes a grant, and `remove`'s revocation stays explicit above.\n\t\t\t\t\t\t\tvariables: membership.variables\n\t\t\t\t\t\t\t\t.filter(it => it.values.length > 0)\n\t\t\t\t\t\t\t\t.map(it => ({ name: it.name, set: [...it.values] })),\n\t\t\t\t\t\t},\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with\n\t * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by\n\t * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit\n\t * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),\n\t * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any\n\t * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a\n\t * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data\n\t * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog\n\t * readers — by design (the recorded value is the ACL grant being audited). Variable values are included\n\t * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is\n\t * still detected as a change and audited.\n\t */\n\tprivate async snapshot(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tvocabularyMemberships: ReadonlyMap<string, ReadonlySet<string>>,\n\t): Promise<ClaimMappingSnapshot> {\n\t\tconst memberships: MappedMembership[] = []\n\t\tfor (const [slug, roles] of vocabularyMemberships) {\n\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t\t\tif (!project) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst rows = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\t\tfor (const row of rows) {\n\t\t\t\t// Only the roles the mapping itself could grant: a membership role no rule names (managed outside\n\t\t\t\t// the mapping) is neither reconciled nor disclosed in the audit delta.\n\t\t\t\tif (roles.has(row.role)) {\n\t\t\t\t\tmemberships.push({ project: slug, role: row.role, variables: row.variables })\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { memberships: sortMemberships(memberships) }\n\t}\n}\n\n// Stable ordering (memberships by project+role, variables by name, values sorted) so `snapshotEquals`\n// compares by content, not by the DB's row/array order. Assumes variable `values` are always JSON\n// string arrays (which they are — the membership commands only ever store `string[]`); a non-string\n// element would make the default sort order-unstable and the JSON.stringify comparison spurious, so\n// keep variable values string-typed.\nconst sortMemberships = (memberships: readonly MappedMembership[]): readonly MappedMembership[] =>\n\t[...memberships]\n\t\t.map(membership => ({\n\t\t\tproject: membership.project,\n\t\t\trole: membership.role,\n\t\t\tvariables: [...membership.variables]\n\t\t\t\t.map(variable => ({ name: variable.name, values: [...variable.values].sort() }))\n\t\t\t\t.sort((a, b) => a.name.localeCompare(b.name)),\n\t\t}))\n\t\t.sort((a, b) => a.project.localeCompare(b.project) || a.role.localeCompare(b.role))\n\nconst snapshotEquals = (a: ClaimMappingSnapshot, b: ClaimMappingSnapshot): boolean => JSON.stringify(a) === JSON.stringify(b)\n"],"names":["DEFAULT_SYNC_POLICY","DEFAULT_UNMATCHED","evaluateClaimMapping","schema","ProjectBySlugQuery","validateClaimMappingMembership","MembershipResolver","ProjectRole","ProjectMembershipByIdentityQuery","RemoveProjectMembershipCommand","CreateOrUpdateProjectMembershipCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6CO,MAAM,oBAAoB;AAAA,EAChC,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,KACL,IACA,SACA,QACA,UACA,aACA,UAAsC,IACJ;AAClC,QAAI,QAAQ,MAAM,WAAW,GAAG;AAC/B,aAAO,EAAE,OAAO,MAAM,oBAAoB,MAAA;AAAA,IAC3C;AAEA,UAAM,aAAa,QAAQ,cAAcA,aAAAA;AAQzC,UAAM,YAAY,QAAQ,iBAAiB,QAAQ,SAAU,QAAQ,aAAaC,aAAAA;AAIlF,QAAI,eAAe,YAAY,CAAC,aAAa;AAC5C,aAAO,EAAE,OAAO,MAAM,oBAAoB,MAAA;AAAA,IAC3C;AAWA,UAAM,EAAE,MAAM,OAAO,SAAS,aAAA,IAAiB,MAAM,KAAK,gBAAgB,IAAI,QAAQ,KAAK;AAS3F,UAAM,YAAYC,sBAAAA,qBAAqB,EAAE,GAAG,SAAS,MAAA,GAAS,MAAM;AACpE,UAAM,EAAE,MAAM,aAAa,SAAS,uBAAuB,KAAK,+BAA+B,WAAW,YAAY;AACtH,UAAM,qBAAqB,QAAQ,SAAS,KAAK,mBAAmB,SAAS;AAK7E,UAAM,4CAA4B,IAAA;AAClC,eAAW,QAAQ,OAAO;AACzB,UAAI,KAAK,iBAAiB;AACzB,cAAM,QAAQ,sBAAsB,IAAI,KAAK,gBAAgB,OAAO,yBAAS,IAAA;AAC7E,cAAM,IAAI,KAAK,gBAAgB,IAAI;AACnC,8BAAsB,IAAI,KAAK,gBAAgB,SAAS,KAAK;AAAA,MAC9D;AAAA,IACD;AACA,UAAM,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS,IAAI,qBAAqB;AAEzE,UAAM,KAAK,iBAAiB,IAAI,SAAS,IAAI,aAAa,uBAAuB,SAAS;AAE1F,UAAM,QAAQ,MAAM,KAAK,SAAS,IAAI,SAAS,IAAI,qBAAqB;AAExE,QAAI,eAAe,QAAQ,KAAK,GAAG;AAClC,aAAO,EAAE,OAAO,MAAM,mBAAA;AAAA,IACvB;AAEA,WAAO,EAAE,OAAO,EAAE,QAAQ,OAAO,YAAY,UAAA,GAAa,mBAAA;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAc,gBACb,IACA,OACmH;AACnH,UAAM,mCAAmB,IAAA;AACzB,UAAM,0CAA0B,IAAA;AAChC,UAAM,OAA2B,CAAA;AACjC,UAAM,UAA8B,CAAA;AACpC,eAAW,QAAQ,OAAO;AACzB,YAAM,aAAa,KAAK;AACxB,UAAI,CAAC,YAAY;AAChB,aAAK,KAAK,IAAI;AACd;AAAA,MACD;AACA,UAAI,CAAC,aAAa,IAAI,WAAW,OAAO,GAAG;AAC1C,cAAMC,UAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW,OAAO;AAC5E,qBAAa,IAAI,WAAW,SAASA,SAAQ,OAAO,IAAI;AAAA,MACzD;AACA,YAAM,MAAM,aAAa,IAAI,WAAW,OAAO,KAAK;AACpD,UAAI,QAAQ,MAAM;AACjB,YAAI,CAAC,oBAAoB,IAAI,WAAW,OAAO,GAAG;AACjD,gBAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,WAAW,OAAO,CAAC;AACtF,8BAAoB,IAAI,WAAW,SAAS,WAAW,IAAI;AAAA,QAC5D;AAGA,YAAI,oBAAoB,IAAI,WAAW,OAAO,GAAG;AAChD,kBAAQ,KAAK,IAAI;AAAA,QAClB,OAAO;AACN,eAAK,KAAK,IAAI;AAAA,QACf;AACA;AAAA,MACD;AACA,UAAI;AACJ,UAAI;AACH,iBAASC,uBAAAA,+BAA+B,KAAK,UAAU,EAAE,SAAS;AAAA,MACnE,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,UAAI,QAAQ;AACX,gBAAQ,KAAK,IAAI;AAAA,MAClB,OAAO;AACN,aAAK,KAAK,IAAI;AAAA,MACf;AAAA,IACD;AACA,WAAO,EAAE,MAAM,SAAS,aAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BQ,+BACP,aACA,cAC4D;AAC5D,UAAM,WAAW,IAAIC,+BAAA;AACrB,UAAM,OAA2B,CAAA;AACjC,UAAM,UAA8B,CAAA;AACpC,eAAW,cAAc,aAAa;AACrC,YAAM,MAAM,aAAa,IAAI,WAAW,OAAO,KAAK;AAIpD,UAAI,WAAW,SAASC,OAAAA,YAAY,SAAS,QAAQ,MAAM;AAC1D,aAAK,KAAK,UAAU;AACpB;AAAA,MACD;AAIA,YAAM,UAA0B;AAAA,QAC/B,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,OAAO,QAAM,GAAG,OAAO,SAAS,CAAC,EAAE,IAAI,SAAO,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,GAAG,MAAM,IAAI;AAAA,MAAA;AAEzH,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,QAAQ,KAAK,CAAC,OAAO,GAAGD,YAAAA,mBAAmB,iBAAiB,KAAK,EAAE,OAAO,SAAS;AAAA,MACtG,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,UAAI,QAAQ;AACX,gBAAQ,KAAK,UAAU;AAAA,MACxB,OAAO;AACN,aAAK,KAAK,UAAU;AAAA,MACrB;AAAA,IACD;AACA,WAAO,EAAE,MAAM,QAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACb,IACA,YACA,oBACA,uBACA,WACgB;AAEhB,UAAM,gCAAgB,IAAA;AACtB,eAAW,cAAc,oBAAoB;AAC5C,YAAM,OAAO,UAAU,IAAI,WAAW,OAAO,KAAK,CAAA;AAClD,WAAK,KAAK,UAAU;AACpB,gBAAU,IAAI,WAAW,SAAS,IAAI;AAAA,IACvC;AAKA,UAAM,eAAe,cAAc,WAChC,oBAAI,IAAI,CAAC,GAAG,sBAAsB,KAAA,GAAQ,GAAG,UAAU,KAAA,CAAM,CAAC,IAC9D,IAAI,IAAI,UAAU,MAAM;AAE3B,eAAW,eAAe,cAAc;AACvC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIF,mBAAAA,mBAAmB,WAAW,CAAC;AAC/E,UAAI,CAAC,SAAS;AAGb;AAAA,MACD;AAEA,YAAM,cAAc,UAAU,IAAI,WAAW,KAAK,CAAA;AAClD,YAAM,eAAe,IAAI,IAAI,YAAY,IAAI,CAAA,OAAM,GAAG,IAAI,CAAC;AAE3D,UAAI,cAAc,UAAU;AAI3B,cAAM,kBAAkB,sBAAsB,IAAI,WAAW,yBAAS,IAAA;AACtE,cAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAII,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACnH,mBAAW,cAAc,UAAU;AAClC,cAAI,gBAAgB,IAAI,WAAW,IAAI,KAAK,CAAC,aAAa,IAAI,WAAW,IAAI,GAAG;AAC/E,kBAAM,GAAG,WAAW,QAAQ,IAAIC,+BAAAA,+BAA+B,QAAQ,IAAI,YAAY,WAAW,IAAI,CAAC;AAAA,UACxG;AAAA,QACD;AAAA,MACD;AAEA,iBAAW,cAAc,aAAa;AAUrC,YAAI,cAAc,YAAY,WAAW,UAAU,KAAK,QAAM,GAAG,OAAO,WAAW,CAAC,GAAG;AACtF,gBAAM,GAAG,WAAW,QAAQ,IAAIA,+BAAAA,+BAA+B,QAAQ,IAAI,YAAY,WAAW,IAAI,CAAC;AACvG;AAAA,QACD;AAEA,cAAM,GAAG,WAAW;AAAA,UACnB,IAAIC,uCAAAA;AAAAA,YACH,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,cACC,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAMjB,WAAW,WAAW,UACpB,OAAO,QAAM,GAAG,OAAO,SAAS,CAAC,EACjC,IAAI,SAAO,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI;AAAA,YAAA;AAAA,UACrD;AAAA,QACD;AAAA,MAEF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAc,SACb,IACA,YACA,uBACgC;AAChC,UAAM,cAAkC,CAAA;AACxC,eAAW,CAAC,MAAM,KAAK,KAAK,uBAAuB;AAClD,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIN,mBAAAA,mBAAmB,IAAI,CAAC;AACxE,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AACA,YAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAII,iCAAAA,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AAC/G,iBAAW,OAAO,MAAM;AAGvB,YAAI,MAAM,IAAI,IAAI,IAAI,GAAG;AACxB,sBAAY,KAAK,EAAE,SAAS,MAAM,MAAM,IAAI,MAAM,WAAW,IAAI,UAAA,CAAW;AAAA,QAC7E;AAAA,MACD;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,gBAAgB,WAAW,EAAA;AAAA,EAClD;AACD;AAOA,MAAM,kBAAkB,CAAC,gBACxB,CAAC,GAAG,WAAW,EACb,IAAI,CAAA,gBAAe;AAAA,EACnB,SAAS,WAAW;AAAA,EACpB,MAAM,WAAW;AAAA,EACjB,WAAW,CAAC,GAAG,WAAW,SAAS,EACjC,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,EAAE,KAAA,EAAK,EAAI,EAC9E,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC9C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,KAAK,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEpF,MAAM,iBAAiB,CAAC,GAAyB,MAAqC,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;;"}

package/dist/production/src/model/service/idp/IDPClaimSyncService.js

@@ -0,0 +1,261 @@
+import { DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED } from "./ClaimMapping.js";
+import { evaluateClaimMapping } from "./ClaimMappingEvaluator.js";
+import { validateClaimMappingMembership } from "./ClaimMappingValidation.js";
+import { ProjectRole } from "@contember/schema";
+import { MembershipResolver } from "@contember/schema-utils";
+import "../../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../type/ApiKey.js";
+import { ProjectMembershipByIdentityQuery } from "../../queries/membership/ProjectMembershipByIdentityQuery.js";
+import { ProjectBySlugQuery } from "../../queries/project/ProjectBySlugQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/CustomRolePermissions.js";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/TargetIdentityPermission.js";
+import "node:crypto";
+import { CreateOrUpdateProjectMembershipCommand } from "../../commands/membership/CreateOrUpdateProjectMembershipCommand.js";
+import { RemoveProjectMembershipCommand } from "../../commands/membership/RemoveProjectMembershipCommand.js";
+class IDPClaimSyncService {
+  constructor(projectSchemaResolver) {
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async sync(db, mapping, claims, identity, isNewPerson, options = {}) {
+    if (mapping.rules.length === 0) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const syncPolicy = mapping.syncPolicy ?? DEFAULT_SYNC_POLICY;
+    const unmatched = options.allowRemoval === false ? "keep" : mapping.unmatched ?? DEFAULT_UNMATCHED;
+    if (syncPolicy === "sticky" && !isNewPerson) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const { safe: rules, dropped, aclByProject } = await this.dropUnsafeRules(db, mapping.rules);
+    const evaluated = evaluateClaimMapping({ ...mapping, rules }, claims);
+    const { safe: memberships, dropped: droppedMemberships } = this.dropUnsafeEvaluatedMemberships(evaluated, aclByProject);
+    const droppedUnsafeRules = dropped.length > 0 || droppedMemberships.length > 0;
+    const vocabularyMemberships = /* @__PURE__ */ new Map();
+    for (const rule of rules) {
+      if (rule.grantMembership) {
+        const roles = vocabularyMemberships.get(rule.grantMembership.project) ?? /* @__PURE__ */ new Set();
+        roles.add(rule.grantMembership.role);
+        vocabularyMemberships.set(rule.grantMembership.project, roles);
+      }
+    }
+    const before = await this.snapshot(db, identity.id, vocabularyMemberships);
+    await this.applyMemberships(db, identity.id, memberships, vocabularyMemberships, unmatched);
+    const after = await this.snapshot(db, identity.id, vocabularyMemberships);
+    if (snapshotEquals(before, after)) {
+      return { audit: null, droppedUnsafeRules };
+    }
+    return { audit: { before, after, syncPolicy, unmatched }, droppedUnsafeRules };
+  }
+  /**
+   * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+   * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+   * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+   * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+   * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+   * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+   *
+   * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+   * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+   * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+   * disambiguate via the tenant `project` table:
+   *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+   *     it, so nothing is written). KEEP the rule for when the project is created later.
+   *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+   *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+   *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+   *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+   *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+   *
+   * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+   * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+   */
+  async dropUnsafeRules(db, rules) {
+    const aclByProject = /* @__PURE__ */ new Map();
+    const projectExistsBySlug = /* @__PURE__ */ new Map();
+    const safe = [];
+    const dropped = [];
+    for (const rule of rules) {
+      const membership = rule.grantMembership;
+      if (!membership) {
+        safe.push(rule);
+        continue;
+      }
+      if (!aclByProject.has(membership.project)) {
+        const schema = await this.projectSchemaResolver.getSchema(membership.project);
+        aclByProject.set(membership.project, schema?.acl ?? null);
+      }
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (acl === null) {
+        if (!projectExistsBySlug.has(membership.project)) {
+          const project = await db.queryHandler.fetch(new ProjectBySlugQuery(membership.project));
+          projectExistsBySlug.set(membership.project, project != null);
+        }
+        if (projectExistsBySlug.get(membership.project)) {
+          dropped.push(rule);
+        } else {
+          safe.push(rule);
+        }
+        continue;
+      }
+      let unsafe;
+      try {
+        unsafe = validateClaimMappingMembership(acl, membership).length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(rule);
+      } else {
+        safe.push(rule);
+      }
+    }
+    return { safe, dropped, aclByProject };
+  }
+  /**
+   * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+   * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+   * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+   * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+   * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+   * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+   * missing variable there denies, never escalates).
+   *
+   * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+   * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+   * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+   * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+   * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+   * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+   * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+   * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+   * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+   *
+   * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+   * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+   * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+   * the bare grant is then never written; under `remove` it is absent from the granted set, so
+   * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+   * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+   * `idp_role_mapping_failed` fail-open marker.
+   */
+  dropUnsafeEvaluatedMemberships(memberships, aclByProject) {
+    const resolver = new MembershipResolver();
+    const safe = [];
+    const dropped = [];
+    for (const membership of memberships) {
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (membership.role !== ProjectRole.ADMIN || acl === null) {
+        safe.push(membership);
+        continue;
+      }
+      const written = {
+        role: membership.role,
+        variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, values: [...it.values] }))
+      };
+      let unsafe;
+      try {
+        unsafe = resolver.resolve(acl, [written], MembershipResolver.UnknownIdentity, false).errors.length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(membership);
+      } else {
+        safe.push(membership);
+      }
+    }
+    return { safe, dropped };
+  }
+  // Membership writes are driven through the low-level commands directly (as InviteManager also does),
+  // not via ProjectMemberManager (the "normal" add/update-member path): A09 needs semantics that path does
+  // not offer — empty-value hard-delete avoidance under `keep`, and vocabulary-bounded removal under `remove`.
+  async applyMemberships(db, identityId, grantedMemberships, vocabularyMemberships, unmatched) {
+    const byProject = /* @__PURE__ */ new Map();
+    for (const membership of grantedMemberships) {
+      const list = byProject.get(membership.project) ?? [];
+      list.push(membership);
+      byProject.set(membership.project, list);
+    }
+    const projectSlugs = unmatched === "remove" ? /* @__PURE__ */ new Set([...vocabularyMemberships.keys(), ...byProject.keys()]) : new Set(byProject.keys());
+    for (const projectSlug of projectSlugs) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery(projectSlug));
+      if (!project) {
+        continue;
+      }
+      const memberships = byProject.get(projectSlug) ?? [];
+      const grantedRoles = new Set(memberships.map((it) => it.role));
+      if (unmatched === "remove") {
+        const vocabularyRoles = vocabularyMemberships.get(projectSlug) ?? /* @__PURE__ */ new Set();
+        const existing = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+        for (const membership of existing) {
+          if (vocabularyRoles.has(membership.role) && !grantedRoles.has(membership.role)) {
+            await db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          }
+        }
+      }
+      for (const membership of memberships) {
+        if (unmatched === "remove" && membership.variables.some((it) => it.values.length === 0)) {
+          await db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          continue;
+        }
+        await db.commandBus.execute(
+          new CreateOrUpdateProjectMembershipCommand(
+            project.id,
+            identityId,
+            {
+              role: membership.role,
+              // Drop variables with no values: an unset variable simply isn't applied (a role with no
+              // variables is fine — it sends none). Under `keep` this is the only empty-handling; under
+              // `remove` an empty DECLARED variable already revoked the whole membership above. Because the
+              // filtered list never carries an empty `set`, the command's hard-delete-on-empty never fires
+              // here — so `keep` never revokes a grant, and `remove`'s revocation stays explicit above.
+              variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, set: [...it.values] }))
+            }
+          )
+        );
+      }
+    }
+  }
+  /**
+   * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+   * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+   * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+   * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+   * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+   * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+   * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+   * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+   * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+   * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+   * still detected as a change and audited.
+   */
+  async snapshot(db, identityId, vocabularyMemberships) {
+    const memberships = [];
+    for (const [slug, roles] of vocabularyMemberships) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery(slug));
+      if (!project) {
+        continue;
+      }
+      const rows = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+      for (const row of rows) {
+        if (roles.has(row.role)) {
+          memberships.push({ project: slug, role: row.role, variables: row.variables });
+        }
+      }
+    }
+    return { memberships: sortMemberships(memberships) };
+  }
+}
+const sortMemberships = (memberships) => [...memberships].map((membership) => ({
+  project: membership.project,
+  role: membership.role,
+  variables: [...membership.variables].map((variable) => ({ name: variable.name, values: [...variable.values].sort() })).sort((a, b) => a.name.localeCompare(b.name))
+})).sort((a, b) => a.project.localeCompare(b.project) || a.role.localeCompare(b.role));
+const snapshotEquals = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+export {
+  IDPClaimSyncService
+};
+//# sourceMappingURL=IDPClaimSyncService.js.map