@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/development/src/model/service/idp/IDPClaimSyncService.js

@@ -0,0 +1,260 @@
+import { DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED } from "./ClaimMapping.js";
+import { evaluateClaimMapping } from "./ClaimMappingEvaluator.js";
+import { validateClaimMappingMembership } from "./ClaimMappingValidation.js";
+import { ProjectRole } from "@contember/schema";
+import { MembershipResolver } from "@contember/schema-utils";
+import "../../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../type/ApiKey.js";
+import { ProjectMembershipByIdentityQuery } from "../../queries/membership/ProjectMembershipByIdentityQuery.js";
+import { ProjectBySlugQuery } from "../../queries/project/ProjectBySlugQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/PermissionsFactory.js";
+import "node:crypto";
+import { CreateOrUpdateProjectMembershipCommand } from "../../commands/membership/CreateOrUpdateProjectMembershipCommand.js";
+import { RemoveProjectMembershipCommand } from "../../commands/membership/RemoveProjectMembershipCommand.js";
+class IDPClaimSyncService {
+  constructor(projectSchemaResolver) {
+    this.projectSchemaResolver = projectSchemaResolver;
+  }
+  async sync(db, mapping, claims, identity, isNewPerson, options = {}) {
+    if (mapping.rules.length === 0) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const syncPolicy = mapping.syncPolicy ?? DEFAULT_SYNC_POLICY;
+    const unmatched = options.allowRemoval === false ? "keep" : mapping.unmatched ?? DEFAULT_UNMATCHED;
+    if (syncPolicy === "sticky" && !isNewPerson) {
+      return { audit: null, droppedUnsafeRules: false };
+    }
+    const { safe: rules, dropped, aclByProject } = await this.dropUnsafeRules(db, mapping.rules);
+    const evaluated = evaluateClaimMapping({ ...mapping, rules }, claims);
+    const { safe: memberships, dropped: droppedMemberships } = this.dropUnsafeEvaluatedMemberships(evaluated, aclByProject);
+    const droppedUnsafeRules = dropped.length > 0 || droppedMemberships.length > 0;
+    const vocabularyMemberships = /* @__PURE__ */ new Map();
+    for (const rule of rules) {
+      if (rule.grantMembership) {
+        const roles = vocabularyMemberships.get(rule.grantMembership.project) ?? /* @__PURE__ */ new Set();
+        roles.add(rule.grantMembership.role);
+        vocabularyMemberships.set(rule.grantMembership.project, roles);
+      }
+    }
+    const before = await this.snapshot(db, identity.id, vocabularyMemberships);
+    await this.applyMemberships(db, identity.id, memberships, vocabularyMemberships, unmatched);
+    const after = await this.snapshot(db, identity.id, vocabularyMemberships);
+    if (snapshotEquals(before, after)) {
+      return { audit: null, droppedUnsafeRules };
+    }
+    return { audit: { before, after, syncPolicy, unmatched }, droppedUnsafeRules };
+  }
+  /**
+   * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule
+   * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL
+   * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed
+   * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot
+   * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per
+   * project. The dropped set is returned so the caller can emit a fail-open audit marker.
+   *
+   * When `getSchema` returns no ACL it does NOT mean "the project does not exist": it returns undefined both
+   * for a project that has no row yet AND for one whose row exists but whose container / content schema is
+   * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we
+   * disambiguate via the tenant `project` table:
+   *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips
+   *     it, so nothing is written). KEEP the rule for when the project is created later.
+   *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership
+   *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an
+   *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could
+   *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This
+   *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.
+   *
+   * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop
+   * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.
+   */
+  async dropUnsafeRules(db, rules) {
+    const aclByProject = /* @__PURE__ */ new Map();
+    const projectExistsBySlug = /* @__PURE__ */ new Map();
+    const safe = [];
+    const dropped = [];
+    for (const rule of rules) {
+      const membership = rule.grantMembership;
+      if (!membership) {
+        safe.push(rule);
+        continue;
+      }
+      if (!aclByProject.has(membership.project)) {
+        const schema = await this.projectSchemaResolver.getSchema(membership.project);
+        aclByProject.set(membership.project, schema?.acl ?? null);
+      }
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (acl === null) {
+        if (!projectExistsBySlug.has(membership.project)) {
+          const project = await db.queryHandler.fetch(new ProjectBySlugQuery(membership.project));
+          projectExistsBySlug.set(membership.project, project != null);
+        }
+        if (projectExistsBySlug.get(membership.project)) {
+          dropped.push(rule);
+        } else {
+          safe.push(rule);
+        }
+        continue;
+      }
+      let unsafe;
+      try {
+        unsafe = validateClaimMappingMembership(acl, membership).length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(rule);
+      } else {
+        safe.push(rule);
+      }
+    }
+    return { safe, dropped, aclByProject };
+  }
+  /**
+   * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`
+   * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing
+   * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's
+   * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just
+   * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,
+   * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a
+   * missing variable there denies, never escalates).
+   *
+   * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the
+   * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity
+   * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the
+   * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves
+   * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`
+   * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a
+   * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would
+   * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization
+   * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)
+   *
+   * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty
+   * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver
+   * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`
+   * the bare grant is then never written; under `remove` it is absent from the granted set, so
+   * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial
+   * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the
+   * `idp_role_mapping_failed` fail-open marker.
+   */
+  dropUnsafeEvaluatedMemberships(memberships, aclByProject) {
+    const resolver = new MembershipResolver();
+    const safe = [];
+    const dropped = [];
+    for (const membership of memberships) {
+      const acl = aclByProject.get(membership.project) ?? null;
+      if (membership.role !== ProjectRole.ADMIN || acl === null) {
+        safe.push(membership);
+        continue;
+      }
+      const written = {
+        role: membership.role,
+        variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, values: [...it.values] }))
+      };
+      let unsafe;
+      try {
+        unsafe = resolver.resolve(acl, [written], MembershipResolver.UnknownIdentity, false).errors.length > 0;
+      } catch {
+        unsafe = true;
+      }
+      if (unsafe) {
+        dropped.push(membership);
+      } else {
+        safe.push(membership);
+      }
+    }
+    return { safe, dropped };
+  }
+  // Membership writes are driven through the low-level commands directly (as InviteManager also does),
+  // not via ProjectMemberManager (the "normal" add/update-member path): A09 needs semantics that path does
+  // not offer — empty-value hard-delete avoidance under `keep`, and vocabulary-bounded removal under `remove`.
+  async applyMemberships(db, identityId, grantedMemberships, vocabularyMemberships, unmatched) {
+    const byProject = /* @__PURE__ */ new Map();
+    for (const membership of grantedMemberships) {
+      const list = byProject.get(membership.project) ?? [];
+      list.push(membership);
+      byProject.set(membership.project, list);
+    }
+    const projectSlugs = unmatched === "remove" ? /* @__PURE__ */ new Set([...vocabularyMemberships.keys(), ...byProject.keys()]) : new Set(byProject.keys());
+    for (const projectSlug of projectSlugs) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery(projectSlug));
+      if (!project) {
+        continue;
+      }
+      const memberships = byProject.get(projectSlug) ?? [];
+      const grantedRoles = new Set(memberships.map((it) => it.role));
+      if (unmatched === "remove") {
+        const vocabularyRoles = vocabularyMemberships.get(projectSlug) ?? /* @__PURE__ */ new Set();
+        const existing = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+        for (const membership of existing) {
+          if (vocabularyRoles.has(membership.role) && !grantedRoles.has(membership.role)) {
+            await db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          }
+        }
+      }
+      for (const membership of memberships) {
+        if (unmatched === "remove" && membership.variables.some((it) => it.values.length === 0)) {
+          await db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role));
+          continue;
+        }
+        await db.commandBus.execute(
+          new CreateOrUpdateProjectMembershipCommand(
+            project.id,
+            identityId,
+            {
+              role: membership.role,
+              // Drop variables with no values: an unset variable simply isn't applied (a role with no
+              // variables is fine — it sends none). Under `keep` this is the only empty-handling; under
+              // `remove` an empty DECLARED variable already revoked the whole membership above. Because the
+              // filtered list never carries an empty `set`, the command's hard-delete-on-empty never fires
+              // here — so `keep` never revokes a grant, and `remove`'s revocation stays explicit above.
+              variables: membership.variables.filter((it) => it.values.length > 0).map((it) => ({ name: it.name, set: [...it.values] }))
+            }
+          )
+        );
+      }
+    }
+  }
+  /**
+   * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with
+   * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by
+   * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit
+   * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),
+   * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any
+   * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a
+   * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data
+   * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog
+   * readers — by design (the recorded value is the ACL grant being audited). Variable values are included
+   * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is
+   * still detected as a change and audited.
+   */
+  async snapshot(db, identityId, vocabularyMemberships) {
+    const memberships = [];
+    for (const [slug, roles] of vocabularyMemberships) {
+      const project = await db.queryHandler.fetch(new ProjectBySlugQuery(slug));
+      if (!project) {
+        continue;
+      }
+      const rows = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]));
+      for (const row of rows) {
+        if (roles.has(row.role)) {
+          memberships.push({ project: slug, role: row.role, variables: row.variables });
+        }
+      }
+    }
+    return { memberships: sortMemberships(memberships) };
+  }
+}
+const sortMemberships = (memberships) => [...memberships].map((membership) => ({
+  project: membership.project,
+  role: membership.role,
+  variables: [...membership.variables].map((variable) => ({ name: variable.name, values: [...variable.values].sort() })).sort((a, b) => a.name.localeCompare(b.name))
+})).sort((a, b) => a.project.localeCompare(b.project) || a.role.localeCompare(b.role));
+const snapshotEquals = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+export {
+  IDPClaimSyncService
+};
+//# sourceMappingURL=IDPClaimSyncService.js.map

package/dist/development/src/model/service/idp/IDPClaimSyncService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPClaimSyncService.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPClaimSyncService.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ClaimMapping, ClaimMappingRule, DEFAULT_SYNC_POLICY, DEFAULT_UNMATCHED } from './ClaimMapping.js'\nimport { evaluateClaimMapping, MappedMembership } from './ClaimMappingEvaluator.js'\nimport { validateClaimMappingMembership } from './ClaimMappingValidation.js'\nimport { ProjectSchemaResolver } from '../../type/index.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { MembershipResolver } from '@contember/schema-utils'\nimport { ProjectBySlugQuery, ProjectMembershipByIdentityQuery } from '../../queries/index.js'\nimport { CreateOrUpdateProjectMembershipCommand, RemoveProjectMembershipCommand } from '../../commands/index.js'\n\nexport type ClaimMappingSnapshot = {\n\treadonly memberships: readonly MappedMembership[]\n}\n\nexport type ClaimMappingAudit = {\n\treadonly before: ClaimMappingSnapshot\n\treadonly after: ClaimMappingSnapshot\n\treadonly syncPolicy: NonNullable<ClaimMapping['syncPolicy']>\n\treadonly unmatched: NonNullable<ClaimMapping['unmatched']>\n}\n\nexport type ClaimMappingSyncResult = {\n\t/** Membership before/after delta — present only when the apply actually changed grants. */\n\treadonly audit: ClaimMappingAudit | null\n\t/** True when the apply-time safety backstop dropped one or more configured rules (a fail-open marker for the caller's audit). */\n\treadonly droppedUnsafeRules: boolean\n}\n\n/**\n * Applies an IdP's `claimMapping` (A09) after a person has been resolved: evaluates the declarative\n * rules against the IdP claims and grants the resulting project memberships, honouring the per-IdP\n * `syncPolicy` (`always` vs `sticky`) and `unmatched` (`keep` vs `remove`) settings. The mapping\n * grants project memberships only — never global/tenant roles (see {@link ClaimMapping}).\n *\n * Runs at sign-in (inside the sign-in transaction) and, for `always` mappings, again on each OIDC\n * session refresh (see `IdpSessionRevalidator`). Returns a {@link ClaimMappingSyncResult}: an\n * `{ before, after }` audit delta (`null` when nothing changed) plus `droppedUnsafeRules` (true when the\n * apply-time safety backstop dropped a configured rule). The caller emits the `idp_role_mapped` audit\n * from the delta and the `idp_role_mapping_failed` fail-open marker from `droppedUnsafeRules` — audit\n * lives at the caller layer, never here.\n *\n * The caller parses the mapping (via {@link parseClaimMapping}) and decides the fail-open policy: a\n * malformed config is caught by the caller before this runs, while a DB error raised here propagates\n * so the surrounding transaction rolls back the partial apply (no half-applied grants).\n */\nexport class IDPClaimSyncService {\n\tconstructor(\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {\n\t}\n\n\tasync sync(\n\t\tdb: DatabaseContext,\n\t\tmapping: ClaimMapping,\n\t\tclaims: Record<string, unknown>,\n\t\tidentity: { id: string },\n\t\tisNewPerson: boolean,\n\t\toptions: { allowRemoval?: boolean } = {},\n\t): Promise<ClaimMappingSyncResult> {\n\t\tif (mapping.rules.length === 0) {\n\t\t\treturn { audit: null, droppedUnsafeRules: false }\n\t\t}\n\n\t\tconst syncPolicy = mapping.syncPolicy ?? DEFAULT_SYNC_POLICY\n\t\t// `unmatched: 'remove'` reconciliation is only safe when the claim surface is COMPLETE: a rule that\n\t\t// matched at sign-in but is missing from a partial surface would strip a legitimate membership with no\n\t\t// IdP change. At sign-in the surface is always complete, so the caller leaves removal enabled. On the\n\t\t// OIDC refresh path the caller passes `allowRemoval` per surface completeness (see IdpSessionRevalidator):\n\t\t// a `method: 'refresh'` that rebuilt sign-in's id-token + userinfo surface enables removal (refresh then\n\t\t// reconciles exactly like sign-in); a partial surface (userinfo-only probe, or a failed userinfo fetch)\n\t\t// disables it so refresh stays additive-only. The audit below reflects this effective value.\n\t\tconst unmatched = options.allowRemoval === false ? 'keep' : (mapping.unmatched ?? DEFAULT_UNMATCHED)\n\n\t\t// `sticky`: only apply at account creation; an existing account keeps whatever it has. This is\n\t\t// also what bounds refresh-sync to `always` mappings — a refresh passes `isNewPerson: false`.\n\t\tif (syncPolicy === 'sticky' && !isNewPerson) {\n\t\t\treturn { audit: null, droppedUnsafeRules: false }\n\t\t}\n\n\t\t// Apply-time safety backstop (A09): re-validate each granted membership against the project's LIVE\n\t\t// ACL schema and drop any that fails (fail-closed) — condition-injection above all, but ANY error\n\t\t// (unknown role/variable, a malformed condition value, an unsafe predefined). Config-time validation\n\t\t// (`IDPManager.assertValidClaimMapping`) is the primary guard, but it is skipped when the target\n\t\t// project does not exist yet, is never re-run when it is later created, and a variable's ACL type can\n\t\t// drift (e.g. entity → condition) after the mapping was authored. A dropped rule is removed from BOTH\n\t\t// the granted set and the removal vocabulary below (both derived from `rules`), so an unsafe rule\n\t\t// neither grants nor drives reconciliation. The caller is told a drop happened (`droppedUnsafeRules`)\n\t\t// so it can emit the `idp_role_mapping_failed` fail-open marker.\n\t\tconst { safe: rules, dropped, aclByProject } = await this.dropUnsafeRules(db, mapping.rules)\n\n\t\t// Apply-time safety backstop, part 2 (A09): RUNTIME re-validation of the EVALUATED memberships.\n\t\t// `dropUnsafeRules` above only sees each rule's static CONFIG shape, so — like config-time validation —\n\t\t// it tolerates a missing membership variable (an A09 grant may set only some of a role's variables).\n\t\t// Once the claims are evaluated we know each membership EXACTLY as it would be written, and can\n\t\t// fail-close on the one case that tolerance makes unsafe: an `admin` grant whose claim-derived scoping\n\t\t// variable resolved empty, which would otherwise persist a bare, UNSCOPED `admin` membership (see\n\t\t// {@link dropUnsafeEvaluatedMemberships}). Both drop sets feed the `droppedUnsafeRules` fail-open marker.\n\t\tconst evaluated = evaluateClaimMapping({ ...mapping, rules }, claims)\n\t\tconst { safe: memberships, dropped: droppedMemberships } = this.dropUnsafeEvaluatedMemberships(evaluated, aclByProject)\n\t\tconst droppedUnsafeRules = dropped.length > 0 || droppedMemberships.length > 0\n\n\t\t// The mapping's membership \"vocabulary\": every (project, role) any rule could grant a membership\n\t\t// for. Removal is strictly bounded to this set so memberships and variable names managed outside\n\t\t// the mapping are never stripped, even under `unmatched: 'remove'`.\n\t\tconst vocabularyMemberships = new Map<string, Set<string>>()\n\t\tfor (const rule of rules) {\n\t\t\tif (rule.grantMembership) {\n\t\t\t\tconst roles = vocabularyMemberships.get(rule.grantMembership.project) ?? new Set<string>()\n\t\t\t\troles.add(rule.grantMembership.role)\n\t\t\t\tvocabularyMemberships.set(rule.grantMembership.project, roles)\n\t\t\t}\n\t\t}\n\t\tconst before = await this.snapshot(db, identity.id, vocabularyMemberships)\n\n\t\tawait this.applyMemberships(db, identity.id, memberships, vocabularyMemberships, unmatched)\n\n\t\tconst after = await this.snapshot(db, identity.id, vocabularyMemberships)\n\n\t\tif (snapshotEquals(before, after)) {\n\t\t\treturn { audit: null, droppedUnsafeRules }\n\t\t}\n\n\t\treturn { audit: { before, after, syncPolicy, unmatched }, droppedUnsafeRules }\n\t}\n\n\t/**\n\t * Partition rules into those safe to apply and those dropped by the apply-time safety backstop. A rule\n\t * is dropped when its granted membership produces ANY validation error against the project's CURRENT ACL\n\t * schema (fail-closed) — condition-injection above all, but also an unknown role/variable, a malformed\n\t * condition value, or a forbidden predefined variable. A validation throw is treated as unsafe (we cannot\n\t * prove the grant safe). Schemas (and, when needed, project existence) are resolved at most once per\n\t * project. The dropped set is returned so the caller can emit a fail-open audit marker.\n\t *\n\t * When `getSchema` returns no ACL it does NOT mean \"the project does not exist\": it returns undefined both\n\t * for a project that has no row yet AND for one whose row exists but whose container / content schema is\n\t * momentarily unresolvable (mid-provisioning, transient). The two need OPPOSITE handling, so we\n\t * disambiguate via the tenant `project` table:\n\t *   - no project row → the grant is genuinely inert (`applyMemberships` resolves the same slug and skips\n\t *     it, so nothing is written). KEEP the rule for when the project is created later.\n\t *   - project row EXISTS but the ACL is unresolvable → `applyMemberships` WOULD still write the membership\n\t *     (it resolves the slug from the tenant `project` table, independent of the content schema), so an\n\t *     UNVALIDATED grant — including a claim-derived value targeting a `condition` ACL variable — could\n\t *     land. Fail closed: DROP the rule (it re-applies on a later sign-in once the schema resolves). This\n\t *     matches the direct add-member path, which refuses a membership whose project schema can't be resolved.\n\t *\n\t * Returns the per-project ACL map it built (`aclByProject`) so the runtime backstop\n\t * ({@link dropUnsafeEvaluatedMemberships}) can re-use it without re-resolving any schema.\n\t */\n\tprivate async dropUnsafeRules(\n\t\tdb: DatabaseContext,\n\t\trules: readonly ClaimMappingRule[],\n\t): Promise<{ safe: ClaimMappingRule[]; dropped: ClaimMappingRule[]; aclByProject: Map<string, Acl.Schema | null> }> {\n\t\tconst aclByProject = new Map<string, Acl.Schema | null>()\n\t\tconst projectExistsBySlug = new Map<string, boolean>()\n\t\tconst safe: ClaimMappingRule[] = []\n\t\tconst dropped: ClaimMappingRule[] = []\n\t\tfor (const rule of rules) {\n\t\t\tconst membership = rule.grantMembership\n\t\t\tif (!membership) {\n\t\t\t\tsafe.push(rule)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (!aclByProject.has(membership.project)) {\n\t\t\t\tconst schema = await this.projectSchemaResolver.getSchema(membership.project)\n\t\t\t\taclByProject.set(membership.project, schema?.acl ?? null)\n\t\t\t}\n\t\t\tconst acl = aclByProject.get(membership.project) ?? null\n\t\t\tif (acl === null) {\n\t\t\t\tif (!projectExistsBySlug.has(membership.project)) {\n\t\t\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(membership.project))\n\t\t\t\t\tprojectExistsBySlug.set(membership.project, project != null)\n\t\t\t\t}\n\t\t\t\t// project row exists but its ACL is unresolvable → can't prove the grant safe → drop (fail-closed);\n\t\t\t\t// no row yet → genuinely inert, keep for a project created later.\n\t\t\t\tif (projectExistsBySlug.get(membership.project)) {\n\t\t\t\t\tdropped.push(rule)\n\t\t\t\t} else {\n\t\t\t\t\tsafe.push(rule)\n\t\t\t\t}\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tlet unsafe: boolean\n\t\t\ttry {\n\t\t\t\tunsafe = validateClaimMappingMembership(acl, membership).length > 0\n\t\t\t} catch {\n\t\t\t\tunsafe = true\n\t\t\t}\n\t\t\tif (unsafe) {\n\t\t\t\tdropped.push(rule)\n\t\t\t} else {\n\t\t\t\tsafe.push(rule)\n\t\t\t}\n\t\t}\n\t\treturn { safe, dropped, aclByProject }\n\t}\n\n\t/**\n\t * RUNTIME companion to {@link dropUnsafeRules} (A09 apply-time backstop, part 2). `dropUnsafeRules`\n\t * validates each rule's static CONFIG shape and — like config-time validation — TOLERATES a missing\n\t * membership variable (`VARIABLE_EMPTY`): an A09 grant may legitimately set only some of a role's\n\t * variables. For an ordinary role that tolerance is safe: a variable that resolves to no value just\n\t * narrows CONTENT access (the membership resolver maps it to `{ never: true }` — strictly LESS access,\n\t * never more), and a role's tenant permissions are matched against that role's OWN tenant rule (a\n\t * missing variable there denies, never escalates).\n\t *\n\t * The ONE role that breaks the assumption is the project `admin` role: {@link ProjectScope} grants the\n\t * PROJECT_ADMIN tenant role (project secrets, member management, IdP config, deploy, …) to ANY identity\n\t * holding an `admin` membership in the project — keyed on the role NAME alone, independent of the\n\t * membership's variables. So when a claim-derived variable meant to SCOPE an `admin` grant resolves\n\t * empty, `applyMemberships` drops the empty variable before the write and persists a BARE `admin`\n\t * membership — i.e. UNSCOPED project-admin, even though the operator intended a scoped grant, and a\n\t * membership the direct add-member path ({@link MembershipResolver}, via `MembershipValidator`) would\n\t * REJECT as `VARIABLE_EMPTY`. (`admin` is the only role-name-based grant in the whole authorization\n\t * layer; every other privilege is gated by ACL variables/predicates, so it cannot be widened this way.)\n\t *\n\t * So, fail-closed, we re-validate every evaluated `admin` grant EXACTLY as it would be written (empty\n\t * variables filtered out, as `applyMemberships` does) against the live ACL and DROP it if the resolver\n\t * reports any error — i.e. if a required (non-fallback) `admin` variable would be absent. Under `keep`\n\t * the bare grant is then never written; under `remove` it is absent from the granted set, so\n\t * reconciliation revokes any pre-existing one. Non-`admin` grants are left untouched (their partial\n\t * grants stay valid). The drop folds into `droppedUnsafeRules`, so the caller still emits the\n\t * `idp_role_mapping_failed` fail-open marker.\n\t */\n\tprivate dropUnsafeEvaluatedMemberships(\n\t\tmemberships: readonly MappedMembership[],\n\t\taclByProject: ReadonlyMap<string, Acl.Schema | null>,\n\t): { safe: MappedMembership[]; dropped: MappedMembership[] } {\n\t\tconst resolver = new MembershipResolver()\n\t\tconst safe: MappedMembership[] = []\n\t\tconst dropped: MappedMembership[] = []\n\t\tfor (const membership of memberships) {\n\t\t\tconst acl = aclByProject.get(membership.project) ?? null\n\t\t\t// Only `admin` is privileged by role name independent of its variables (see above). A null ACL means\n\t\t\t// the project has no row yet — an existing-but-unresolvable project had its rule dropped upstream, so\n\t\t\t// it never reaches here — so the grant is inert (`applyMemberships` skips the missing project): keep it.\n\t\t\tif (membership.role !== ProjectRole.ADMIN || acl === null) {\n\t\t\t\tsafe.push(membership)\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\t// Validate the membership as it will be persisted: `applyMemberships` filters out empty-valued\n\t\t\t// variables before the write, so an unset required (non-fallback) variable surfaces here as\n\t\t\t// `VARIABLE_EMPTY`, exactly as the direct add-member path reports and rejects it. Any error ⇒ unsafe.\n\t\t\tconst written: Acl.Membership = {\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.filter(it => it.values.length > 0).map(it => ({ name: it.name, values: [...it.values] })),\n\t\t\t}\n\t\t\tlet unsafe: boolean\n\t\t\ttry {\n\t\t\t\tunsafe = resolver.resolve(acl, [written], MembershipResolver.UnknownIdentity, false).errors.length > 0\n\t\t\t} catch {\n\t\t\t\tunsafe = true\n\t\t\t}\n\t\t\tif (unsafe) {\n\t\t\t\tdropped.push(membership)\n\t\t\t} else {\n\t\t\t\tsafe.push(membership)\n\t\t\t}\n\t\t}\n\t\treturn { safe, dropped }\n\t}\n\n\t// Membership writes are driven through the low-level commands directly (as InviteManager also does),\n\t// not via ProjectMemberManager (the \"normal\" add/update-member path): A09 needs semantics that path does\n\t// not offer — empty-value hard-delete avoidance under `keep`, and vocabulary-bounded removal under `remove`.\n\tprivate async applyMemberships(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tgrantedMemberships: readonly MappedMembership[],\n\t\tvocabularyMemberships: ReadonlyMap<string, ReadonlySet<string>>,\n\t\tunmatched: NonNullable<ClaimMapping['unmatched']>,\n\t): Promise<void> {\n\t\t// Group granted memberships by project so each project is resolved (slug -> id) only once.\n\t\tconst byProject = new Map<string, MappedMembership[]>()\n\t\tfor (const membership of grantedMemberships) {\n\t\t\tconst list = byProject.get(membership.project) ?? []\n\t\t\tlist.push(membership)\n\t\t\tbyProject.set(membership.project, list)\n\t\t}\n\n\t\t// Under `remove`, reconcile every project in the mapping's membership vocabulary — not only the\n\t\t// projects granted this sign-in — so a membership whose claim disappeared entirely (its project is\n\t\t// then absent from `byProject`) is still revoked. `keep` only ever touches the projects it grants.\n\t\tconst projectSlugs = unmatched === 'remove'\n\t\t\t? new Set([...vocabularyMemberships.keys(), ...byProject.keys()])\n\t\t\t: new Set(byProject.keys())\n\n\t\tfor (const projectSlug of projectSlugs) {\n\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(projectSlug))\n\t\t\tif (!project) {\n\t\t\t\t// Mapping references a project that does not exist (or was deleted) — skip it rather\n\t\t\t\t// than fail the whole sign-in. The audit's before/after won't reflect it.\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\tconst memberships = byProject.get(projectSlug) ?? []\n\t\t\tconst grantedRoles = new Set(memberships.map(it => it.role))\n\n\t\t\tif (unmatched === 'remove') {\n\t\t\t\t// Removal is bounded to the mapping's own membership vocabulary (project::role named by some\n\t\t\t\t// rule): a role the mapping could grant but doesn't this sign-in is stripped, while a\n\t\t\t\t// membership role no rule names (managed outside the mapping) is left untouched.\n\t\t\t\tconst vocabularyRoles = vocabularyMemberships.get(projectSlug) ?? new Set<string>()\n\t\t\t\tconst existing = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\t\t\tfor (const membership of existing) {\n\t\t\t\t\tif (vocabularyRoles.has(membership.role) && !grantedRoles.has(membership.role)) {\n\t\t\t\t\t\tawait db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role))\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tfor (const membership of memberships) {\n\t\t\t\t// Under `remove` the IdP is the source of truth, and the system does NOT allow an empty membership\n\t\t\t\t// variable — the direct add-member path hard-deletes a membership whose variable resolves to no\n\t\t\t\t// values (`CreateOrUpdateProjectMembershipCommand` deletes such a row), and the membership\n\t\t\t\t// resolver reports a missing/empty variable as VARIABLE_EMPTY. So a DECLARED variable that resolves\n\t\t\t\t// to no values means the grant is empty-scoped and meaningless: REVOKE the whole membership,\n\t\t\t\t// consistently with that invariant, rather than leaving a role with a missing/empty variable. (CORR-1:\n\t\t\t\t// clearing the variable to `[]` instead would, for a `condition` variable, parse to `{ or: [] }` =\n\t\t\t\t// allow-all — the opposite of revoking.) Under `keep` we never revoke, so an empty variable is simply\n\t\t\t\t// not applied below and the grant stays.\n\t\t\t\tif (unmatched === 'remove' && membership.variables.some(it => it.values.length === 0)) {\n\t\t\t\t\tawait db.commandBus.execute(new RemoveProjectMembershipCommand(project.id, identityId, membership.role))\n\t\t\t\t\tcontinue\n\t\t\t\t}\n\n\t\t\t\tawait db.commandBus.execute(\n\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(\n\t\t\t\t\t\tproject.id,\n\t\t\t\t\t\tidentityId,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\trole: membership.role,\n\t\t\t\t\t\t\t// Drop variables with no values: an unset variable simply isn't applied (a role with no\n\t\t\t\t\t\t\t// variables is fine — it sends none). Under `keep` this is the only empty-handling; under\n\t\t\t\t\t\t\t// `remove` an empty DECLARED variable already revoked the whole membership above. Because the\n\t\t\t\t\t\t\t// filtered list never carries an empty `set`, the command's hard-delete-on-empty never fires\n\t\t\t\t\t\t\t// here — so `keep` never revokes a grant, and `remove`'s revocation stays explicit above.\n\t\t\t\t\t\t\tvariables: membership.variables\n\t\t\t\t\t\t\t\t.filter(it => it.values.length > 0)\n\t\t\t\t\t\t\t\t.map(it => ({ name: it.name, set: [...it.values] })),\n\t\t\t\t\t\t},\n\t\t\t\t\t),\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Snapshot the identity's mapping-relevant memberships for the audit delta: its memberships (with\n\t * variable values) for exactly the (project, role) pairs in the mapping's vocabulary. Bounding is by\n\t * (project, role) — a membership whose ROLE no rule names is excluded entirely — which keeps the audit\n\t * consistent with the (also vocabulary-bounded) reconciliation. NOTE the bound is per-(project, role),\n\t * NOT per-variable-name: for an in-vocabulary membership ALL its variables are snapshotted, including any\n\t * variable managed OUTSIDE the mapping on that same role (e.g. an admin-set `condition` filter), and a\n\t * `passthrough` variable's value IS the verbatim external claim value. So the idp_role_mapped event_data\n\t * can disclose claim-derived / admin-managed variable values for a mapped role to system:viewAuthLog\n\t * readers — by design (the recorded value is the ACL grant being audited). Variable values are included\n\t * so a sign-in that only changes a claim-derived membership variable — itself a row-level ACL grant — is\n\t * still detected as a change and audited.\n\t */\n\tprivate async snapshot(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tvocabularyMemberships: ReadonlyMap<string, ReadonlySet<string>>,\n\t): Promise<ClaimMappingSnapshot> {\n\t\tconst memberships: MappedMembership[] = []\n\t\tfor (const [slug, roles] of vocabularyMemberships) {\n\t\t\tconst project = await db.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t\t\tif (!project) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst rows = await db.queryHandler.fetch(new ProjectMembershipByIdentityQuery({ id: project.id }, [identityId]))\n\t\t\tfor (const row of rows) {\n\t\t\t\t// Only the roles the mapping itself could grant: a membership role no rule names (managed outside\n\t\t\t\t// the mapping) is neither reconciled nor disclosed in the audit delta.\n\t\t\t\tif (roles.has(row.role)) {\n\t\t\t\t\tmemberships.push({ project: slug, role: row.role, variables: row.variables })\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn { memberships: sortMemberships(memberships) }\n\t}\n}\n\n// Stable ordering (memberships by project+role, variables by name, values sorted) so `snapshotEquals`\n// compares by content, not by the DB's row/array order. Assumes variable `values` are always JSON\n// string arrays (which they are — the membership commands only ever store `string[]`); a non-string\n// element would make the default sort order-unstable and the JSON.stringify comparison spurious, so\n// keep variable values string-typed.\nconst sortMemberships = (memberships: readonly MappedMembership[]): readonly MappedMembership[] =>\n\t[...memberships]\n\t\t.map(membership => ({\n\t\t\tproject: membership.project,\n\t\t\trole: membership.role,\n\t\t\tvariables: [...membership.variables]\n\t\t\t\t.map(variable => ({ name: variable.name, values: [...variable.values].sort() }))\n\t\t\t\t.sort((a, b) => a.name.localeCompare(b.name)),\n\t\t}))\n\t\t.sort((a, b) => a.project.localeCompare(b.project) || a.role.localeCompare(b.role))\n\nconst snapshotEquals = (a: ClaimMappingSnapshot, b: ClaimMappingSnapshot): boolean => JSON.stringify(a) === JSON.stringify(b)\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA6CO,MAAM,oBAAoB;AAAA,EAChC,YACkB,uBAChB;AADgB,SAAA,wBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,KACL,IACA,SACA,QACA,UACA,aACA,UAAsC,IACJ;AAClC,QAAI,QAAQ,MAAM,WAAW,GAAG;AAC/B,aAAO,EAAE,OAAO,MAAM,oBAAoB,MAAA;AAAA,IAC3C;AAEA,UAAM,aAAa,QAAQ,cAAc;AAQzC,UAAM,YAAY,QAAQ,iBAAiB,QAAQ,SAAU,QAAQ,aAAa;AAIlF,QAAI,eAAe,YAAY,CAAC,aAAa;AAC5C,aAAO,EAAE,OAAO,MAAM,oBAAoB,MAAA;AAAA,IAC3C;AAWA,UAAM,EAAE,MAAM,OAAO,SAAS,aAAA,IAAiB,MAAM,KAAK,gBAAgB,IAAI,QAAQ,KAAK;AAS3F,UAAM,YAAY,qBAAqB,EAAE,GAAG,SAAS,MAAA,GAAS,MAAM;AACpE,UAAM,EAAE,MAAM,aAAa,SAAS,uBAAuB,KAAK,+BAA+B,WAAW,YAAY;AACtH,UAAM,qBAAqB,QAAQ,SAAS,KAAK,mBAAmB,SAAS;AAK7E,UAAM,4CAA4B,IAAA;AAClC,eAAW,QAAQ,OAAO;AACzB,UAAI,KAAK,iBAAiB;AACzB,cAAM,QAAQ,sBAAsB,IAAI,KAAK,gBAAgB,OAAO,yBAAS,IAAA;AAC7E,cAAM,IAAI,KAAK,gBAAgB,IAAI;AACnC,8BAAsB,IAAI,KAAK,gBAAgB,SAAS,KAAK;AAAA,MAC9D;AAAA,IACD;AACA,UAAM,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS,IAAI,qBAAqB;AAEzE,UAAM,KAAK,iBAAiB,IAAI,SAAS,IAAI,aAAa,uBAAuB,SAAS;AAE1F,UAAM,QAAQ,MAAM,KAAK,SAAS,IAAI,SAAS,IAAI,qBAAqB;AAExE,QAAI,eAAe,QAAQ,KAAK,GAAG;AAClC,aAAO,EAAE,OAAO,MAAM,mBAAA;AAAA,IACvB;AAEA,WAAO,EAAE,OAAO,EAAE,QAAQ,OAAO,YAAY,UAAA,GAAa,mBAAA;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAyBA,MAAc,gBACb,IACA,OACmH;AACnH,UAAM,mCAAmB,IAAA;AACzB,UAAM,0CAA0B,IAAA;AAChC,UAAM,OAA2B,CAAA;AACjC,UAAM,UAA8B,CAAA;AACpC,eAAW,QAAQ,OAAO;AACzB,YAAM,aAAa,KAAK;AACxB,UAAI,CAAC,YAAY;AAChB,aAAK,KAAK,IAAI;AACd;AAAA,MACD;AACA,UAAI,CAAC,aAAa,IAAI,WAAW,OAAO,GAAG;AAC1C,cAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW,OAAO;AAC5E,qBAAa,IAAI,WAAW,SAAS,QAAQ,OAAO,IAAI;AAAA,MACzD;AACA,YAAM,MAAM,aAAa,IAAI,WAAW,OAAO,KAAK;AACpD,UAAI,QAAQ,MAAM;AACjB,YAAI,CAAC,oBAAoB,IAAI,WAAW,OAAO,GAAG;AACjD,gBAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB,WAAW,OAAO,CAAC;AACtF,8BAAoB,IAAI,WAAW,SAAS,WAAW,IAAI;AAAA,QAC5D;AAGA,YAAI,oBAAoB,IAAI,WAAW,OAAO,GAAG;AAChD,kBAAQ,KAAK,IAAI;AAAA,QAClB,OAAO;AACN,eAAK,KAAK,IAAI;AAAA,QACf;AACA;AAAA,MACD;AACA,UAAI;AACJ,UAAI;AACH,iBAAS,+BAA+B,KAAK,UAAU,EAAE,SAAS;AAAA,MACnE,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,UAAI,QAAQ;AACX,gBAAQ,KAAK,IAAI;AAAA,MAClB,OAAO;AACN,aAAK,KAAK,IAAI;AAAA,MACf;AAAA,IACD;AACA,WAAO,EAAE,MAAM,SAAS,aAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6BQ,+BACP,aACA,cAC4D;AAC5D,UAAM,WAAW,IAAI,mBAAA;AACrB,UAAM,OAA2B,CAAA;AACjC,UAAM,UAA8B,CAAA;AACpC,eAAW,cAAc,aAAa;AACrC,YAAM,MAAM,aAAa,IAAI,WAAW,OAAO,KAAK;AAIpD,UAAI,WAAW,SAAS,YAAY,SAAS,QAAQ,MAAM;AAC1D,aAAK,KAAK,UAAU;AACpB;AAAA,MACD;AAIA,YAAM,UAA0B;AAAA,QAC/B,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,OAAO,QAAM,GAAG,OAAO,SAAS,CAAC,EAAE,IAAI,SAAO,EAAE,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,GAAG,MAAM,IAAI;AAAA,MAAA;AAEzH,UAAI;AACJ,UAAI;AACH,iBAAS,SAAS,QAAQ,KAAK,CAAC,OAAO,GAAG,mBAAmB,iBAAiB,KAAK,EAAE,OAAO,SAAS;AAAA,MACtG,QAAQ;AACP,iBAAS;AAAA,MACV;AACA,UAAI,QAAQ;AACX,gBAAQ,KAAK,UAAU;AAAA,MACxB,OAAO;AACN,aAAK,KAAK,UAAU;AAAA,MACrB;AAAA,IACD;AACA,WAAO,EAAE,MAAM,QAAA;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACb,IACA,YACA,oBACA,uBACA,WACgB;AAEhB,UAAM,gCAAgB,IAAA;AACtB,eAAW,cAAc,oBAAoB;AAC5C,YAAM,OAAO,UAAU,IAAI,WAAW,OAAO,KAAK,CAAA;AAClD,WAAK,KAAK,UAAU;AACpB,gBAAU,IAAI,WAAW,SAAS,IAAI;AAAA,IACvC;AAKA,UAAM,eAAe,cAAc,WAChC,oBAAI,IAAI,CAAC,GAAG,sBAAsB,KAAA,GAAQ,GAAG,UAAU,KAAA,CAAM,CAAC,IAC9D,IAAI,IAAI,UAAU,MAAM;AAE3B,eAAW,eAAe,cAAc;AACvC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB,WAAW,CAAC;AAC/E,UAAI,CAAC,SAAS;AAGb;AAAA,MACD;AAEA,YAAM,cAAc,UAAU,IAAI,WAAW,KAAK,CAAA;AAClD,YAAM,eAAe,IAAI,IAAI,YAAY,IAAI,CAAA,OAAM,GAAG,IAAI,CAAC;AAE3D,UAAI,cAAc,UAAU;AAI3B,cAAM,kBAAkB,sBAAsB,IAAI,WAAW,yBAAS,IAAA;AACtE,cAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AACnH,mBAAW,cAAc,UAAU;AAClC,cAAI,gBAAgB,IAAI,WAAW,IAAI,KAAK,CAAC,aAAa,IAAI,WAAW,IAAI,GAAG;AAC/E,kBAAM,GAAG,WAAW,QAAQ,IAAI,+BAA+B,QAAQ,IAAI,YAAY,WAAW,IAAI,CAAC;AAAA,UACxG;AAAA,QACD;AAAA,MACD;AAEA,iBAAW,cAAc,aAAa;AAUrC,YAAI,cAAc,YAAY,WAAW,UAAU,KAAK,QAAM,GAAG,OAAO,WAAW,CAAC,GAAG;AACtF,gBAAM,GAAG,WAAW,QAAQ,IAAI,+BAA+B,QAAQ,IAAI,YAAY,WAAW,IAAI,CAAC;AACvG;AAAA,QACD;AAEA,cAAM,GAAG,WAAW;AAAA,UACnB,IAAI;AAAA,YACH,QAAQ;AAAA,YACR;AAAA,YACA;AAAA,cACC,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAMjB,WAAW,WAAW,UACpB,OAAO,QAAM,GAAG,OAAO,SAAS,CAAC,EACjC,IAAI,SAAO,EAAE,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,MAAM,IAAI;AAAA,YAAA;AAAA,UACrD;AAAA,QACD;AAAA,MAEF;AAAA,IACD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAc,SACb,IACA,YACA,uBACgC;AAChC,UAAM,cAAkC,CAAA;AACxC,eAAW,CAAC,MAAM,KAAK,KAAK,uBAAuB;AAClD,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB,IAAI,CAAC;AACxE,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AACA,YAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAI,iCAAiC,EAAE,IAAI,QAAQ,GAAA,GAAM,CAAC,UAAU,CAAC,CAAC;AAC/G,iBAAW,OAAO,MAAM;AAGvB,YAAI,MAAM,IAAI,IAAI,IAAI,GAAG;AACxB,sBAAY,KAAK,EAAE,SAAS,MAAM,MAAM,IAAI,MAAM,WAAW,IAAI,UAAA,CAAW;AAAA,QAC7E;AAAA,MACD;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,gBAAgB,WAAW,EAAA;AAAA,EAClD;AACD;AAOA,MAAM,kBAAkB,CAAC,gBACxB,CAAC,GAAG,WAAW,EACb,IAAI,CAAA,gBAAe;AAAA,EACnB,SAAS,WAAW;AAAA,EACpB,MAAM,WAAW;AAAA,EACjB,WAAW,CAAC,GAAG,WAAW,SAAS,EACjC,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,EAAE,KAAA,EAAK,EAAI,EAC9E,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAC9C,EAAE,EACD,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,cAAc,EAAE,OAAO,KAAK,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;AAEpF,MAAM,iBAAiB,CAAC,GAAyB,MAAqC,KAAK,UAAU,CAAC,MAAM,KAAK,UAAU,CAAC;"}

package/dist/development/src/model/service/idp/IDPManager.cjs

@@ -14,18 +14,22 @@ require("@contember/schema");
 const CreateIdpCommand = require("../../commands/idp/CreateIdpCommand.cjs");
 const IdentityProviderNotFoundError = require("./IdentityProviderNotFoundError.cjs");
 const InvalidIDPConfigurationError = require("./InvalidIDPConfigurationError.cjs");
+const ClaimMapping = require("./ClaimMapping.cjs");
+const ClaimMappingValidation = require("./ClaimMappingValidation.cjs");
 const DisableIdpCommand = require("../../commands/idp/DisableIdpCommand.cjs");
 const EnableIdpCommand = require("../../commands/idp/EnableIdpCommand.cjs");
 const UpdateIdpCommand = require("../../commands/idp/UpdateIdpCommand.cjs");
 class IDPManager {
-  constructor(idpRegistry) {
+  constructor(idpRegistry, projectSchemaResolver) {
     this.idpRegistry = idpRegistry;
+    this.projectSchemaResolver = projectSchemaResolver;
   }
   async addIDP(db, idp) {
     return await db.transaction(async (db2) => {
       try {
         const providerService = this.idpRegistry.getHandler(idp.type);
-        providerService.validateConfiguration(idp.configuration);
+        this.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(idp.configuration), idp.configuration);
+        await this.assertValidClaimMapping(idp.configuration);
       } catch (e) {
         if (e instanceof IdentityProviderNotFoundError.IdentityProviderNotFoundError) {
           return new Response.ResponseError("UNKNOWN_TYPE", `IDP type ${idp.type} not found`);
@@ -73,28 +77,13 @@ class IDPManager {
       if (!existing) {
         return new Response.ResponseError("NOT_FOUND", `IDP ${slug} not found`);
       }
-      const newConfiguration = (() => {
-        if (!data.configuration) {
-          return existing.configuration;
-        }
-        if (!mergeConfiguration) {
-          return data.configuration;
-        }
-        const newConfiguration2 = { ...existing.configuration };
-        for (const [key, value] of Object.entries(data.configuration)) {
-          if (value === null) {
-            delete newConfiguration2[key];
-          } else {
-            newConfiguration2[key] = value;
-          }
-        }
-        return newConfiguration2;
-      })();
+      const newConfiguration = !data.configuration ? existing.configuration : mergeConfiguration ? deepMergeConfiguration(existing.configuration, data.configuration) : data.configuration;
       try {
         const type = data.type ?? existing.type;
         const providerService = this.idpRegistry.getHandler(type);
         if (data.configuration !== void 0 || type !== existing.type) {
-          providerService.validateConfiguration(newConfiguration);
+          this.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(newConfiguration), newConfiguration);
+          await this.assertValidClaimMapping(newConfiguration);
         }
       } catch (e) {
         if (e instanceof InvalidIDPConfigurationError.InvalidIDPConfigurationError) {
@@ -111,6 +100,76 @@ class IDPManager {
       return new Response.ResponseOk(null);
     });
   }
+  /**
+   * Reject top-level `configuration` keys the provider does not recognise.
+   *
+   * Every provider configuration is parsed with `Typesafe.partial`, which silently DROPS unknown
+   * properties. Without this check `addIDP` / `updateIDP` answer `ok` to a configuration the
+   * provider will never act on — a typo like `fetchUserinfo` (lowercase i) reads as a successfully
+   * applied setting while the option stays off, and an option that a given engine version does not
+   * support yet looks indistinguishable from one that works.
+   *
+   * The parsed result carries exactly the keys the provider understood, so the difference against
+   * the submitted object is the set of ignored keys. All of them are reported at once (rather than
+   * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one
+   * round trip to fix, matching {@link findRemovedRuleKeys}.
+   *
+   * Only the top level is checked: nested shapes that need strictness validate themselves
+   * (`claimMapping` via {@link parseClaimMapping}). Reading a stored configuration is deliberately
+   * left untouched — this runs at write time only, so a row written before this check keeps
+   * authenticating instead of locking its users out.
+   */
+  assertNoUnknownConfigurationKeys(parsed, submitted) {
+    const known = new Set(Object.keys(parsed));
+    const unknown = Object.keys(submitted).filter((key) => !known.has(key));
+    if (unknown.length > 0) {
+      throw new InvalidIDPConfigurationError.InvalidIDPConfigurationError(
+        `unknown configuration ${unknown.length === 1 ? "property" : "properties"} ${unknown.join(", ")}; remove ${unknown.length === 1 ? "it" : "them"} or check the spelling — the provider would ignore ${unknown.length === 1 ? "it" : "them"}`
+      );
+    }
+  }
+  /**
+   * Validate the optional A09 `claimMapping` embedded in an IdP `configuration`: reject a removed
+   * `grantRoles` (global-role mapping was dropped — see {@link parseClaimMapping}), reject a
+   * malformed shape, and validate each granted membership's role against the target project's ACL
+   * schema (mirroring the direct add-member path). Throws {@link InvalidIDPConfigurationError},
+   * surfaced as `INVALID_CONFIGURATION`.
+   */
+  async assertValidClaimMapping(configuration) {
+    const removed = ClaimMapping.findRemovedRuleKeys(configuration);
+    if (removed.length > 0) {
+      throw new InvalidIDPConfigurationError.InvalidIDPConfigurationError(
+        `claimMapping no longer supports ${removed.join(", ")} (global-role mapping was removed); grant a project membership via grantMembership instead`
+      );
+    }
+    let mapping;
+    try {
+      mapping = ClaimMapping.parseClaimMapping(configuration);
+    } catch (e) {
+      throw new InvalidIDPConfigurationError.InvalidIDPConfigurationError(`Invalid claimMapping: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (!mapping) {
+      return;
+    }
+    const shapeErrors = ClaimMapping.findClaimMappingShapeErrors(mapping);
+    if (shapeErrors.length > 0) {
+      throw new InvalidIDPConfigurationError.InvalidIDPConfigurationError(shapeErrors[0]);
+    }
+    for (const rule of mapping.rules) {
+      const membership = rule.grantMembership;
+      if (!membership) {
+        continue;
+      }
+      const schema = await this.projectSchemaResolver.getSchema(membership.project);
+      if (!schema) {
+        continue;
+      }
+      const errors = ClaimMappingValidation.validateClaimMappingMembership(schema.acl, membership);
+      if (errors.length > 0) {
+        throw new InvalidIDPConfigurationError.InvalidIDPConfigurationError(errors[0].message);
+      }
+    }
+  }
   async listIDP(db) {
     const result = await db.queryHandler.fetch(new IdentityProvidersQuery.IdentityProvidersQuery());
     return result.map((it) => {
@@ -120,5 +179,22 @@ class IDPManager {
     });
   }
 }
+const deepMergeConfiguration = (base, updates) => {
+  const result = { ...base };
+  for (const [key, value] of Object.entries(updates)) {
+    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+      continue;
+    }
+    if (value === null) {
+      delete result[key];
+    } else if (ClaimMapping.isRecord(value)) {
+      const existingChild = result[key];
+      result[key] = deepMergeConfiguration(ClaimMapping.isRecord(existingChild) ? existingChild : {}, value);
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+};
 exports.IDPManager = IDPManager;
 //# sourceMappingURL=IDPManager.cjs.map

package/dist/development/src/model/service/idp/IDPManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderData } from '../../type/index.js'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries/index.js'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError.js'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand.js'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand.js'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js'\nimport { IdentityProviderDto } from '../../queries/idp/types.js'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","IdentityProviderNotFoundError","ResponseError","InvalidIDPConfigurationError","IdentityProviderBySlugQuery","CreateIdpCommand","ResponseOk","DisableIdpCommand","EnableIdpCommand","newConfiguration","UpdateIdpCommand","IdentityProvidersQuery"],"mappings":";;;;;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAaC,8BAAAA,+BAA+B;AAC/C,iBAAO,IAAIC,SAAAA,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMF,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAIF,SAAAA,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMF,IAAG,WAAW,QAAQ,IAAIK,iBAAAA,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMF,IAAG,WAAW,QAAQ,IAAIO,kBAAAA,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMF,IAAG,WAAW,QAAQ,IAAIQ,iBAAAA,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAIF,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMO,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAaN,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMF,IAAG,WAAW;AAAA,QACnB,IAAIU,iBAAAA,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAIJ,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIK,uBAAAA,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;;"}
+{"version":3,"file":"IDPManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderData } from '../../type/index.js'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries/index.js'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError.js'\nimport { findClaimMappingShapeErrors, findRemovedRuleKeys, isRecord, parseClaimMapping } from './ClaimMapping.js'\nimport { validateClaimMappingMembership } from './ClaimMappingValidation.js'\nimport { ProjectSchemaResolver } from '../../type/index.js'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand.js'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand.js'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js'\nimport { IdentityProviderDto } from '../../queries/idp/types.js'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tthis.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(idp.configuration), idp.configuration)\n\t\t\t\tawait this.assertValidClaimMapping(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = !data.configuration\n\t\t\t\t? existing.configuration\n\t\t\t\t: (mergeConfiguration ? deepMergeConfiguration(existing.configuration, data.configuration) : data.configuration)\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tthis.assertNoUnknownConfigurationKeys(providerService.validateConfiguration(newConfiguration), newConfiguration)\n\t\t\t\t\tawait this.assertValidClaimMapping(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\t/**\n\t * Reject top-level `configuration` keys the provider does not recognise.\n\t *\n\t * Every provider configuration is parsed with `Typesafe.partial`, which silently DROPS unknown\n\t * properties. Without this check `addIDP` / `updateIDP` answer `ok` to a configuration the\n\t * provider will never act on — a typo like `fetchUserinfo` (lowercase i) reads as a successfully\n\t * applied setting while the option stays off, and an option that a given engine version does not\n\t * support yet looks indistinguishable from one that works.\n\t *\n\t * The parsed result carries exactly the keys the provider understood, so the difference against\n\t * the submitted object is the set of ignored keys. All of them are reported at once (rather than\n\t * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one\n\t * round trip to fix, matching {@link findRemovedRuleKeys}.\n\t *\n\t * Only the top level is checked: nested shapes that need strictness validate themselves\n\t * (`claimMapping` via {@link parseClaimMapping}). Reading a stored configuration is deliberately\n\t * left untouched — this runs at write time only, so a row written before this check keeps\n\t * authenticating instead of locking its users out.\n\t */\n\tprivate assertNoUnknownConfigurationKeys(parsed: {}, submitted: Record<string, unknown>): void {\n\t\tconst known = new Set(Object.keys(parsed))\n\t\tconst unknown = Object.keys(submitted).filter(key => !known.has(key))\n\t\tif (unknown.length > 0) {\n\t\t\tthrow new InvalidIDPConfigurationError(\n\t\t\t\t`unknown configuration ${unknown.length === 1 ? 'property' : 'properties'} ${unknown.join(', ')}; `\n\t\t\t\t\t+ `remove ${unknown.length === 1 ? 'it' : 'them'} or check the spelling — the provider would ignore ${unknown.length === 1 ? 'it' : 'them'}`,\n\t\t\t)\n\t\t}\n\t}\n\n\t/**\n\t * Validate the optional A09 `claimMapping` embedded in an IdP `configuration`: reject a removed\n\t * `grantRoles` (global-role mapping was dropped — see {@link parseClaimMapping}), reject a\n\t * malformed shape, and validate each granted membership's role against the target project's ACL\n\t * schema (mirroring the direct add-member path). Throws {@link InvalidIDPConfigurationError},\n\t * surfaced as `INVALID_CONFIGURATION`.\n\t */\n\tprivate async assertValidClaimMapping(configuration: Record<string, unknown>): Promise<void> {\n\t\tconst removed = findRemovedRuleKeys(configuration)\n\t\tif (removed.length > 0) {\n\t\t\tthrow new InvalidIDPConfigurationError(\n\t\t\t\t`claimMapping no longer supports ${removed.join(', ')} (global-role mapping was removed); grant a project membership via grantMembership instead`,\n\t\t\t)\n\t\t}\n\t\tlet mapping\n\t\ttry {\n\t\t\tmapping = parseClaimMapping(configuration)\n\t\t} catch (e) {\n\t\t\tthrow new InvalidIDPConfigurationError(`Invalid claimMapping: ${e instanceof Error ? e.message : String(e)}`)\n\t\t}\n\t\tif (!mapping) {\n\t\t\treturn\n\t\t}\n\t\t// Reject contradictory / empty-by-construction rule shapes (a rule setting both equals+contains; a\n\t\t// variable's `from.where` without `from.pick`) before the per-project ACL checks, so a\n\t\t// misconfiguration is caught even when the target project does not exist yet (ACL loop skipped).\n\t\tconst shapeErrors = findClaimMappingShapeErrors(mapping)\n\t\tif (shapeErrors.length > 0) {\n\t\t\tthrow new InvalidIDPConfigurationError(shapeErrors[0])\n\t\t}\n\t\t// Validate each granted membership's role AND its variables against the target project's ACL schema,\n\t\t// via the shared {@link validateClaimMappingMembership} (the same checks `IDPClaimSyncService`\n\t\t// re-runs at apply time, so the two enforcement points can't drift). A project that does not (yet)\n\t\t// exist is skipped — it may be created later, and a sign-in referencing a missing project is\n\t\t// harmless (the grant is skipped). NOTE: this validation runs only here at add/update time and is\n\t\t// NOT re-checked when the project/role appears later; the unsafe-condition-variable case is caught\n\t\t// again at apply time by `IDPClaimSyncService`, but other drift (unknown role/variable) is not.\n\t\tfor (const rule of mapping.rules) {\n\t\t\tconst membership = rule.grantMembership\n\t\t\tif (!membership) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst schema = await this.projectSchemaResolver.getSchema(membership.project)\n\t\t\tif (!schema) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst errors = validateClaimMappingMembership(schema.acl, membership)\n\t\t\tif (errors.length > 0) {\n\t\t\t\tthrow new InvalidIDPConfigurationError(errors[0].message)\n\t\t\t}\n\t\t}\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\n/**\n * Recursively merge configurer-supplied `updates` into the stored `base` configuration (the\n * `mergeConfiguration: true` path of {@link IDPManager.updateIDP}), returning a new object:\n * - a plain-object value is merged INTO an existing plain-object value at the same key, so updating one\n *   field of a nested config object preserves its siblings. This matters for `configuration.claimMapping`,\n *   which holds two independent concerns in one object — the OIDC identity-remap (`email` / `name` /\n *   `externalIdentifier` / `attributesKey`) and the A09 `rules` — so a shallow replace of `claimMapping`\n *   while updating one would silently wipe the other.\n * - any non-object value (including ARRAYS, e.g. the A09 `rules` list) REPLACES wholesale — arrays are\n *   never merged element-wise.\n * - a `null` value DELETES the key (the established \"send null to unset\" convention).\n * - `__proto__` / `constructor` / `prototype` keys are skipped at EVERY level: they are never a legitimate\n *   config field and writing one through could pollute the object's prototype.\n */\nconst deepMergeConfiguration = (base: Record<string, unknown>, updates: Record<string, unknown>): Record<string, unknown> => {\n\tconst result: Record<string, unknown> = { ...base }\n\tfor (const [key, value] of Object.entries(updates)) {\n\t\tif (key === '__proto__' || key === 'constructor' || key === 'prototype') {\n\t\t\tcontinue\n\t\t}\n\t\tif (value === null) {\n\t\t\tdelete result[key]\n\t\t} else if (isRecord(value)) {\n\t\t\tconst existingChild = result[key]\n\t\t\tresult[key] = deepMergeConfiguration(isRecord(existingChild) ? existingChild : {}, value)\n\t\t} else {\n\t\t\tresult[key] = value\n\t\t}\n\t}\n\treturn result\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","IdentityProviderNotFoundError","ResponseError","InvalidIDPConfigurationError","IdentityProviderBySlugQuery","CreateIdpCommand","ResponseOk","DisableIdpCommand","EnableIdpCommand","UpdateIdpCommand","findRemovedRuleKeys","parseClaimMapping","findClaimMappingShapeErrors","validateClaimMappingMembership","IdentityProvidersQuery","isRecord"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,WAAW;AAAA,EACvB,YACkB,aACA,uBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,wBAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,aAAK,iCAAiC,gBAAgB,sBAAsB,IAAI,aAAa,GAAG,IAAI,aAAa;AACjH,cAAM,KAAK,wBAAwB,IAAI,aAAa;AAAA,MACrD,SAAS,GAAG;AACX,YAAI,aAAaC,8BAAAA,+BAA+B;AAC/C,iBAAO,IAAIC,SAAAA,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMF,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAIF,SAAAA,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMF,IAAG,WAAW,QAAQ,IAAIK,iBAAAA,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMF,IAAG,WAAW,QAAQ,IAAIO,kBAAAA,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMF,IAAG,WAAW,QAAQ,IAAIQ,iBAAAA,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAIF,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,mBAAmB,CAAC,KAAK,gBAC5B,SAAS,gBACR,qBAAqB,uBAAuB,SAAS,eAAe,KAAK,aAAa,IAAI,KAAK;AAEnG,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,eAAK,iCAAiC,gBAAgB,sBAAsB,gBAAgB,GAAG,gBAAgB;AAC/G,gBAAM,KAAK,wBAAwB,gBAAgB;AAAA,QACpD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMF,IAAG,WAAW;AAAA,QACnB,IAAIS,iBAAAA,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAIH,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAqBQ,iCAAiC,QAAY,WAA0C;AAC9F,UAAM,QAAQ,IAAI,IAAI,OAAO,KAAK,MAAM,CAAC;AACzC,UAAM,UAAU,OAAO,KAAK,SAAS,EAAE,OAAO,CAAA,QAAO,CAAC,MAAM,IAAI,GAAG,CAAC;AACpE,QAAI,QAAQ,SAAS,GAAG;AACvB,YAAM,IAAIH,6BAAAA;AAAAA,QACT,yBAAyB,QAAQ,WAAW,IAAI,aAAa,YAAY,IAAI,QAAQ,KAAK,IAAI,CAAC,YAClF,QAAQ,WAAW,IAAI,OAAO,MAAM,sDAAsD,QAAQ,WAAW,IAAI,OAAO,MAAM;AAAA,MAAA;AAAA,IAE7I;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,wBAAwB,eAAuD;AAC5F,UAAM,UAAUO,aAAAA,oBAAoB,aAAa;AACjD,QAAI,QAAQ,SAAS,GAAG;AACvB,YAAM,IAAIP,6BAAAA;AAAAA,QACT,mCAAmC,QAAQ,KAAK,IAAI,CAAC;AAAA,MAAA;AAAA,IAEvD;AACA,QAAI;AACJ,QAAI;AACH,gBAAUQ,aAAAA,kBAAkB,aAAa;AAAA,IAC1C,SAAS,GAAG;AACX,YAAM,IAAIR,6BAAAA,6BAA6B,yBAAyB,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,EAAE;AAAA,IAC7G;AACA,QAAI,CAAC,SAAS;AACb;AAAA,IACD;AAIA,UAAM,cAAcS,aAAAA,4BAA4B,OAAO;AACvD,QAAI,YAAY,SAAS,GAAG;AAC3B,YAAM,IAAIT,6BAAAA,6BAA6B,YAAY,CAAC,CAAC;AAAA,IACtD;AAQA,eAAW,QAAQ,QAAQ,OAAO;AACjC,YAAM,aAAa,KAAK;AACxB,UAAI,CAAC,YAAY;AAChB;AAAA,MACD;AACA,YAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW,OAAO;AAC5E,UAAI,CAAC,QAAQ;AACZ;AAAA,MACD;AACA,YAAM,SAASU,uBAAAA,+BAA+B,OAAO,KAAK,UAAU;AACpE,UAAI,OAAO,SAAS,GAAG;AACtB,cAAM,IAAIV,6BAAAA,6BAA6B,OAAO,CAAC,EAAE,OAAO;AAAA,MACzD;AAAA,IACD;AAAA,EACD;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIW,uBAAAA,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;AAgBA,MAAM,yBAAyB,CAAC,MAA+B,YAA8D;AAC5H,QAAM,SAAkC,EAAE,GAAG,KAAA;AAC7C,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AACnD,QAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,aAAa;AACxE;AAAA,IACD;AACA,QAAI,UAAU,MAAM;AACnB,aAAO,OAAO,GAAG;AAAA,IAClB,WAAWC,sBAAS,KAAK,GAAG;AAC3B,YAAM,gBAAgB,OAAO,GAAG;AAChC,aAAO,GAAG,IAAI,uBAAuBA,aAAAA,SAAS,aAAa,IAAI,gBAAgB,CAAA,GAAI,KAAK;AAAA,IACzF,OAAO;AACN,aAAO,GAAG,IAAI;AAAA,IACf;AAAA,EACD;AACA,SAAO;AACR;;"}