@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/service/captcha/CaptchaValidator.d.ts

@@ -0,0 +1,37 @@
+import { Config } from '../../type/Config.js';
+import { CaptchaProvider as CaptchaProviderKey } from '../../../schema/index.js';
+import { CaptchaProviderHandler, CaptchaVerifyResult } from './CaptchaProvider.js';
+/** Mutations that can be individually gated by captcha (config.captcha.protect). */
+export type CaptchaProtectedFlow = 'signUp' | 'passwordReset' | 'passwordlessInit' | 'emailVerification';
+export interface CaptchaConfig {
+    readonly provider: CaptchaProviderKey | null;
+    readonly secret: string | null;
+    readonly threshold: number | null;
+    readonly protect: Record<CaptchaProtectedFlow, boolean>;
+}
+export declare class CaptchaValidator {
+    private readonly providers;
+    constructor(providers: Record<CaptchaProviderKey, CaptchaProviderHandler>);
+    /** True when the tenant has opted into captcha (provider+secret both set). */
+    isEnabled(config: CaptchaConfig): boolean;
+    /**
+     * True when captcha is configured AND enforced for the given flow. A single
+     * provider/secret is shared; `config.captcha.protect` decides per-flow which
+     * mutations actually require a token.
+     */
+    isEnabledFor(config: CaptchaConfig, flow: CaptchaProtectedFlow): boolean;
+    /**
+     * Extract just the captcha-relevant fields from a loaded tenant Config so
+     * services only pass what they need.
+     */
+    extractConfig(config: Config): CaptchaConfig;
+    verify(args: {
+        config: CaptchaConfig;
+        token: string | null | undefined;
+        remoteIp?: string;
+    }): Promise<CaptchaVerifyResult | {
+        ok: true;
+        skipped: true;
+    }>;
+}
+//# sourceMappingURL=CaptchaValidator.d.ts.map

package/dist/types/model/service/captcha/CaptchaValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,EAC3E;IAEJ,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/C;IAED;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAE9E;IAED;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAYlD;IAEK,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAiB7D;CACD"}

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts

@@ -0,0 +1,9 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/** hCaptcha. Binary success/failure — `threshold` is ignored. */
+export declare class HCaptchaProvider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=HCaptchaProvider.d.ts.map

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBzF;CACD"}

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts

@@ -0,0 +1,12 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/**
+ * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no
+ * config-level threshold is set.
+ */
+export declare class RecaptchaV3Provider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=RecaptchaV3Provider.d.ts.map

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBpG;CACD"}

package/dist/types/model/service/captcha/TurnstileProvider.d.ts

@@ -0,0 +1,12 @@
+import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js';
+/**
+ * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.
+ * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/
+ */
+export declare class TurnstileProvider implements CaptchaProviderHandler {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch);
+    verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+//# sourceMappingURL=TurnstileProvider.d.ts.map

package/dist/types/model/service/captcha/TurnstileProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwBzF;CACD"}

package/dist/types/model/service/captcha/index.d.ts

@@ -0,0 +1,6 @@
+export * from './CaptchaProvider.js';
+export * from './CaptchaValidator.js';
+export * from './HCaptchaProvider.js';
+export * from './RecaptchaV3Provider.js';
+export * from './TurnstileProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/captcha/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA"}

package/dist/types/model/service/helpers/getPreferredProject.d.ts

@@ -1,3 +1,3 @@
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare const getPreferredProject: (projects: Project[], preferredProjectSlug: string | null) => Project | null;
 //# sourceMappingURL=getPreferredProject.d.ts.map

package/dist/types/model/service/helpers/getPreferredProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,EAAE,EAAE,sBAAsB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}
+{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,aAAc,OAAO,EAAE,wBAAwB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts

@@ -0,0 +1,10 @@
+import { ConfigPolicy } from '../../../schema/index.js';
+/**
+ * Resolves whether passwordless sign-in is effectively available for a person,
+ * combining the tenant-wide policy with the person's own flag. This is the same
+ * gate the passwordless sign-in flow applies, so any caller that reasons about a
+ * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays
+ * consistent with what sign-in actually permits.
+ */
+export declare const isPasswordlessEnabled: (globalValue: ConfigPolicy, personValue: boolean | null) => boolean;
+//# sourceMappingURL=isPasswordlessEnabled.d.ts.map

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,gBAAiB,YAAY,eAAe,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts

@@ -0,0 +1,34 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+export type BackchannelLogoutResult = {
+    status: 'ok';
+    revokedCount: number;
+} | {
+    status: 'provider_not_found';
+} | {
+    status: 'not_supported';
+} | {
+    status: 'invalid_token';
+    message: string;
+};
+/**
+ * Handles an incoming OIDC Back-Channel Logout request (A10). Runs entirely on the HTTP auth path
+ * (no GraphQL resolver), so — like {@link IdpSessionRevalidator} — it owns its own audit write
+ * rather than deferring to a resolver. Flow:
+ *   1. resolve the IdP by slug (the back-channel endpoint carries a `?provider=` query param, since
+ *      the IdP only knows which client it is calling, not the Contember tenant/provider record);
+ *   2. validate the IdP-signed logout token and extract `sid` / `sub`;
+ *   3. look up the local federated session(s) the token targets and revoke their api_key(s).
+ *
+ * A logout token with a `sid` targets that single IdP session; a `sub`-only token (rare — most IdPs
+ * send a `sid`) targets *all* of that subject's federated sessions under the provider. Either way, a
+ * token that matches no live session is reported as `revokedCount: 0` and audited, not failed.
+ */
+export declare class BackchannelLogoutManager {
+    private readonly idpRegistry;
+    constructor(idpRegistry: IDPHandlerRegistry);
+    logout(db: DatabaseContext, providerSlug: string, logoutToken: string): Promise<BackchannelLogoutResult>;
+    private resolveTargetSessions;
+    private audit;
+}
+//# sourceMappingURL=BackchannelLogoutManager.d.ts.map

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAD7B,YACkB,WAAW,EAAE,kBAAkB,EAC7C;IAEE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqC7G;YAEa,qBAAqB;YAerB,KAAK;CAoCnB"}

package/dist/types/model/service/idp/ClaimMapping.d.ts

@@ -0,0 +1,330 @@
+import * as Typesafe from '@contember/typesafe';
+/**
+ * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).
+ * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing
+ * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`
+ * already accept an opaque configuration object.
+ *
+ * The mapping grants **project memberships only** (a project role plus optional membership
+ * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing
+ * and granting them from external claims would be a privilege-escalation path, so global-role
+ * mapping was dropped. A project membership stays within what the IdP configurer
+ * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.
+ *
+ * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated
+ * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only
+ * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}
+ * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.
+ *
+ * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,
+ * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project
+ * membership. Rules are independent and additive — every matching rule contributes; a
+ * non-matching rule is simply skipped.
+ *
+ * Matching is declarative, never code:
+ * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one
+ *                of the elements).
+ * - `contains` — the claim contains the value: substring for string claims, membership for array
+ *                claims. This is the natural fit for multi-valued `groups`.
+ * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).
+ */
+/**
+ * Where a membership variable's values come from when they are not constant. Reads one `claim` from the
+ * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path
+ * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:
+ * - array claim       → its elements (`languages: ['cs','en']`)
+ * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements
+ * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their
+ *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)
+ *
+ * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.
+ */
+export declare const ClaimValueSource: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    }>;
+};
+export type ClaimValueSource = ReturnType<typeof ClaimValueSource>;
+/**
+ * One membership variable to set on a granted membership. Either constant (`values`), claim-derived
+ * (`from`), or both — the two sets are unioned. When derived from a claim:
+ * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.
+ *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…
+ * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by
+ *                   default: raw external claim values then flow straight into row-level ACL
+ *                   variables, so enable it only when the variable legitimately holds claim values
+ *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.
+ * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).
+ */
+export declare const ClaimMappingVariable: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    }>;
+};
+export type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>;
+export declare const ClaimMappingMembership: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    }>;
+};
+export type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>;
+export declare const ClaimMappingRule: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    }>;
+};
+export type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>;
+/**
+ * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a
+ * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only
+ * `claimMapping` is treated as "no role mapping", not an error).
+ */
+export declare const ClaimMapping: Typesafe.Type<{
+    readonly rules: readonly ({
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    })[];
+} & {
+    readonly syncPolicy?: "always" | "sticky" | undefined;
+    readonly unmatched?: "keep" | "remove" | undefined;
+}>;
+export type ClaimMapping = ReturnType<typeof ClaimMapping>;
+export declare const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']>;
+export declare const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']>;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+/**
+ * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no
+ * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no
+ * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both
+ * the pre-A09 sign-in path and the OIDC remap untouched.
+ *
+ * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the
+ * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via
+ * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required
+ * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.
+ *
+ * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in
+ * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is
+ * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a
+ * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object
+ * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/
+ * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)
+ * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap
+ * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),
+ * not a strict object. The removed `grantRoles` key is still caught separately by
+ * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic
+ * extra-property error `noExtraProps` would otherwise raise.
+ */
+export declare const parseClaimMapping: (configuration: Record<string, unknown>) => ClaimMapping | null;
+/**
+ * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,
+ * so config-time validation can reject them with a clear message pointing at `grantMembership`.
+ */
+export declare const findRemovedRuleKeys: (configuration: Record<string, unknown>) => string[];
+/**
+ * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one
+ * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a
+ * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:
+ * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`
+ *   when both are set, so the other would be silently ignored);
+ * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY
+ *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the
+ *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;
+ * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*
+ *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during
+ *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,
+ *   which the `partial` schema permits.)
+ * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there
+ *   is nothing to project, so the source can only ever resolve to no values;
+ * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value
+ *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).
+ */
+export declare const findClaimMappingShapeErrors: (mapping: ClaimMapping) => string[];
+//# sourceMappingURL=ClaimMapping.d.ts.map

package/dist/types/model/service/idp/ClaimMapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAgB3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgB/B,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYjC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE9E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAa3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA;AAE1D,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAY,CAAA;AACpF,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAU,CAAA;AAE/E,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAyE,CAAA;AAElJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAAY,GAAG,IAazF,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAgBlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,YAAa,YAAY,KAAG,MAAM,EAmCzE,CAAA"}

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts

@@ -0,0 +1,30 @@
+import { ClaimMapping, ClaimMappingVariable, ClaimValueSource } from './ClaimMapping.js';
+export type MappedMembership = {
+    readonly project: string;
+    readonly role: string;
+    readonly variables: readonly {
+        readonly name: string;
+        readonly values: readonly string[];
+    }[];
+};
+/**
+ * Evaluate every rule of a claim mapping against the claims of an IdP response and collect the union
+ * of granted project memberships (keyed implicitly by (project, role)). Pure: no DB, no side effects —
+ * the caller decides how to apply the result (and whether to add-only or replace, per `unmatched`).
+ */
+export declare const evaluateClaimMapping: (mapping: ClaimMapping, claims: Record<string, unknown>) => MappedMembership[];
+/**
+ * Resolve a membership variable to its final string values: constant `values` (always kept) unioned
+ * with values derived from `from` (extracted from the claims, then mapped / passed through / allow-
+ * filtered). Pure; an empty result simply means the variable is not applied — `IDPClaimSyncService`
+ * drops empty-valued variables so an empty `set` never soft-deletes the membership.
+ */
+export declare const resolveVariableValues: (variable: ClaimMappingVariable, claims: Record<string, unknown>) => string[];
+/**
+ * Extract a flat, de-duplicated list of string values from a single claim per a {@link ClaimValueSource}:
+ * resolves the (possibly nested) claim, normalises scalar/array, optionally filters + projects an
+ * array of objects (`where` / `pick`), and optionally splits a delimited string (`split`). Non-scalar
+ * leaves (objects, null/undefined) are skipped; finite numbers are coerced to their string form.
+ */
+export declare const extractClaimValues: (source: ClaimValueSource, claims: Record<string, unknown>) => string[];
+//# sourceMappingURL=ClaimMappingEvaluator.d.ts.map

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingEvaluator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingEvaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4C,oBAAoB,EAAE,gBAAgB,EAAY,MAAM,mBAAmB,CAAA;AAE5I,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAC5F,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,YAAa,YAAY,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,gBAAgB,EAkB7G,CAAA;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAAc,oBAAoB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAoB7G,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,gBAAgB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EA8BpG,CAAA"}

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts

@@ -0,0 +1,55 @@
+import { Acl } from '@contember/schema';
+import { ClaimMappingMembership } from './ClaimMapping.js';
+/**
+ * Why a granted membership in an A09 claim mapping is invalid against a project's live ACL schema.
+ * Shared by config-time validation ({@link validateClaimMappingMembership} via
+ * `IDPManager.assertValidClaimMapping`, which rejects the whole IdP config) and the apply-time backstop
+ * (`IDPClaimSyncService`, which drops the unsafe grant), so the per-membership ACL validation can never
+ * drift between the two. NOTE this shared check is ONLY the per-membership ACL validation; the rule-shape
+ * checks (`findClaimMappingShapeErrors`) and the removed-key check (`findRemovedRuleKeys`, e.g. `grantRoles`)
+ * run at config time only — the apply-time backstop deliberately re-checks just the ACL safety of each
+ * grant, not the mapping's overall shape (a malformed shape can only arrive via an out-of-band JSONB edit
+ * that bypassed config validation; `evaluateClaimMapping` then honours whatever shape it finds).
+ */
+export declare enum ClaimMappingMembershipErrorType {
+    /** The granted role is not defined in the project ACL. */
+    roleNotFound = "roleNotFound",
+    /** A membership variable is not defined for the granted role. */
+    variableNotFound = "variableNotFound",
+    /** A predefined variable (identityID / personID) cannot be set — the runtime binds it to the signed-in identity. */
+    predefinedVariable = "predefinedVariable",
+    /**
+     * A claim-derived (`from`) value would be written into a `condition` ACL variable without being bounded
+     * by an `allow` allowlist (or with `passthrough`). A condition variable's stored value is parsed as a
+     * row-level ACL condition at every content request, so this is an arbitrary-condition injection vector.
+     */
+    conditionInjection = "conditionInjection",
+    /** A configured value targeting a `condition` variable is not a parseable ACL condition (it would deny at content time). */
+    conditionValueInvalid = "conditionValueInvalid"
+}
+export interface ClaimMappingMembershipError {
+    readonly type: ClaimMappingMembershipErrorType;
+    readonly message: string;
+}
+/**
+ * Validate one A09 granted membership against a project's live ACL schema.
+ *
+ * The shared membership-shape checks (role exists, each set variable is defined for the role, a
+ * predefined variable cannot be set, a `condition` variable's stored value parses as an ACL condition)
+ * are DELEGATED to the very {@link MembershipResolver} the direct add-member path uses — so the IdP path
+ * cannot drift from it. Only the resolver's `VARIABLE_EMPTY` is excluded: A09 grants are *partial* (a
+ * rule sets only some of a role's variables), which is legitimate here but `VARIABLE_EMPTY` to the
+ * resolver. On top of the shared checks A09 adds one claim-aware guard the resolver cannot know about —
+ * the condition-injection guard (a claim-derived value must not flow unbounded into a `condition`
+ * variable). See {@link ClaimMappingMembershipErrorType}.
+ *
+ * Returns every problem found (empty array = valid). The caller decides the consequence: config-time
+ * validation throws on the first error (rejecting the whole IdP config), while the apply-time backstop
+ * (`IDPClaimSyncService`) drops any grant that produces an error.
+ *
+ * Role / variable lookups are own-property only, so a name like `constructor` / `toString` cannot
+ * resolve to an inherited Object.prototype member and pass as defined (the resolver and
+ * `getRoleVariables` are likewise own-property guarded).
+ */
+export declare const validateClaimMappingMembership: (acl: Acl.Schema, membership: ClaimMappingMembership) => ClaimMappingMembershipError[];
+//# sourceMappingURL=ClaimMappingValidation.d.ts.map

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingValidation.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,OAAO,EAAE,sBAAsB,EAAwB,MAAM,mBAAmB,CAAA;AAEhF;;;;;;;;;;GAUG;AACH,oBAAY,+BAA+B;IAC1C,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,iEAAiE;IACjE,gBAAgB,qBAAqB;IACrC,oHAAoH;IACpH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC,4HAA4H;IAC5H,qBAAqB,0BAA0B;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,8BAA8B,QAAS,GAAG,CAAC,MAAM,cAAc,sBAAsB,KAAG,2BAA2B,EA0C/H,CAAA"}