@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/service/idp/ClaimMappingEvaluator.js

@@ -0,0 +1,155 @@
+import { isRecord } from "./ClaimMapping.js";
+const evaluateClaimMapping = (mapping, claims) => {
+  const membershipByKey = /* @__PURE__ */ new Map();
+  for (const rule of mapping.rules) {
+    if (!ruleMatches(rule, resolvePath(claims, rule.claim))) {
+      continue;
+    }
+    if (rule.grantMembership) {
+      const membership = toMembership(rule.grantMembership, claims);
+      const key = JSON.stringify([membership.project, membership.role]);
+      const existing = membershipByKey.get(key);
+      membershipByKey.set(key, existing ? mergeMembershipVariables(existing, membership) : membership);
+    }
+  }
+  return [...membershipByKey.values()];
+};
+const toMembership = (membership, claims) => ({
+  project: membership.project,
+  role: membership.role,
+  // Union by name so a single grant that lists the same variable twice (e.g. two `locale` entries)
+  // combines their values into one entry, rather than emitting duplicate entries that would later race
+  // and clobber each other when each is written as a full-replace of the same (membership, variable).
+  variables: unionVariablesByName(
+    (membership.variables ?? []).map((variable) => ({ name: variable.name, values: resolveVariableValues(variable, claims) }))
+  )
+});
+const mergeMembershipVariables = (a, b) => ({
+  project: a.project,
+  role: a.role,
+  variables: unionVariablesByName([...a.variables, ...b.variables])
+});
+const unionVariablesByName = (variables) => {
+  const valuesByName = /* @__PURE__ */ new Map();
+  for (const variable of variables) {
+    const values = valuesByName.get(variable.name) ?? /* @__PURE__ */ new Set();
+    for (const value of variable.values) {
+      values.add(value);
+    }
+    valuesByName.set(variable.name, values);
+  }
+  return [...valuesByName].map(([name, values]) => ({ name, values: [...values].sort() }));
+};
+const resolveVariableValues = (variable, claims) => {
+  const values = new Set(variable.values ?? []);
+  if (variable.from) {
+    const allow = variable.allow ? new Set(variable.allow) : null;
+    for (const raw of extractClaimValues(variable.from, claims)) {
+      const mapped = variable.map && Object.prototype.hasOwnProperty.call(variable.map, raw) ? variable.map[raw] : variable.passthrough ? [raw] : [];
+      for (const value of mapped) {
+        if (!allow || allow.has(value)) {
+          values.add(value);
+        }
+      }
+    }
+  }
+  return [...values];
+};
+const extractClaimValues = (source, claims) => {
+  const resolved = resolvePath(claims, source.claim);
+  const items = Array.isArray(resolved) ? resolved : [resolved];
+  const out = [];
+  for (const item of items) {
+    let value = item;
+    if (source.where !== void 0 || source.pick !== void 0) {
+      if (!isRecord(item)) {
+        continue;
+      }
+      if (source.where && !scalarEquals(resolvePath(item, source.where.field), source.where.equals)) {
+        continue;
+      }
+      value = source.pick !== void 0 ? resolvePath(item, source.pick) : void 0;
+    }
+    if (typeof value === "string" && source.split !== void 0) {
+      for (const part of value.split(source.split)) {
+        const trimmed = part.trim();
+        if (trimmed.length > 0) {
+          out.push(trimmed);
+        }
+      }
+      continue;
+    }
+    const scalar = coerceToString(value);
+    if (scalar !== null) {
+      out.push(scalar);
+    }
+  }
+  return [...new Set(out)];
+};
+const resolvePath = (root, path) => {
+  if (isRecord(root) && Object.prototype.hasOwnProperty.call(root, path)) {
+    return root[path];
+  }
+  let current = root;
+  for (const key of path.split(".")) {
+    if (!isRecord(current) || !Object.prototype.hasOwnProperty.call(current, key)) {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return current;
+};
+const coerceToString = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  return null;
+};
+const ruleMatches = (rule, claimValue) => {
+  if (rule.equals !== void 0) {
+    return matchEquals(claimValue, rule.equals);
+  }
+  if (rule.contains !== void 0) {
+    return matchContains(claimValue, rule.contains);
+  }
+  if (claimValue === void 0 || claimValue === null || claimValue === false || claimValue === "") {
+    return false;
+  }
+  if (Array.isArray(claimValue)) {
+    return claimValue.length > 0;
+  }
+  return true;
+};
+const matchEquals = (claimValue, expected) => {
+  if (Array.isArray(claimValue)) {
+    return claimValue.some((it) => scalarEquals(it, expected));
+  }
+  return scalarEquals(claimValue, expected);
+};
+const matchContains = (claimValue, needle) => {
+  if (needle === "") {
+    return false;
+  }
+  if (Array.isArray(claimValue)) {
+    return claimValue.some((it) => scalarEquals(it, needle));
+  }
+  if (typeof claimValue === "string" && typeof needle === "string") {
+    return claimValue.includes(needle);
+  }
+  return scalarEquals(claimValue, needle);
+};
+const scalarEquals = (value, expected) => {
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) {
+    return value === expected;
+  }
+  return false;
+};
+export {
+  evaluateClaimMapping,
+  extractClaimValues,
+  resolveVariableValues
+};
+//# sourceMappingURL=ClaimMappingEvaluator.js.map

package/dist/development/src/model/service/idp/ClaimMappingEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingEvaluator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMappingEvaluator.ts"],"sourcesContent":["import { ClaimMapping, ClaimMappingMembership, ClaimMappingRule, ClaimMappingVariable, ClaimValueSource, isRecord } from './ClaimMapping.js'\n\nexport type MappedMembership = {\n\treadonly project: string\n\treadonly role: string\n\treadonly variables: readonly { readonly name: string; readonly values: readonly string[] }[]\n}\n\n/**\n * Evaluate every rule of a claim mapping against the claims of an IdP response and collect the union\n * of granted project memberships (keyed implicitly by (project, role)). Pure: no DB, no side effects —\n * the caller decides how to apply the result (and whether to add-only or replace, per `unmatched`).\n */\nexport const evaluateClaimMapping = (mapping: ClaimMapping, claims: Record<string, unknown>): MappedMembership[] => {\n\tconst membershipByKey = new Map<string, MappedMembership>()\n\n\tfor (const rule of mapping.rules) {\n\t\tif (!ruleMatches(rule, resolvePath(claims, rule.claim))) {\n\t\t\tcontinue\n\t\t}\n\t\tif (rule.grantMembership) {\n\t\t\tconst membership = toMembership(rule.grantMembership, claims)\n\t\t\t// JSON-encode the (project, role) pair so the dedup key can't collide on a delimiter that a\n\t\t\t// slug could itself contain (a plain `${project}::${role}` would fold `a::b`/`c` into `a`/`b::c`).\n\t\t\tconst key = JSON.stringify([membership.project, membership.role])\n\t\t\tconst existing = membershipByKey.get(key)\n\t\t\tmembershipByKey.set(key, existing ? mergeMembershipVariables(existing, membership) : membership)\n\t\t}\n\t}\n\n\treturn [...membershipByKey.values()]\n}\n\nconst toMembership = (membership: ClaimMappingMembership, claims: Record<string, unknown>): MappedMembership => ({\n\tproject: membership.project,\n\trole: membership.role,\n\t// Union by name so a single grant that lists the same variable twice (e.g. two `locale` entries)\n\t// combines their values into one entry, rather than emitting duplicate entries that would later race\n\t// and clobber each other when each is written as a full-replace of the same (membership, variable).\n\tvariables: unionVariablesByName(\n\t\t(membership.variables ?? []).map(variable => ({ name: variable.name, values: resolveVariableValues(variable, claims) })),\n\t),\n})\n\n/**\n * Merge two grants of the same (project, role) by unioning their membership variables per name — so\n * several matching rules granting the same membership combine their variables (consistent with how\n * global roles union), rather than the last rule silently overwriting the variables of the earlier ones.\n */\nconst mergeMembershipVariables = (a: MappedMembership, b: MappedMembership): MappedMembership => ({\n\tproject: a.project,\n\trole: a.role,\n\tvariables: unionVariablesByName([...a.variables, ...b.variables]),\n})\n\n/**\n * Union a list of membership variables by name: several entries for the same variable name — whether from\n * one grant listing it twice or from several rules granting the same membership — combine their values into\n * a single entry. Values are de-duplicated and SORTED so the result is canonical: the same effective grant\n * always yields the same value array regardless of claim/rule order. That keeps the persisted JSON stable\n * (no redundant rewrite when an IdP returns a multi-valued claim in a different order across sign-ins) and\n * the audit delta order-insensitive. Variable entries keep first-seen order.\n */\nconst unionVariablesByName = (\n\tvariables: readonly { readonly name: string; readonly values: readonly string[] }[],\n): { name: string; values: string[] }[] => {\n\tconst valuesByName = new Map<string, Set<string>>()\n\tfor (const variable of variables) {\n\t\tconst values = valuesByName.get(variable.name) ?? new Set<string>()\n\t\tfor (const value of variable.values) {\n\t\t\tvalues.add(value)\n\t\t}\n\t\tvaluesByName.set(variable.name, values)\n\t}\n\treturn [...valuesByName].map(([name, values]) => ({ name, values: [...values].sort() }))\n}\n\n/**\n * Resolve a membership variable to its final string values: constant `values` (always kept) unioned\n * with values derived from `from` (extracted from the claims, then mapped / passed through / allow-\n * filtered). Pure; an empty result simply means the variable is not applied — `IDPClaimSyncService`\n * drops empty-valued variables so an empty `set` never soft-deletes the membership.\n */\nexport const resolveVariableValues = (variable: ClaimMappingVariable, claims: Record<string, unknown>): string[] => {\n\tconst values = new Set<string>(variable.values ?? [])\n\tif (variable.from) {\n\t\tconst allow = variable.allow ? new Set(variable.allow) : null\n\t\tfor (const raw of extractClaimValues(variable.from, claims)) {\n\t\t\t// `raw` is an external claim value used as a `map` key — look it up as an OWN property only.\n\t\t\t// A plain `map?.[raw]` would let a hostile claim like `__proto__` / `constructor` resolve to an\n\t\t\t// inherited prototype member (a non-array object/function), which then slips past `?? []` and\n\t\t\t// throws `not iterable` in the loop below — aborting the sign-in transaction.\n\t\t\tconst mapped = variable.map && Object.prototype.hasOwnProperty.call(variable.map, raw)\n\t\t\t\t? variable.map[raw]\n\t\t\t\t: (variable.passthrough ? [raw] : [])\n\t\t\tfor (const value of mapped) {\n\t\t\t\tif (!allow || allow.has(value)) {\n\t\t\t\t\tvalues.add(value)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn [...values]\n}\n\n/**\n * Extract a flat, de-duplicated list of string values from a single claim per a {@link ClaimValueSource}:\n * resolves the (possibly nested) claim, normalises scalar/array, optionally filters + projects an\n * array of objects (`where` / `pick`), and optionally splits a delimited string (`split`). Non-scalar\n * leaves (objects, null/undefined) are skipped; finite numbers are coerced to their string form.\n */\nexport const extractClaimValues = (source: ClaimValueSource, claims: Record<string, unknown>): string[] => {\n\tconst resolved = resolvePath(claims, source.claim)\n\tconst items: unknown[] = Array.isArray(resolved) ? resolved : [resolved]\n\tconst out: string[] = []\n\tfor (const item of items) {\n\t\tlet value: unknown = item\n\t\tif (source.where !== undefined || source.pick !== undefined) {\n\t\t\tif (!isRecord(item)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (source.where && !scalarEquals(resolvePath(item, source.where.field), source.where.equals)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tvalue = source.pick !== undefined ? resolvePath(item, source.pick) : undefined\n\t\t}\n\t\tif (typeof value === 'string' && source.split !== undefined) {\n\t\t\tfor (const part of value.split(source.split)) {\n\t\t\t\tconst trimmed = part.trim()\n\t\t\t\tif (trimmed.length > 0) {\n\t\t\t\t\tout.push(trimmed)\n\t\t\t\t}\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tconst scalar = coerceToString(value)\n\t\tif (scalar !== null) {\n\t\t\tout.push(scalar)\n\t\t}\n\t}\n\treturn [...new Set(out)]\n}\n\n/**\n * Resolve a claim name — a rule's `claim` and a variable's `from.claim` / `pick` / `where.field` all\n * use this same lookup. The EXACT name is tried first, so a claim whose name literally contains dots\n * (URL-namespaced, e.g. Auth0's `https://example.com/roles`) stays addressable and wins over a nested\n * path of the same spelling; only then is the name treated as a dot-path into nested objects\n * (`realm_access.roles`). Own-property only at every step: never descend into inherited members, so a\n * claim object can't surface `Object.prototype` via a `__proto__` segment (and a configured path can't\n * read a prototype member).\n */\nconst resolvePath = (root: unknown, path: string): unknown => {\n\tif (isRecord(root) && Object.prototype.hasOwnProperty.call(root, path)) {\n\t\treturn root[path]\n\t}\n\tlet current: unknown = root\n\tfor (const key of path.split('.')) {\n\t\tif (!isRecord(current) || !Object.prototype.hasOwnProperty.call(current, key)) {\n\t\t\treturn undefined\n\t\t}\n\t\tcurrent = current[key]\n\t}\n\treturn current\n}\n\nconst coerceToString = (value: unknown): string | null => {\n\tif (typeof value === 'string') {\n\t\treturn value\n\t}\n\tif (typeof value === 'number' && Number.isFinite(value)) {\n\t\treturn String(value)\n\t}\n\treturn null\n}\n\nconst ruleMatches = (rule: ClaimMappingRule, claimValue: unknown): boolean => {\n\tif (rule.equals !== undefined) {\n\t\treturn matchEquals(claimValue, rule.equals)\n\t}\n\tif (rule.contains !== undefined) {\n\t\treturn matchContains(claimValue, rule.contains)\n\t}\n\t// No condition: match on mere PRESENCE of a non-empty value. Treated as absent: `undefined` / `null`\n\t// (claim not present), the boolean `false` (a `groups`-style flag only grants when truthy), an empty\n\t// array (e.g. `groups: []` — the user is in no group), and an empty string. \"Presence\" therefore means\n\t// the claim actually carries a value, not merely that the field exists but is empty.\n\tif (claimValue === undefined || claimValue === null || claimValue === false || claimValue === '') {\n\t\treturn false\n\t}\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.length > 0\n\t}\n\treturn true\n}\n\nconst matchEquals = (claimValue: unknown, expected: string | number | boolean | null): boolean => {\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.some(it => scalarEquals(it, expected))\n\t}\n\treturn scalarEquals(claimValue, expected)\n}\n\nconst matchContains = (claimValue: unknown, needle: string | number | boolean | null): boolean => {\n\t// An empty-string needle would substring-match EVERY string claim (`s.includes('') === true`) — a\n\t// match-everyone grant to every user of the IdP. Config-time validation rejects it, but a config planted\n\t// out-of-band (a direct `identity_provider.configuration` JSONB edit) bypasses that guard; refuse it here\n\t// too so the evaluator never honours a degenerate match-everyone rule, regardless of how it arrived (SEC-1).\n\tif (needle === '') {\n\t\treturn false\n\t}\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.some(it => scalarEquals(it, needle))\n\t}\n\tif (typeof claimValue === 'string' && typeof needle === 'string') {\n\t\treturn claimValue.includes(needle)\n\t}\n\treturn scalarEquals(claimValue, needle)\n}\n\nconst scalarEquals = (value: unknown, expected: string | number | boolean | null): boolean => {\n\tif (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' || value === null) {\n\t\treturn value === expected\n\t}\n\treturn false\n}\n"],"names":[],"mappings":";AAaO,MAAM,uBAAuB,CAAC,SAAuB,WAAwD;AACnH,QAAM,sCAAsB,IAAA;AAE5B,aAAW,QAAQ,QAAQ,OAAO;AACjC,QAAI,CAAC,YAAY,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC,GAAG;AACxD;AAAA,IACD;AACA,QAAI,KAAK,iBAAiB;AACzB,YAAM,aAAa,aAAa,KAAK,iBAAiB,MAAM;AAG5D,YAAM,MAAM,KAAK,UAAU,CAAC,WAAW,SAAS,WAAW,IAAI,CAAC;AAChE,YAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,sBAAgB,IAAI,KAAK,WAAW,yBAAyB,UAAU,UAAU,IAAI,UAAU;AAAA,IAChG;AAAA,EACD;AAEA,SAAO,CAAC,GAAG,gBAAgB,QAAQ;AACpC;AAEA,MAAM,eAAe,CAAC,YAAoC,YAAuD;AAAA,EAChH,SAAS,WAAW;AAAA,EACpB,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA,EAIjB,WAAW;AAAA,KACT,WAAW,aAAa,CAAA,GAAI,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,sBAAsB,UAAU,MAAM,IAAI;AAAA,EAAA;AAEzH;AAOA,MAAM,2BAA2B,CAAC,GAAqB,OAA2C;AAAA,EACjG,SAAS,EAAE;AAAA,EACX,MAAM,EAAE;AAAA,EACR,WAAW,qBAAqB,CAAC,GAAG,EAAE,WAAW,GAAG,EAAE,SAAS,CAAC;AACjE;AAUA,MAAM,uBAAuB,CAC5B,cAC0C;AAC1C,QAAM,mCAAmB,IAAA;AACzB,aAAW,YAAY,WAAW;AACjC,UAAM,SAAS,aAAa,IAAI,SAAS,IAAI,yBAAS,IAAA;AACtD,eAAW,SAAS,SAAS,QAAQ;AACpC,aAAO,IAAI,KAAK;AAAA,IACjB;AACA,iBAAa,IAAI,SAAS,MAAM,MAAM;AAAA,EACvC;AACA,SAAO,CAAC,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAA,IAAS;AACxF;AAQO,MAAM,wBAAwB,CAAC,UAAgC,WAA8C;AACnH,QAAM,SAAS,IAAI,IAAY,SAAS,UAAU,CAAA,CAAE;AACpD,MAAI,SAAS,MAAM;AAClB,UAAM,QAAQ,SAAS,QAAQ,IAAI,IAAI,SAAS,KAAK,IAAI;AACzD,eAAW,OAAO,mBAAmB,SAAS,MAAM,MAAM,GAAG;AAK5D,YAAM,SAAS,SAAS,OAAO,OAAO,UAAU,eAAe,KAAK,SAAS,KAAK,GAAG,IAClF,SAAS,IAAI,GAAG,IACf,SAAS,cAAc,CAAC,GAAG,IAAI,CAAA;AACnC,iBAAW,SAAS,QAAQ;AAC3B,YAAI,CAAC,SAAS,MAAM,IAAI,KAAK,GAAG;AAC/B,iBAAO,IAAI,KAAK;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,SAAO,CAAC,GAAG,MAAM;AAClB;AAQO,MAAM,qBAAqB,CAAC,QAA0B,WAA8C;AAC1G,QAAM,WAAW,YAAY,QAAQ,OAAO,KAAK;AACjD,QAAM,QAAmB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AACvE,QAAM,MAAgB,CAAA;AACtB,aAAW,QAAQ,OAAO;AACzB,QAAI,QAAiB;AACrB,QAAI,OAAO,UAAU,UAAa,OAAO,SAAS,QAAW;AAC5D,UAAI,CAAC,SAAS,IAAI,GAAG;AACpB;AAAA,MACD;AACA,UAAI,OAAO,SAAS,CAAC,aAAa,YAAY,MAAM,OAAO,MAAM,KAAK,GAAG,OAAO,MAAM,MAAM,GAAG;AAC9F;AAAA,MACD;AACA,cAAQ,OAAO,SAAS,SAAY,YAAY,MAAM,OAAO,IAAI,IAAI;AAAA,IACtE;AACA,QAAI,OAAO,UAAU,YAAY,OAAO,UAAU,QAAW;AAC5D,iBAAW,QAAQ,MAAM,MAAM,OAAO,KAAK,GAAG;AAC7C,cAAM,UAAU,KAAK,KAAA;AACrB,YAAI,QAAQ,SAAS,GAAG;AACvB,cAAI,KAAK,OAAO;AAAA,QACjB;AAAA,MACD;AACA;AAAA,IACD;AACA,UAAM,SAAS,eAAe,KAAK;AACnC,QAAI,WAAW,MAAM;AACpB,UAAI,KAAK,MAAM;AAAA,IAChB;AAAA,EACD;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACxB;AAWA,MAAM,cAAc,CAAC,MAAe,SAA0B;AAC7D,MAAI,SAAS,IAAI,KAAK,OAAO,UAAU,eAAe,KAAK,MAAM,IAAI,GAAG;AACvE,WAAO,KAAK,IAAI;AAAA,EACjB;AACA,MAAI,UAAmB;AACvB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AAClC,QAAI,CAAC,SAAS,OAAO,KAAK,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG,GAAG;AAC9E,aAAO;AAAA,IACR;AACA,cAAU,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACR;AAEA,MAAM,iBAAiB,CAAC,UAAkC;AACzD,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACxD,WAAO,OAAO,KAAK;AAAA,EACpB;AACA,SAAO;AACR;AAEA,MAAM,cAAc,CAAC,MAAwB,eAAiC;AAC7E,MAAI,KAAK,WAAW,QAAW;AAC9B,WAAO,YAAY,YAAY,KAAK,MAAM;AAAA,EAC3C;AACA,MAAI,KAAK,aAAa,QAAW;AAChC,WAAO,cAAc,YAAY,KAAK,QAAQ;AAAA,EAC/C;AAKA,MAAI,eAAe,UAAa,eAAe,QAAQ,eAAe,SAAS,eAAe,IAAI;AACjG,WAAO;AAAA,EACR;AACA,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,SAAS;AAAA,EAC5B;AACA,SAAO;AACR;AAEA,MAAM,cAAc,CAAC,YAAqB,aAAwD;AACjG,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,KAAK,CAAA,OAAM,aAAa,IAAI,QAAQ,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,YAAY,QAAQ;AACzC;AAEA,MAAM,gBAAgB,CAAC,YAAqB,WAAsD;AAKjG,MAAI,WAAW,IAAI;AAClB,WAAO;AAAA,EACR;AACA,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,KAAK,CAAA,OAAM,aAAa,IAAI,MAAM,CAAC;AAAA,EACtD;AACA,MAAI,OAAO,eAAe,YAAY,OAAO,WAAW,UAAU;AACjE,WAAO,WAAW,SAAS,MAAM;AAAA,EAClC;AACA,SAAO,aAAa,YAAY,MAAM;AACvC;AAEA,MAAM,eAAe,CAAC,OAAgB,aAAwD;AAC7F,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,UAAU,MAAM;AAC3G,WAAO,UAAU;AAAA,EAClB;AACA,SAAO;AACR;"}

package/dist/development/src/model/service/idp/ClaimMappingValidation.cjs

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const schema = require("@contember/schema");
+const schemaUtils = require("@contember/schema-utils");
+var ClaimMappingMembershipErrorType = /* @__PURE__ */ ((ClaimMappingMembershipErrorType2) => {
+  ClaimMappingMembershipErrorType2["roleNotFound"] = "roleNotFound";
+  ClaimMappingMembershipErrorType2["variableNotFound"] = "variableNotFound";
+  ClaimMappingMembershipErrorType2["predefinedVariable"] = "predefinedVariable";
+  ClaimMappingMembershipErrorType2["conditionInjection"] = "conditionInjection";
+  ClaimMappingMembershipErrorType2["conditionValueInvalid"] = "conditionValueInvalid";
+  return ClaimMappingMembershipErrorType2;
+})(ClaimMappingMembershipErrorType || {});
+const validateClaimMappingMembership = (acl, membership) => {
+  const errors = [];
+  const roleExists = Object.prototype.hasOwnProperty.call(acl.roles, membership.role);
+  const roleVariables = roleExists ? schemaUtils.getRoleVariables(membership.role, acl) : {};
+  if (roleExists) {
+    for (const variable of membership.variables ?? []) {
+      const aclVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : void 0;
+      if (aclVariable?.type === schema.Acl.VariableType.condition && variable.from !== void 0 && (variable.passthrough === true || variable.allow === void 0)) {
+        errors.push({
+          type: "conditionInjection",
+          message: `claimMapping variable '${variable.name}' of role '${membership.role}' is a condition variable: a claim-derived value is interpreted as a row-level ACL condition, so it must be constrained by an 'allow' allowlist and must not use 'passthrough'`
+        });
+      }
+    }
+  }
+  const resolverMembership = {
+    role: membership.role,
+    variables: (membership.variables ?? []).map((variable) => ({ name: variable.name, values: staticVariableValues(variable) }))
+  };
+  const result = new schemaUtils.MembershipResolver().resolve(acl, [resolverMembership], schemaUtils.MembershipResolver.UnknownIdentity, false);
+  for (const error of result.errors) {
+    const translated = translateResolverError(error.error, membership, error.variable, roleVariables);
+    if (translated) {
+      errors.push(translated);
+    }
+  }
+  return errors;
+};
+const staticVariableValues = (variable) => [
+  .../* @__PURE__ */ new Set([
+    ...variable.values ?? [],
+    ...Object.values(variable.map ?? {}).flat(),
+    ...variable.allow ?? []
+  ])
+];
+const translateResolverError = (type, membership, variableName, roleVariables) => {
+  const aclVariable = variableName && Object.prototype.hasOwnProperty.call(roleVariables, variableName) ? roleVariables[variableName] : void 0;
+  switch (type) {
+    case schemaUtils.MembershipValidationErrorType.ROLE_NOT_FOUND:
+      return {
+        type: "roleNotFound",
+        message: `claimMapping grants role '${membership.role}' which is not defined in the ACL of project '${membership.project}'`
+      };
+    case schemaUtils.MembershipValidationErrorType.VARIABLE_NOT_FOUND:
+      if (aclVariable?.type === schema.Acl.VariableType.predefined) {
+        return {
+          type: "predefinedVariable",
+          message: `claimMapping cannot set the predefined variable '${variableName}' of role '${membership.role}'`
+        };
+      }
+      return {
+        type: "variableNotFound",
+        message: `claimMapping sets variable '${variableName}' which is not defined for role '${membership.role}' in project '${membership.project}'`
+      };
+    case schemaUtils.MembershipValidationErrorType.VARIABLE_INVALID:
+      if (aclVariable?.type === schema.Acl.VariableType.predefined) {
+        return null;
+      }
+      return {
+        type: "conditionValueInvalid",
+        message: `claimMapping variable '${variableName}' of role '${membership.role}' is a condition variable, but a configured value (a constant, a 'map' output, or an 'allow' entry) is not a valid condition`
+      };
+    case schemaUtils.MembershipValidationErrorType.VARIABLE_EMPTY:
+      return null;
+    default:
+      return null;
+  }
+};
+exports.ClaimMappingMembershipErrorType = ClaimMappingMembershipErrorType;
+exports.validateClaimMappingMembership = validateClaimMappingMembership;
+//# sourceMappingURL=ClaimMappingValidation.cjs.map

package/dist/development/src/model/service/idp/ClaimMappingValidation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingValidation.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMappingValidation.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { getRoleVariables, MembershipResolver, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { ClaimMappingMembership, ClaimMappingVariable } from './ClaimMapping.js'\n\n/**\n * Why a granted membership in an A09 claim mapping is invalid against a project's live ACL schema.\n * Shared by config-time validation ({@link validateClaimMappingMembership} via\n * `IDPManager.assertValidClaimMapping`, which rejects the whole IdP config) and the apply-time backstop\n * (`IDPClaimSyncService`, which drops the unsafe grant), so the per-membership ACL validation can never\n * drift between the two. NOTE this shared check is ONLY the per-membership ACL validation; the rule-shape\n * checks (`findClaimMappingShapeErrors`) and the removed-key check (`findRemovedRuleKeys`, e.g. `grantRoles`)\n * run at config time only — the apply-time backstop deliberately re-checks just the ACL safety of each\n * grant, not the mapping's overall shape (a malformed shape can only arrive via an out-of-band JSONB edit\n * that bypassed config validation; `evaluateClaimMapping` then honours whatever shape it finds).\n */\nexport enum ClaimMappingMembershipErrorType {\n\t/** The granted role is not defined in the project ACL. */\n\troleNotFound = 'roleNotFound',\n\t/** A membership variable is not defined for the granted role. */\n\tvariableNotFound = 'variableNotFound',\n\t/** A predefined variable (identityID / personID) cannot be set — the runtime binds it to the signed-in identity. */\n\tpredefinedVariable = 'predefinedVariable',\n\t/**\n\t * A claim-derived (`from`) value would be written into a `condition` ACL variable without being bounded\n\t * by an `allow` allowlist (or with `passthrough`). A condition variable's stored value is parsed as a\n\t * row-level ACL condition at every content request, so this is an arbitrary-condition injection vector.\n\t */\n\tconditionInjection = 'conditionInjection',\n\t/** A configured value targeting a `condition` variable is not a parseable ACL condition (it would deny at content time). */\n\tconditionValueInvalid = 'conditionValueInvalid',\n}\n\nexport interface ClaimMappingMembershipError {\n\treadonly type: ClaimMappingMembershipErrorType\n\treadonly message: string\n}\n\n/**\n * Validate one A09 granted membership against a project's live ACL schema.\n *\n * The shared membership-shape checks (role exists, each set variable is defined for the role, a\n * predefined variable cannot be set, a `condition` variable's stored value parses as an ACL condition)\n * are DELEGATED to the very {@link MembershipResolver} the direct add-member path uses — so the IdP path\n * cannot drift from it. Only the resolver's `VARIABLE_EMPTY` is excluded: A09 grants are *partial* (a\n * rule sets only some of a role's variables), which is legitimate here but `VARIABLE_EMPTY` to the\n * resolver. On top of the shared checks A09 adds one claim-aware guard the resolver cannot know about —\n * the condition-injection guard (a claim-derived value must not flow unbounded into a `condition`\n * variable). See {@link ClaimMappingMembershipErrorType}.\n *\n * Returns every problem found (empty array = valid). The caller decides the consequence: config-time\n * validation throws on the first error (rejecting the whole IdP config), while the apply-time backstop\n * (`IDPClaimSyncService`) drops any grant that produces an error.\n *\n * Role / variable lookups are own-property only, so a name like `constructor` / `toString` cannot\n * resolve to an inherited Object.prototype member and pass as defined (the resolver and\n * `getRoleVariables` are likewise own-property guarded).\n */\nexport const validateClaimMappingMembership = (acl: Acl.Schema, membership: ClaimMappingMembership): ClaimMappingMembershipError[] => {\n\tconst errors: ClaimMappingMembershipError[] = []\n\tconst roleExists = Object.prototype.hasOwnProperty.call(acl.roles, membership.role)\n\tconst roleVariables = roleExists ? getRoleVariables(membership.role, acl) : {}\n\n\t// A09-specific, claim-aware injection guard — MembershipResolver does not see `from`/`passthrough`/\n\t// `allow`. For a `condition` ACL variable, a claim-derived value is interpreted as a row-level ACL\n\t// condition on every content request, so it must be bounded by an explicit `allow` allowlist and must\n\t// not use `passthrough`. Constant `values` are configurer-controlled (their shape is validated by the\n\t// resolver below). Only checkable when the role resolves; an unknown role is reported as roleNotFound.\n\tif (roleExists) {\n\t\tfor (const variable of membership.variables ?? []) {\n\t\t\tconst aclVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : undefined\n\t\t\tif (\n\t\t\t\taclVariable?.type === Acl.VariableType.condition && variable.from !== undefined && (variable.passthrough === true || variable.allow === undefined)\n\t\t\t) {\n\t\t\t\terrors.push({\n\t\t\t\t\ttype: ClaimMappingMembershipErrorType.conditionInjection,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`claimMapping variable '${variable.name}' of role '${membership.role}' is a condition variable: a claim-derived value is interpreted as a row-level ACL condition, so it must be constrained by an 'allow' allowlist and must not use 'passthrough'`,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t}\n\n\t// Shared shape checks — delegate to MembershipResolver over the configurer-authored STATIC values the\n\t// mapping can deposit into each variable (constants + every `map` output + the `allow` allowlist), so a\n\t// malformed condition in ANY of them is rejected here rather than silently denying (`{ never: true }`)\n\t// on every content request once granted. Raw claim-derived values are unknown at validation time and\n\t// are bounded separately by the injection guard above.\n\tconst resolverMembership: Acl.Membership = {\n\t\trole: membership.role,\n\t\tvariables: (membership.variables ?? []).map(variable => ({ name: variable.name, values: staticVariableValues(variable) })),\n\t}\n\tconst result = new MembershipResolver().resolve(acl, [resolverMembership], MembershipResolver.UnknownIdentity, false)\n\tfor (const error of result.errors) {\n\t\tconst translated = translateResolverError(error.error, membership, error.variable, roleVariables)\n\t\tif (translated) {\n\t\t\terrors.push(translated)\n\t\t}\n\t}\n\treturn errors\n}\n\n/**\n * Every configurer-authored value the mapping could store into a variable: constant `values`, every\n * `map` output, and the `allow` allowlist (raw claim values are excluded — unknown at validation time\n * and bounded by the injection guard). De-duplicated; fed to the resolver so each is shape-checked.\n */\nconst staticVariableValues = (variable: ClaimMappingVariable): string[] => [\n\t...new Set([\n\t\t...(variable.values ?? []),\n\t\t...Object.values(variable.map ?? {}).flat(),\n\t\t...(variable.allow ?? []),\n\t]),\n]\n\nconst translateResolverError = (\n\ttype: MembershipValidationErrorType,\n\tmembership: ClaimMappingMembership,\n\tvariableName: string | undefined,\n\troleVariables: Acl.Variables,\n): ClaimMappingMembershipError | null => {\n\tconst aclVariable = variableName && Object.prototype.hasOwnProperty.call(roleVariables, variableName) ? roleVariables[variableName] : undefined\n\tswitch (type) {\n\t\tcase MembershipValidationErrorType.ROLE_NOT_FOUND:\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.roleNotFound,\n\t\t\t\tmessage: `claimMapping grants role '${membership.role}' which is not defined in the ACL of project '${membership.project}'`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_NOT_FOUND:\n\t\t\t// The resolver reports a (forbidden) predefined variable as VARIABLE_NOT_FOUND when not assumed;\n\t\t\t// surface A09's clearer `predefinedVariable` message when that is the actual cause.\n\t\t\tif (aclVariable?.type === Acl.VariableType.predefined) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: ClaimMappingMembershipErrorType.predefinedVariable,\n\t\t\t\t\tmessage: `claimMapping cannot set the predefined variable '${variableName}' of role '${membership.role}'`,\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.variableNotFound,\n\t\t\t\tmessage: `claimMapping sets variable '${variableName}' which is not defined for role '${membership.role}' in project '${membership.project}'`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_INVALID:\n\t\t\t// A predefined variable can also raise VARIABLE_INVALID (its non-id value) — already reported as\n\t\t\t// predefinedVariable above, so don't double-report it as a bad condition value.\n\t\t\tif (aclVariable?.type === Acl.VariableType.predefined) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.conditionValueInvalid,\n\t\t\t\tmessage:\n\t\t\t\t\t`claimMapping variable '${variableName}' of role '${membership.role}' is a condition variable, but a configured value (a constant, a 'map' output, or an 'allow' entry) is not a valid condition`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_EMPTY:\n\t\t\t// A09 intentionally tolerates partial grants — a rule may set only some of a role's variables.\n\t\t\treturn null\n\t\tdefault:\n\t\t\treturn null\n\t}\n}\n"],"names":["ClaimMappingMembershipErrorType","getRoleVariables","Acl","MembershipResolver","MembershipValidationErrorType"],"mappings":";;;;AAeO,IAAK,oDAAAA,qCAAL;AAENA,mCAAA,cAAA,IAAe;AAEfA,mCAAA,kBAAA,IAAmB;AAEnBA,mCAAA,oBAAA,IAAqB;AAMrBA,mCAAA,oBAAA,IAAqB;AAErBA,mCAAA,uBAAA,IAAwB;AAdb,SAAAA;AAAA,GAAA,mCAAA,CAAA,CAAA;AA0CL,MAAM,iCAAiC,CAAC,KAAiB,eAAsE;AACrI,QAAM,SAAwC,CAAA;AAC9C,QAAM,aAAa,OAAO,UAAU,eAAe,KAAK,IAAI,OAAO,WAAW,IAAI;AAClF,QAAM,gBAAgB,aAAaC,YAAAA,iBAAiB,WAAW,MAAM,GAAG,IAAI,CAAA;AAO5E,MAAI,YAAY;AACf,eAAW,YAAY,WAAW,aAAa,CAAA,GAAI;AAClD,YAAM,cAAc,OAAO,UAAU,eAAe,KAAK,eAAe,SAAS,IAAI,IAAI,cAAc,SAAS,IAAI,IAAI;AACxH,UACC,aAAa,SAASC,OAAAA,IAAI,aAAa,aAAa,SAAS,SAAS,WAAc,SAAS,gBAAgB,QAAQ,SAAS,UAAU,SACvI;AACD,eAAO,KAAK;AAAA,UACX,MAAM;AAAA,UACN,SACC,0BAA0B,SAAS,IAAI,cAAc,WAAW,IAAI;AAAA,QAAA,CACrE;AAAA,MACF;AAAA,IACD;AAAA,EACD;AAOA,QAAM,qBAAqC;AAAA,IAC1C,MAAM,WAAW;AAAA,IACjB,YAAY,WAAW,aAAa,CAAA,GAAI,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,qBAAqB,QAAQ,IAAI;AAAA,EAAA;AAE1H,QAAM,SAAS,IAAIC,+BAAA,EAAqB,QAAQ,KAAK,CAAC,kBAAkB,GAAGA,YAAAA,mBAAmB,iBAAiB,KAAK;AACpH,aAAW,SAAS,OAAO,QAAQ;AAClC,UAAM,aAAa,uBAAuB,MAAM,OAAO,YAAY,MAAM,UAAU,aAAa;AAChG,QAAI,YAAY;AACf,aAAO,KAAK,UAAU;AAAA,IACvB;AAAA,EACD;AACA,SAAO;AACR;AAOA,MAAM,uBAAuB,CAAC,aAA6C;AAAA,EAC1E,uBAAO,IAAI;AAAA,IACV,GAAI,SAAS,UAAU,CAAA;AAAA,IACvB,GAAG,OAAO,OAAO,SAAS,OAAO,CAAA,CAAE,EAAE,KAAA;AAAA,IACrC,GAAI,SAAS,SAAS,CAAA;AAAA,EAAC,CACvB;AACF;AAEA,MAAM,yBAAyB,CAC9B,MACA,YACA,cACA,kBACwC;AACxC,QAAM,cAAc,gBAAgB,OAAO,UAAU,eAAe,KAAK,eAAe,YAAY,IAAI,cAAc,YAAY,IAAI;AACtI,UAAQ,MAAA;AAAA,IACP,KAAKC,YAAAA,8BAA8B;AAClC,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SAAS,6BAA6B,WAAW,IAAI,iDAAiD,WAAW,OAAO;AAAA,MAAA;AAAA,IAE1H,KAAKA,YAAAA,8BAA8B;AAGlC,UAAI,aAAa,SAASF,WAAI,aAAa,YAAY;AACtD,eAAO;AAAA,UACN,MAAM;AAAA,UACN,SAAS,oDAAoD,YAAY,cAAc,WAAW,IAAI;AAAA,QAAA;AAAA,MAExG;AACA,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SAAS,+BAA+B,YAAY,oCAAoC,WAAW,IAAI,iBAAiB,WAAW,OAAO;AAAA,MAAA;AAAA,IAE5I,KAAKE,YAAAA,8BAA8B;AAGlC,UAAI,aAAa,SAASF,WAAI,aAAa,YAAY;AACtD,eAAO;AAAA,MACR;AACA,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SACC,0BAA0B,YAAY,cAAc,WAAW,IAAI;AAAA,MAAA;AAAA,IAEtE,KAAKE,YAAAA,8BAA8B;AAElC,aAAO;AAAA,IACR;AACC,aAAO;AAAA,EAAA;AAEV;;;"}

package/dist/development/src/model/service/idp/ClaimMappingValidation.js

@@ -0,0 +1,83 @@
+import { Acl } from "@contember/schema";
+import { getRoleVariables, MembershipResolver, MembershipValidationErrorType } from "@contember/schema-utils";
+var ClaimMappingMembershipErrorType = /* @__PURE__ */ ((ClaimMappingMembershipErrorType2) => {
+  ClaimMappingMembershipErrorType2["roleNotFound"] = "roleNotFound";
+  ClaimMappingMembershipErrorType2["variableNotFound"] = "variableNotFound";
+  ClaimMappingMembershipErrorType2["predefinedVariable"] = "predefinedVariable";
+  ClaimMappingMembershipErrorType2["conditionInjection"] = "conditionInjection";
+  ClaimMappingMembershipErrorType2["conditionValueInvalid"] = "conditionValueInvalid";
+  return ClaimMappingMembershipErrorType2;
+})(ClaimMappingMembershipErrorType || {});
+const validateClaimMappingMembership = (acl, membership) => {
+  const errors = [];
+  const roleExists = Object.prototype.hasOwnProperty.call(acl.roles, membership.role);
+  const roleVariables = roleExists ? getRoleVariables(membership.role, acl) : {};
+  if (roleExists) {
+    for (const variable of membership.variables ?? []) {
+      const aclVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : void 0;
+      if (aclVariable?.type === Acl.VariableType.condition && variable.from !== void 0 && (variable.passthrough === true || variable.allow === void 0)) {
+        errors.push({
+          type: "conditionInjection",
+          message: `claimMapping variable '${variable.name}' of role '${membership.role}' is a condition variable: a claim-derived value is interpreted as a row-level ACL condition, so it must be constrained by an 'allow' allowlist and must not use 'passthrough'`
+        });
+      }
+    }
+  }
+  const resolverMembership = {
+    role: membership.role,
+    variables: (membership.variables ?? []).map((variable) => ({ name: variable.name, values: staticVariableValues(variable) }))
+  };
+  const result = new MembershipResolver().resolve(acl, [resolverMembership], MembershipResolver.UnknownIdentity, false);
+  for (const error of result.errors) {
+    const translated = translateResolverError(error.error, membership, error.variable, roleVariables);
+    if (translated) {
+      errors.push(translated);
+    }
+  }
+  return errors;
+};
+const staticVariableValues = (variable) => [
+  .../* @__PURE__ */ new Set([
+    ...variable.values ?? [],
+    ...Object.values(variable.map ?? {}).flat(),
+    ...variable.allow ?? []
+  ])
+];
+const translateResolverError = (type, membership, variableName, roleVariables) => {
+  const aclVariable = variableName && Object.prototype.hasOwnProperty.call(roleVariables, variableName) ? roleVariables[variableName] : void 0;
+  switch (type) {
+    case MembershipValidationErrorType.ROLE_NOT_FOUND:
+      return {
+        type: "roleNotFound",
+        message: `claimMapping grants role '${membership.role}' which is not defined in the ACL of project '${membership.project}'`
+      };
+    case MembershipValidationErrorType.VARIABLE_NOT_FOUND:
+      if (aclVariable?.type === Acl.VariableType.predefined) {
+        return {
+          type: "predefinedVariable",
+          message: `claimMapping cannot set the predefined variable '${variableName}' of role '${membership.role}'`
+        };
+      }
+      return {
+        type: "variableNotFound",
+        message: `claimMapping sets variable '${variableName}' which is not defined for role '${membership.role}' in project '${membership.project}'`
+      };
+    case MembershipValidationErrorType.VARIABLE_INVALID:
+      if (aclVariable?.type === Acl.VariableType.predefined) {
+        return null;
+      }
+      return {
+        type: "conditionValueInvalid",
+        message: `claimMapping variable '${variableName}' of role '${membership.role}' is a condition variable, but a configured value (a constant, a 'map' output, or an 'allow' entry) is not a valid condition`
+      };
+    case MembershipValidationErrorType.VARIABLE_EMPTY:
+      return null;
+    default:
+      return null;
+  }
+};
+export {
+  ClaimMappingMembershipErrorType,
+  validateClaimMappingMembership
+};
+//# sourceMappingURL=ClaimMappingValidation.js.map

package/dist/development/src/model/service/idp/ClaimMappingValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingValidation.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMappingValidation.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\nimport { getRoleVariables, MembershipResolver, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { ClaimMappingMembership, ClaimMappingVariable } from './ClaimMapping.js'\n\n/**\n * Why a granted membership in an A09 claim mapping is invalid against a project's live ACL schema.\n * Shared by config-time validation ({@link validateClaimMappingMembership} via\n * `IDPManager.assertValidClaimMapping`, which rejects the whole IdP config) and the apply-time backstop\n * (`IDPClaimSyncService`, which drops the unsafe grant), so the per-membership ACL validation can never\n * drift between the two. NOTE this shared check is ONLY the per-membership ACL validation; the rule-shape\n * checks (`findClaimMappingShapeErrors`) and the removed-key check (`findRemovedRuleKeys`, e.g. `grantRoles`)\n * run at config time only — the apply-time backstop deliberately re-checks just the ACL safety of each\n * grant, not the mapping's overall shape (a malformed shape can only arrive via an out-of-band JSONB edit\n * that bypassed config validation; `evaluateClaimMapping` then honours whatever shape it finds).\n */\nexport enum ClaimMappingMembershipErrorType {\n\t/** The granted role is not defined in the project ACL. */\n\troleNotFound = 'roleNotFound',\n\t/** A membership variable is not defined for the granted role. */\n\tvariableNotFound = 'variableNotFound',\n\t/** A predefined variable (identityID / personID) cannot be set — the runtime binds it to the signed-in identity. */\n\tpredefinedVariable = 'predefinedVariable',\n\t/**\n\t * A claim-derived (`from`) value would be written into a `condition` ACL variable without being bounded\n\t * by an `allow` allowlist (or with `passthrough`). A condition variable's stored value is parsed as a\n\t * row-level ACL condition at every content request, so this is an arbitrary-condition injection vector.\n\t */\n\tconditionInjection = 'conditionInjection',\n\t/** A configured value targeting a `condition` variable is not a parseable ACL condition (it would deny at content time). */\n\tconditionValueInvalid = 'conditionValueInvalid',\n}\n\nexport interface ClaimMappingMembershipError {\n\treadonly type: ClaimMappingMembershipErrorType\n\treadonly message: string\n}\n\n/**\n * Validate one A09 granted membership against a project's live ACL schema.\n *\n * The shared membership-shape checks (role exists, each set variable is defined for the role, a\n * predefined variable cannot be set, a `condition` variable's stored value parses as an ACL condition)\n * are DELEGATED to the very {@link MembershipResolver} the direct add-member path uses — so the IdP path\n * cannot drift from it. Only the resolver's `VARIABLE_EMPTY` is excluded: A09 grants are *partial* (a\n * rule sets only some of a role's variables), which is legitimate here but `VARIABLE_EMPTY` to the\n * resolver. On top of the shared checks A09 adds one claim-aware guard the resolver cannot know about —\n * the condition-injection guard (a claim-derived value must not flow unbounded into a `condition`\n * variable). See {@link ClaimMappingMembershipErrorType}.\n *\n * Returns every problem found (empty array = valid). The caller decides the consequence: config-time\n * validation throws on the first error (rejecting the whole IdP config), while the apply-time backstop\n * (`IDPClaimSyncService`) drops any grant that produces an error.\n *\n * Role / variable lookups are own-property only, so a name like `constructor` / `toString` cannot\n * resolve to an inherited Object.prototype member and pass as defined (the resolver and\n * `getRoleVariables` are likewise own-property guarded).\n */\nexport const validateClaimMappingMembership = (acl: Acl.Schema, membership: ClaimMappingMembership): ClaimMappingMembershipError[] => {\n\tconst errors: ClaimMappingMembershipError[] = []\n\tconst roleExists = Object.prototype.hasOwnProperty.call(acl.roles, membership.role)\n\tconst roleVariables = roleExists ? getRoleVariables(membership.role, acl) : {}\n\n\t// A09-specific, claim-aware injection guard — MembershipResolver does not see `from`/`passthrough`/\n\t// `allow`. For a `condition` ACL variable, a claim-derived value is interpreted as a row-level ACL\n\t// condition on every content request, so it must be bounded by an explicit `allow` allowlist and must\n\t// not use `passthrough`. Constant `values` are configurer-controlled (their shape is validated by the\n\t// resolver below). Only checkable when the role resolves; an unknown role is reported as roleNotFound.\n\tif (roleExists) {\n\t\tfor (const variable of membership.variables ?? []) {\n\t\t\tconst aclVariable = Object.prototype.hasOwnProperty.call(roleVariables, variable.name) ? roleVariables[variable.name] : undefined\n\t\t\tif (\n\t\t\t\taclVariable?.type === Acl.VariableType.condition && variable.from !== undefined && (variable.passthrough === true || variable.allow === undefined)\n\t\t\t) {\n\t\t\t\terrors.push({\n\t\t\t\t\ttype: ClaimMappingMembershipErrorType.conditionInjection,\n\t\t\t\t\tmessage:\n\t\t\t\t\t\t`claimMapping variable '${variable.name}' of role '${membership.role}' is a condition variable: a claim-derived value is interpreted as a row-level ACL condition, so it must be constrained by an 'allow' allowlist and must not use 'passthrough'`,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\t}\n\n\t// Shared shape checks — delegate to MembershipResolver over the configurer-authored STATIC values the\n\t// mapping can deposit into each variable (constants + every `map` output + the `allow` allowlist), so a\n\t// malformed condition in ANY of them is rejected here rather than silently denying (`{ never: true }`)\n\t// on every content request once granted. Raw claim-derived values are unknown at validation time and\n\t// are bounded separately by the injection guard above.\n\tconst resolverMembership: Acl.Membership = {\n\t\trole: membership.role,\n\t\tvariables: (membership.variables ?? []).map(variable => ({ name: variable.name, values: staticVariableValues(variable) })),\n\t}\n\tconst result = new MembershipResolver().resolve(acl, [resolverMembership], MembershipResolver.UnknownIdentity, false)\n\tfor (const error of result.errors) {\n\t\tconst translated = translateResolverError(error.error, membership, error.variable, roleVariables)\n\t\tif (translated) {\n\t\t\terrors.push(translated)\n\t\t}\n\t}\n\treturn errors\n}\n\n/**\n * Every configurer-authored value the mapping could store into a variable: constant `values`, every\n * `map` output, and the `allow` allowlist (raw claim values are excluded — unknown at validation time\n * and bounded by the injection guard). De-duplicated; fed to the resolver so each is shape-checked.\n */\nconst staticVariableValues = (variable: ClaimMappingVariable): string[] => [\n\t...new Set([\n\t\t...(variable.values ?? []),\n\t\t...Object.values(variable.map ?? {}).flat(),\n\t\t...(variable.allow ?? []),\n\t]),\n]\n\nconst translateResolverError = (\n\ttype: MembershipValidationErrorType,\n\tmembership: ClaimMappingMembership,\n\tvariableName: string | undefined,\n\troleVariables: Acl.Variables,\n): ClaimMappingMembershipError | null => {\n\tconst aclVariable = variableName && Object.prototype.hasOwnProperty.call(roleVariables, variableName) ? roleVariables[variableName] : undefined\n\tswitch (type) {\n\t\tcase MembershipValidationErrorType.ROLE_NOT_FOUND:\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.roleNotFound,\n\t\t\t\tmessage: `claimMapping grants role '${membership.role}' which is not defined in the ACL of project '${membership.project}'`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_NOT_FOUND:\n\t\t\t// The resolver reports a (forbidden) predefined variable as VARIABLE_NOT_FOUND when not assumed;\n\t\t\t// surface A09's clearer `predefinedVariable` message when that is the actual cause.\n\t\t\tif (aclVariable?.type === Acl.VariableType.predefined) {\n\t\t\t\treturn {\n\t\t\t\t\ttype: ClaimMappingMembershipErrorType.predefinedVariable,\n\t\t\t\t\tmessage: `claimMapping cannot set the predefined variable '${variableName}' of role '${membership.role}'`,\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.variableNotFound,\n\t\t\t\tmessage: `claimMapping sets variable '${variableName}' which is not defined for role '${membership.role}' in project '${membership.project}'`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_INVALID:\n\t\t\t// A predefined variable can also raise VARIABLE_INVALID (its non-id value) — already reported as\n\t\t\t// predefinedVariable above, so don't double-report it as a bad condition value.\n\t\t\tif (aclVariable?.type === Acl.VariableType.predefined) {\n\t\t\t\treturn null\n\t\t\t}\n\t\t\treturn {\n\t\t\t\ttype: ClaimMappingMembershipErrorType.conditionValueInvalid,\n\t\t\t\tmessage:\n\t\t\t\t\t`claimMapping variable '${variableName}' of role '${membership.role}' is a condition variable, but a configured value (a constant, a 'map' output, or an 'allow' entry) is not a valid condition`,\n\t\t\t}\n\t\tcase MembershipValidationErrorType.VARIABLE_EMPTY:\n\t\t\t// A09 intentionally tolerates partial grants — a rule may set only some of a role's variables.\n\t\t\treturn null\n\t\tdefault:\n\t\t\treturn null\n\t}\n}\n"],"names":["ClaimMappingMembershipErrorType"],"mappings":";;AAeO,IAAK,oDAAAA,qCAAL;AAENA,mCAAA,cAAA,IAAe;AAEfA,mCAAA,kBAAA,IAAmB;AAEnBA,mCAAA,oBAAA,IAAqB;AAMrBA,mCAAA,oBAAA,IAAqB;AAErBA,mCAAA,uBAAA,IAAwB;AAdb,SAAAA;AAAA,GAAA,mCAAA,CAAA,CAAA;AA0CL,MAAM,iCAAiC,CAAC,KAAiB,eAAsE;AACrI,QAAM,SAAwC,CAAA;AAC9C,QAAM,aAAa,OAAO,UAAU,eAAe,KAAK,IAAI,OAAO,WAAW,IAAI;AAClF,QAAM,gBAAgB,aAAa,iBAAiB,WAAW,MAAM,GAAG,IAAI,CAAA;AAO5E,MAAI,YAAY;AACf,eAAW,YAAY,WAAW,aAAa,CAAA,GAAI;AAClD,YAAM,cAAc,OAAO,UAAU,eAAe,KAAK,eAAe,SAAS,IAAI,IAAI,cAAc,SAAS,IAAI,IAAI;AACxH,UACC,aAAa,SAAS,IAAI,aAAa,aAAa,SAAS,SAAS,WAAc,SAAS,gBAAgB,QAAQ,SAAS,UAAU,SACvI;AACD,eAAO,KAAK;AAAA,UACX,MAAM;AAAA,UACN,SACC,0BAA0B,SAAS,IAAI,cAAc,WAAW,IAAI;AAAA,QAAA,CACrE;AAAA,MACF;AAAA,IACD;AAAA,EACD;AAOA,QAAM,qBAAqC;AAAA,IAC1C,MAAM,WAAW;AAAA,IACjB,YAAY,WAAW,aAAa,CAAA,GAAI,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,qBAAqB,QAAQ,IAAI;AAAA,EAAA;AAE1H,QAAM,SAAS,IAAI,mBAAA,EAAqB,QAAQ,KAAK,CAAC,kBAAkB,GAAG,mBAAmB,iBAAiB,KAAK;AACpH,aAAW,SAAS,OAAO,QAAQ;AAClC,UAAM,aAAa,uBAAuB,MAAM,OAAO,YAAY,MAAM,UAAU,aAAa;AAChG,QAAI,YAAY;AACf,aAAO,KAAK,UAAU;AAAA,IACvB;AAAA,EACD;AACA,SAAO;AACR;AAOA,MAAM,uBAAuB,CAAC,aAA6C;AAAA,EAC1E,uBAAO,IAAI;AAAA,IACV,GAAI,SAAS,UAAU,CAAA;AAAA,IACvB,GAAG,OAAO,OAAO,SAAS,OAAO,CAAA,CAAE,EAAE,KAAA;AAAA,IACrC,GAAI,SAAS,SAAS,CAAA;AAAA,EAAC,CACvB;AACF;AAEA,MAAM,yBAAyB,CAC9B,MACA,YACA,cACA,kBACwC;AACxC,QAAM,cAAc,gBAAgB,OAAO,UAAU,eAAe,KAAK,eAAe,YAAY,IAAI,cAAc,YAAY,IAAI;AACtI,UAAQ,MAAA;AAAA,IACP,KAAK,8BAA8B;AAClC,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SAAS,6BAA6B,WAAW,IAAI,iDAAiD,WAAW,OAAO;AAAA,MAAA;AAAA,IAE1H,KAAK,8BAA8B;AAGlC,UAAI,aAAa,SAAS,IAAI,aAAa,YAAY;AACtD,eAAO;AAAA,UACN,MAAM;AAAA,UACN,SAAS,oDAAoD,YAAY,cAAc,WAAW,IAAI;AAAA,QAAA;AAAA,MAExG;AACA,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SAAS,+BAA+B,YAAY,oCAAoC,WAAW,IAAI,iBAAiB,WAAW,OAAO;AAAA,MAAA;AAAA,IAE5I,KAAK,8BAA8B;AAGlC,UAAI,aAAa,SAAS,IAAI,aAAa,YAAY;AACtD,eAAO;AAAA,MACR;AACA,aAAO;AAAA,QACN,MAAM;AAAA,QACN,SACC,0BAA0B,YAAY,cAAc,WAAW,IAAI;AAAA,MAAA;AAAA,IAEtE,KAAK,8BAA8B;AAElC,aAAO;AAAA,IACR;AACC,aAAO;AAAA,EAAA;AAEV;"}