@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts

@@ -7,6 +7,24 @@ import { VerifyResult } from './ApiKeyManager.js';
  * though no row exists in the `identity` table.
  */
 export declare const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+/**
+ * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the
+ * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in
+ * memory, so the surface it opens is fixed by this file rather than by whatever token an operator
+ * happened to configure.
+ */
+export declare const UNPERSISTED_LOGIN_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000002";
+/**
+ * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.
+ * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.
+ */
+export declare const isUnpersistedIdentityId: (identityId: string | undefined) => boolean;
+/**
+ * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to
+ * present: the surface is reached by being routed there, so nothing is compared and nothing is read
+ * from the database.
+ */
+export declare const createUnpersistedLoginVerifyResult: () => VerifyResult;
 export interface UnpersistedApiKey {
     readonly tokenHash: TokenHash;
     readonly identityId: string;

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAE1C,OAAO,GAAE,SAAS,iBAAiB,EAAO;IAItD,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IA0B1C,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB;IAQhE;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB;CAoB5B"}
+{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,yCAAyC,CAAA;AAInF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,eAAgB,MAAM,GAAG,SAAS,KAAG,OAA6E,CAAA;AAEtJ;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAO,YAC0D,CAAA;AAEhH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IAEtD,YAAY,OAAO,GAAE,SAAS,iBAAiB,EAAO,EAErD;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAwBzC;IAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB,CAM/D;IAED;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB,CAmB3B;CACD"}

package/dist/types/model/service/captcha/CaptchaValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;IAG/E,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO;IAIhD;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO;IAI/E;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAc7C,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;CAkB9D"}
+{"version":3,"file":"CaptchaValidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,eAAe,IAAI,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAElF,oFAAoF;AACpF,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,eAAe,GAAG,kBAAkB,GAAG,mBAAmB,CAAA;AAExG,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;CACvD;AAED,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,EAC3E;IAEJ,8EAA8E;IACvE,SAAS,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE/C;IAED;;;;OAIG;IACI,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAE9E;IAED;;;OAGG;IACI,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAYlD;IAEK,MAAM,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,aAAa,CAAA;QACrB,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;QAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;KACjB,GAAG,OAAO,CAAC,mBAAmB,GAAG;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC,CAiB7D;CACD"}

package/dist/types/model/service/captcha/HCaptchaProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAqB1F"}
+{"version":3,"file":"HCaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/HCaptchaProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG,iEAAiE;AACjE,qBAAa,gBAAiB,YAAW,sBAAsB;IAE7D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0C,EACpD,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAoBzF;CACD"}

package/dist/types/model/service/captcha/RecaptchaV3Provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA0BrG"}
+{"version":3,"file":"RecaptchaV3Provider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/RecaptchaV3Provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIrG;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,sBAAsB;IAEhE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAA0D,EACpE,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAyBpG;CACD"}

package/dist/types/model/service/captcha/TurnstileProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBADT,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa;IAG3C,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAyB1F"}
+{"version":3,"file":"TurnstileProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/TurnstileProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAErG;;;GAGG;AACH,qBAAa,iBAAkB,YAAW,sBAAsB;IAE9D,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,QAAQ,GAAE,MAAoE,EAC9E,SAAS,GAAE,OAAO,KAAa,EAC7C;IAEE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwBzF;CACD"}

package/dist/types/model/service/helpers/getPreferredProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,EAAE,EAAE,sBAAsB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}
+{"version":3,"file":"getPreferredProject.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/getPreferredProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,eAAO,MAAM,mBAAmB,aAAc,OAAO,EAAE,wBAAwB,MAAM,GAAG,IAAI,KAAG,OAAO,GAAG,IAQxG,CAAA"}

package/dist/types/model/service/helpers/isPasswordlessEnabled.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,GAAI,aAAa,YAAY,EAAE,aAAa,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}
+{"version":3,"file":"isPasswordlessEnabled.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/helpers/isPasswordlessEnabled.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAEvD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,gBAAiB,YAAY,eAAe,OAAO,GAAG,IAAI,KAAG,OAW9F,CAAA"}

package/dist/types/model/service/idp/BackchannelLogoutManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,kBAAkB;IAG3C,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;YAuChG,qBAAqB;YAerB,KAAK;CAoCnB"}
+{"version":3,"file":"BackchannelLogoutManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/BackchannelLogoutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAOtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAG5D,MAAM,MAAM,uBAAuB,GAChC;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,oBAAoB,CAAA;CAAE,GAChC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAD7B,YACkB,WAAW,EAAE,kBAAkB,EAC7C;IAEE,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqC7G;YAEa,qBAAqB;YAerB,KAAK;CAoCnB"}

package/dist/types/model/service/idp/ClaimMapping.d.ts

@@ -0,0 +1,330 @@
+import * as Typesafe from '@contember/typesafe';
+/**
+ * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).
+ * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing
+ * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`
+ * already accept an opaque configuration object.
+ *
+ * The mapping grants **project memberships only** (a project role plus optional membership
+ * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing
+ * and granting them from external claims would be a privilege-escalation path, so global-role
+ * mapping was dropped. A project membership stays within what the IdP configurer
+ * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.
+ *
+ * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated
+ * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only
+ * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}
+ * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.
+ *
+ * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,
+ * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project
+ * membership. Rules are independent and additive — every matching rule contributes; a
+ * non-matching rule is simply skipped.
+ *
+ * Matching is declarative, never code:
+ * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one
+ *                of the elements).
+ * - `contains` — the claim contains the value: substring for string claims, membership for array
+ *                claims. This is the natural fit for multi-valued `groups`.
+ * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).
+ */
+/**
+ * Where a membership variable's values come from when they are not constant. Reads one `claim` from the
+ * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path
+ * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:
+ * - array claim       → its elements (`languages: ['cs','en']`)
+ * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements
+ * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their
+ *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)
+ *
+ * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.
+ */
+export declare const ClaimValueSource: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly split?: string | undefined;
+        readonly pick?: string | undefined;
+        readonly where?: {
+            readonly field: string;
+            readonly equals: Typesafe.Scalar;
+        } | undefined;
+    }>;
+};
+export type ClaimValueSource = ReturnType<typeof ClaimValueSource>;
+/**
+ * One membership variable to set on a granted membership. Either constant (`values`), claim-derived
+ * (`from`), or both — the two sets are unioned. When derived from a claim:
+ * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.
+ *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…
+ * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by
+ *                   default: raw external claim values then flow straight into row-level ACL
+ *                   variables, so enable it only when the variable legitimately holds claim values
+ *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.
+ * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).
+ */
+export declare const ClaimMappingVariable: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly name: string;
+    } & {
+        readonly values?: readonly string[] | undefined;
+        readonly from?: ({
+            readonly claim: string;
+        } & {
+            readonly split?: string | undefined;
+            readonly pick?: string | undefined;
+            readonly where?: {
+                readonly field: string;
+                readonly equals: Typesafe.Scalar;
+            } | undefined;
+        }) | undefined;
+        readonly map?: {
+            readonly [x: string]: readonly string[];
+        } | undefined;
+        readonly passthrough?: boolean | undefined;
+        readonly allow?: readonly string[] | undefined;
+    }>;
+};
+export type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>;
+export declare const ClaimMappingMembership: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly project: string;
+        readonly role: string;
+    } & {
+        readonly variables?: readonly ({
+            readonly name: string;
+        } & {
+            readonly values?: readonly string[] | undefined;
+            readonly from?: ({
+                readonly claim: string;
+            } & {
+                readonly split?: string | undefined;
+                readonly pick?: string | undefined;
+                readonly where?: {
+                    readonly field: string;
+                    readonly equals: Typesafe.Scalar;
+                } | undefined;
+            }) | undefined;
+            readonly map?: {
+                readonly [x: string]: readonly string[];
+            } | undefined;
+            readonly passthrough?: boolean | undefined;
+            readonly allow?: readonly string[] | undefined;
+        })[] | undefined;
+    }>;
+};
+export type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>;
+export declare const ClaimMappingRule: {
+    (input: unknown, path?: PropertyKey[]): {
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    };
+    inner: Typesafe.Type<{
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    }>;
+};
+export type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>;
+/**
+ * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a
+ * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only
+ * `claimMapping` is treated as "no role mapping", not an error).
+ */
+export declare const ClaimMapping: Typesafe.Type<{
+    readonly rules: readonly ({
+        readonly claim: string;
+    } & {
+        readonly equals?: Typesafe.Scalar | undefined;
+        readonly contains?: Typesafe.Scalar | undefined;
+        readonly grantMembership?: ({
+            readonly project: string;
+            readonly role: string;
+        } & {
+            readonly variables?: readonly ({
+                readonly name: string;
+            } & {
+                readonly values?: readonly string[] | undefined;
+                readonly from?: ({
+                    readonly claim: string;
+                } & {
+                    readonly split?: string | undefined;
+                    readonly pick?: string | undefined;
+                    readonly where?: {
+                        readonly field: string;
+                        readonly equals: Typesafe.Scalar;
+                    } | undefined;
+                }) | undefined;
+                readonly map?: {
+                    readonly [x: string]: readonly string[];
+                } | undefined;
+                readonly passthrough?: boolean | undefined;
+                readonly allow?: readonly string[] | undefined;
+            })[] | undefined;
+        }) | undefined;
+    })[];
+} & {
+    readonly syncPolicy?: "always" | "sticky" | undefined;
+    readonly unmatched?: "keep" | "remove" | undefined;
+}>;
+export type ClaimMapping = ReturnType<typeof ClaimMapping>;
+export declare const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']>;
+export declare const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']>;
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+/**
+ * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no
+ * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no
+ * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both
+ * the pre-A09 sign-in path and the OIDC remap untouched.
+ *
+ * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the
+ * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via
+ * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required
+ * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.
+ *
+ * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in
+ * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is
+ * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a
+ * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object
+ * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/
+ * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)
+ * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap
+ * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),
+ * not a strict object. The removed `grantRoles` key is still caught separately by
+ * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic
+ * extra-property error `noExtraProps` would otherwise raise.
+ */
+export declare const parseClaimMapping: (configuration: Record<string, unknown>) => ClaimMapping | null;
+/**
+ * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,
+ * so config-time validation can reject them with a clear message pointing at `grantMembership`.
+ */
+export declare const findRemovedRuleKeys: (configuration: Record<string, unknown>) => string[];
+/**
+ * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one
+ * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a
+ * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:
+ * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`
+ *   when both are set, so the other would be silently ignored);
+ * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY
+ *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the
+ *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;
+ * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*
+ *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during
+ *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,
+ *   which the `partial` schema permits.)
+ * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there
+ *   is nothing to project, so the source can only ever resolve to no values;
+ * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value
+ *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).
+ */
+export declare const findClaimMappingShapeErrors: (mapping: ClaimMapping) => string[];
+//# sourceMappingURL=ClaimMapping.d.ts.map

package/dist/types/model/service/idp/ClaimMapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMapping.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CAgB3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgB/B,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAE1E,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAYjC,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,UAAU,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE9E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAa3B,CAAA;AAEF,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAElE;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAA;AAE1D,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAY,CAAA;AACpF,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAU,CAAA;AAE/E,eAAO,MAAM,QAAQ,UAAW,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAyE,CAAA;AAElJ;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,iBAAiB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,YAAY,GAAG,IAazF,CAAA;AASD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,kBAAmB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAgBlF,CAAA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B,YAAa,YAAY,KAAG,MAAM,EAmCzE,CAAA"}

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts

@@ -0,0 +1,30 @@
+import { ClaimMapping, ClaimMappingVariable, ClaimValueSource } from './ClaimMapping.js';
+export type MappedMembership = {
+    readonly project: string;
+    readonly role: string;
+    readonly variables: readonly {
+        readonly name: string;
+        readonly values: readonly string[];
+    }[];
+};
+/**
+ * Evaluate every rule of a claim mapping against the claims of an IdP response and collect the union
+ * of granted project memberships (keyed implicitly by (project, role)). Pure: no DB, no side effects —
+ * the caller decides how to apply the result (and whether to add-only or replace, per `unmatched`).
+ */
+export declare const evaluateClaimMapping: (mapping: ClaimMapping, claims: Record<string, unknown>) => MappedMembership[];
+/**
+ * Resolve a membership variable to its final string values: constant `values` (always kept) unioned
+ * with values derived from `from` (extracted from the claims, then mapped / passed through / allow-
+ * filtered). Pure; an empty result simply means the variable is not applied — `IDPClaimSyncService`
+ * drops empty-valued variables so an empty `set` never soft-deletes the membership.
+ */
+export declare const resolveVariableValues: (variable: ClaimMappingVariable, claims: Record<string, unknown>) => string[];
+/**
+ * Extract a flat, de-duplicated list of string values from a single claim per a {@link ClaimValueSource}:
+ * resolves the (possibly nested) claim, normalises scalar/array, optionally filters + projects an
+ * array of objects (`where` / `pick`), and optionally splits a delimited string (`split`). Non-scalar
+ * leaves (objects, null/undefined) are skipped; finite numbers are coerced to their string form.
+ */
+export declare const extractClaimValues: (source: ClaimValueSource, claims: Record<string, unknown>) => string[];
+//# sourceMappingURL=ClaimMappingEvaluator.d.ts.map

package/dist/types/model/service/idp/ClaimMappingEvaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingEvaluator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingEvaluator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4C,oBAAoB,EAAE,gBAAgB,EAAY,MAAM,mBAAmB,CAAA;AAE5I,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;CAC5F,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,YAAa,YAAY,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,gBAAgB,EAkB7G,CAAA;AA8CD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,aAAc,oBAAoB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EAoB7G,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,gBAAgB,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,EA8BpG,CAAA"}

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts

@@ -0,0 +1,55 @@
+import { Acl } from '@contember/schema';
+import { ClaimMappingMembership } from './ClaimMapping.js';
+/**
+ * Why a granted membership in an A09 claim mapping is invalid against a project's live ACL schema.
+ * Shared by config-time validation ({@link validateClaimMappingMembership} via
+ * `IDPManager.assertValidClaimMapping`, which rejects the whole IdP config) and the apply-time backstop
+ * (`IDPClaimSyncService`, which drops the unsafe grant), so the per-membership ACL validation can never
+ * drift between the two. NOTE this shared check is ONLY the per-membership ACL validation; the rule-shape
+ * checks (`findClaimMappingShapeErrors`) and the removed-key check (`findRemovedRuleKeys`, e.g. `grantRoles`)
+ * run at config time only — the apply-time backstop deliberately re-checks just the ACL safety of each
+ * grant, not the mapping's overall shape (a malformed shape can only arrive via an out-of-band JSONB edit
+ * that bypassed config validation; `evaluateClaimMapping` then honours whatever shape it finds).
+ */
+export declare enum ClaimMappingMembershipErrorType {
+    /** The granted role is not defined in the project ACL. */
+    roleNotFound = "roleNotFound",
+    /** A membership variable is not defined for the granted role. */
+    variableNotFound = "variableNotFound",
+    /** A predefined variable (identityID / personID) cannot be set — the runtime binds it to the signed-in identity. */
+    predefinedVariable = "predefinedVariable",
+    /**
+     * A claim-derived (`from`) value would be written into a `condition` ACL variable without being bounded
+     * by an `allow` allowlist (or with `passthrough`). A condition variable's stored value is parsed as a
+     * row-level ACL condition at every content request, so this is an arbitrary-condition injection vector.
+     */
+    conditionInjection = "conditionInjection",
+    /** A configured value targeting a `condition` variable is not a parseable ACL condition (it would deny at content time). */
+    conditionValueInvalid = "conditionValueInvalid"
+}
+export interface ClaimMappingMembershipError {
+    readonly type: ClaimMappingMembershipErrorType;
+    readonly message: string;
+}
+/**
+ * Validate one A09 granted membership against a project's live ACL schema.
+ *
+ * The shared membership-shape checks (role exists, each set variable is defined for the role, a
+ * predefined variable cannot be set, a `condition` variable's stored value parses as an ACL condition)
+ * are DELEGATED to the very {@link MembershipResolver} the direct add-member path uses — so the IdP path
+ * cannot drift from it. Only the resolver's `VARIABLE_EMPTY` is excluded: A09 grants are *partial* (a
+ * rule sets only some of a role's variables), which is legitimate here but `VARIABLE_EMPTY` to the
+ * resolver. On top of the shared checks A09 adds one claim-aware guard the resolver cannot know about —
+ * the condition-injection guard (a claim-derived value must not flow unbounded into a `condition`
+ * variable). See {@link ClaimMappingMembershipErrorType}.
+ *
+ * Returns every problem found (empty array = valid). The caller decides the consequence: config-time
+ * validation throws on the first error (rejecting the whole IdP config), while the apply-time backstop
+ * (`IDPClaimSyncService`) drops any grant that produces an error.
+ *
+ * Role / variable lookups are own-property only, so a name like `constructor` / `toString` cannot
+ * resolve to an inherited Object.prototype member and pass as defined (the resolver and
+ * `getRoleVariables` are likewise own-property guarded).
+ */
+export declare const validateClaimMappingMembership: (acl: Acl.Schema, membership: ClaimMappingMembership) => ClaimMappingMembershipError[];
+//# sourceMappingURL=ClaimMappingValidation.d.ts.map

package/dist/types/model/service/idp/ClaimMappingValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingValidation.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/ClaimMappingValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,OAAO,EAAE,sBAAsB,EAAwB,MAAM,mBAAmB,CAAA;AAEhF;;;;;;;;;;GAUG;AACH,oBAAY,+BAA+B;IAC1C,0DAA0D;IAC1D,YAAY,iBAAiB;IAC7B,iEAAiE;IACjE,gBAAgB,qBAAqB;IACrC,oHAAoH;IACpH,kBAAkB,uBAAuB;IACzC;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC,4HAA4H;IAC5H,qBAAqB,0BAA0B;CAC/C;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,+BAA+B,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,8BAA8B,QAAS,GAAG,CAAC,MAAM,cAAc,sBAAsB,KAAG,2BAA2B,EA0C/H,CAAA"}

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts

@@ -0,0 +1,113 @@
+import { DatabaseContext } from '../../utils/index.js';
+import { ClaimMapping } from './ClaimMapping.js';
+import { MappedMembership } from './ClaimMappingEvaluator.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
+export type ClaimMappingSnapshot = {
+    readonly memberships: readonly MappedMembership[];
+};
+export type ClaimMappingAudit = {
+    readonly before: ClaimMappingSnapshot;
+    readonly after: ClaimMappingSnapshot;
+    readonly syncPolicy: NonNullable<ClaimMapping['syncPolicy']>;
+    readonly unmatched: NonNullable<ClaimMapping['unmatched']>;
+};
+export type ClaimMappingSyncResult = {
+    /** Membership before/after delta — present only when the apply actually changed grants. */
+    readonly audit: ClaimMappingAudit | null;
+    /** True when the apply-time safety backstop dropped one or more configured rules (a fail-open marker for the caller's audit). */
+    readonly droppedUnsafeRules: boolean;
+};
+/**
+ * Applies an IdP's `claimMapping` (A09) after a person has been resolved: evaluates the declarative
+ * rules against the IdP claims and grants the resulting project memberships, honouring the per-IdP
+ * `syncPolicy` (`always` vs `sticky`) and `unmatched` (`keep` vs `remove`) settings. The mapping
+ * grants project memberships only — never global/tenant roles (see {@link ClaimMapping}).
+ *
+ * Runs at sign-in (inside the sign-in transaction) and, for `always` mappings, again on each OIDC
+ * session refresh (see `IdpSessionRevalidator`). Returns a {@link ClaimMappingSyncResult}: an
+ * `{ before, after }` audit delta (`null` when nothing changed) plus `droppedUnsafeRules` (true when the
+ * apply-time safety backstop dropped a configured rule). The caller emits the `idp_role_mapped` audit
+ * from the delta and the `idp_role_mapping_failed` fail-open marker from `droppedUnsafeRules` — audit
+ * lives at the caller layer, never here.
+ *
+ * The caller parses the mapping (via {@link parseClaimMapping}) and decides the fail-open policy: a
+ * malformed config is caught by the caller before this runs, while a DB error raised here propagates
+ * so the surrounding transaction rolls back the partial apply (no half-applied grants).
+ */
+export declare class IDPClaimSyncService {
+    private readonly projectSchemaResolver;
+    constructor(projectSchemaResolver: ProjectSchemaResolver);
+    sync(db: DatabaseContext, mapping: ClaimMapping, claims: Record<string, unknown>, identity: {
+        id: string;
+    }, isNewPerson: boolean, options?: {
+        allowRemoval?: boolean;
+    }): Promise<ClaimMappingSyncResult>;
+    /**
+     * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+     * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+     * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+     * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+     * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+     * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+     *
+     * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+     * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+     * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+     * disambiguate via the tenant `project` table:
+     *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+     *     it, so nothing is written). KEEP the rule for when the project is created later.
+     *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+     *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+     *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+     *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+     *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+     *
+     * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+     * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+     */
+    private dropUnsafeRules;
+    /**
+     * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+     * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+     * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+     * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+     * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+     * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+     * missing variable there denies, never escalates).
+     *
+     * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+     * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+     * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+     * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+     * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+     * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+     * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+     * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+     * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+     *
+     * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+     * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+     * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+     * the bare grant is then never written; under `remove` it is absent from the granted set, so
+     * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+     * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+     * `idp_role_mapping_failed` fail-open marker.
+     */
+    private dropUnsafeEvaluatedMemberships;
+    private applyMemberships;
+    /**
+     * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+     * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+     * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+     * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+     * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+     * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+     * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+     * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+     * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+     * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+     * still detected as a change and audited.
+     */
+    private snapshot;
+}
+//# sourceMappingURL=IDPClaimSyncService.d.ts.map

package/dist/types/model/service/idp/IDPClaimSyncService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPClaimSyncService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPClaimSyncService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,YAAY,EAA4D,MAAM,mBAAmB,CAAA;AAC1G,OAAO,EAAwB,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAM3D,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAA;IAC5D,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;CAC1D,CAAA;AAED,MAAM,MAAM,sBAAsB,GAAG;IACpC,2FAA2F;IAC3F,QAAQ,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACxC,iIAAiI;IACjI,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;CACpC,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IADvC,YACkB,qBAAqB,EAAE,qBAAqB,EAE7D;IAEK,IAAI,CACT,EAAE,EAAE,eAAe,EACnB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,WAAW,EAAE,OAAO,EACpB,OAAO,GAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAiEjC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,eAAe;IAgD7B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,OAAO,CAAC,8BAA8B;YAyCxB,gBAAgB;IAkF9B;;;;;;;;;;;;OAYG;YACW,QAAQ;CAuBtB"}

package/dist/types/model/service/idp/IDPHandlerRegistry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI;IAI3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI;IAIlE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"IDPHandlerRegistry.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPHandlerRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AAGtE,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,SAAS,CAAmD;IAE7D,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,uBAAuB,CAAC,GAAG,CAAC,GAAG,IAAI,CAEjF;IAEM,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,GAAG,IAAI,CAExE;IAEM,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAC,CAM3D;CACD"}