@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/production/src/model/service/idp/ClaimMapping.cjs

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const ClaimValueSource = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    /** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */
+    claim: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */
+    split: Typesafe__namespace.string,
+    /** For an array-of-objects claim, take this (dot-path) field from each element. */
+    pick: Typesafe__namespace.string,
+    /** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */
+    where: Typesafe__namespace.noExtraProps(Typesafe__namespace.object({
+      field: Typesafe__namespace.string,
+      equals: Typesafe__namespace.scalar
+    }))
+  })
+));
+const ClaimMappingVariable = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    name: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Constant values, set regardless of any claim (the original static form). */
+    values: Typesafe__namespace.array(Typesafe__namespace.string),
+    /** Derive (additional) values from a claim. */
+    from: ClaimValueSource,
+    /** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */
+    map: Typesafe__namespace.record(Typesafe__namespace.string, Typesafe__namespace.array(Typesafe__namespace.string)),
+    /** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */
+    passthrough: Typesafe__namespace.boolean,
+    /** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */
+    allow: Typesafe__namespace.array(Typesafe__namespace.string)
+  })
+));
+const ClaimMappingMembership = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    project: Typesafe__namespace.string,
+    role: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /**
+     * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)
+     * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).
+     */
+    variables: Typesafe__namespace.array(ClaimMappingVariable)
+  })
+));
+const ClaimMappingRule = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    /** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */
+    claim: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Match when the claim equals this value (array claims: when it contains this element). */
+    equals: Typesafe__namespace.scalar,
+    /** Match when the claim contains this value (substring for strings, element for arrays). */
+    contains: Typesafe__namespace.scalar,
+    /** Project membership to grant when the rule matches. */
+    grantMembership: ClaimMappingMembership
+  })
+));
+const ClaimMapping = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    rules: Typesafe__namespace.array(ClaimMappingRule)
+  }),
+  Typesafe__namespace.partial({
+    /**
+     * When to apply the mapping:
+     * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).
+     * - `sticky`           — apply only when the account is first created by auto-sign-up; existing
+     *                        accounts (including one being linked to this IdP for the first time) are
+     *                        left untouched.
+     */
+    syncPolicy: Typesafe__namespace.enumeration("always", "sticky"),
+    /**
+     * How to treat existing grants the mapping does NOT (re)assign on this sign-in:
+     * - `keep`   (default, safer) — leave pre-existing memberships untouched.
+     * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of
+     *              truth). Only ever touches grants the mapping itself could have made; memberships
+     *              outside the mapping's vocabulary are never removed.
+     */
+    unmatched: Typesafe__namespace.enumeration("keep", "remove")
+  })
+);
+const DEFAULT_SYNC_POLICY = "always";
+const DEFAULT_UNMATCHED = "keep";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseClaimMapping = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || raw.rules === void 0 || raw.rules === null) {
+    return null;
+  }
+  const input = { rules: raw.rules };
+  if (raw.syncPolicy !== void 0) {
+    input.syncPolicy = raw.syncPolicy;
+  }
+  if (raw.unmatched !== void 0) {
+    input.unmatched = raw.unmatched;
+  }
+  return ClaimMapping(input, ["claimMapping"]);
+};
+const REMOVED_RULE_KEYS = ["grantRoles"];
+const findRemovedRuleKeys = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || !Array.isArray(raw.rules)) {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Set();
+  for (const rule of raw.rules) {
+    if (isRecord(rule)) {
+      for (const key of REMOVED_RULE_KEYS) {
+        if (key in rule) {
+          found.add(key);
+        }
+      }
+    }
+  }
+  return [...found];
+};
+const findClaimMappingShapeErrors = (mapping) => {
+  const errors = [];
+  for (const rule of mapping.rules) {
+    if (rule.grantMembership === void 0) {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`
+      );
+    }
+    if (rule.equals !== void 0 && rule.contains !== void 0) {
+      errors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`);
+    }
+    if (typeof rule.equals === "string" && rule.equals.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    if (typeof rule.contains === "string" && rule.contains.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    for (const variable of rule.grantMembership?.variables ?? []) {
+      if (variable.from?.where !== void 0 && variable.from.pick === void 0) {
+        errors.push(
+          `claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`
+        );
+      }
+      if (variable.from?.split === "") {
+        errors.push(
+          `claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`
+        );
+      }
+    }
+  }
+  return errors;
+};
+exports.ClaimMapping = ClaimMapping;
+exports.ClaimMappingMembership = ClaimMappingMembership;
+exports.ClaimMappingRule = ClaimMappingRule;
+exports.ClaimMappingVariable = ClaimMappingVariable;
+exports.ClaimValueSource = ClaimValueSource;
+exports.DEFAULT_SYNC_POLICY = DEFAULT_SYNC_POLICY;
+exports.DEFAULT_UNMATCHED = DEFAULT_UNMATCHED;
+exports.findClaimMappingShapeErrors = findClaimMappingShapeErrors;
+exports.findRemovedRuleKeys = findRemovedRuleKeys;
+exports.isRecord = isRecord;
+exports.parseClaimMapping = parseClaimMapping;
+//# sourceMappingURL=ClaimMapping.cjs.map

package/dist/production/src/model/service/idp/ClaimMapping.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMapping.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\n/**\n * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).\n * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing\n * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`\n * already accept an opaque configuration object.\n *\n * The mapping grants **project memberships only** (a project role plus optional membership\n * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing\n * and granting them from external claims would be a privilege-escalation path, so global-role\n * mapping was dropped. A project membership stays within what the IdP configurer\n * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.\n *\n * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated\n * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only\n * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}\n * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.\n *\n * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,\n * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project\n * membership. Rules are independent and additive — every matching rule contributes; a\n * non-matching rule is simply skipped.\n *\n * Matching is declarative, never code:\n * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one\n *                of the elements).\n * - `contains` — the claim contains the value: substring for string claims, membership for array\n *                claims. This is the natural fit for multi-valued `groups`.\n * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).\n */\n/**\n * Where a membership variable's values come from when they are not constant. Reads one `claim` from the\n * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path\n * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:\n * - array claim       → its elements (`languages: ['cs','en']`)\n * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements\n * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their\n *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)\n *\n * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.\n */\nexport const ClaimValueSource = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */\n\t\tsplit: Typesafe.string,\n\t\t/** For an array-of-objects claim, take this (dot-path) field from each element. */\n\t\tpick: Typesafe.string,\n\t\t/** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */\n\t\twhere: Typesafe.noExtraProps(Typesafe.object({\n\t\t\tfield: Typesafe.string,\n\t\t\tequals: Typesafe.scalar,\n\t\t})),\n\t}),\n))\n\nexport type ClaimValueSource = ReturnType<typeof ClaimValueSource>\n\n/**\n * One membership variable to set on a granted membership. Either constant (`values`), claim-derived\n * (`from`), or both — the two sets are unioned. When derived from a claim:\n * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.\n *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…\n * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by\n *                   default: raw external claim values then flow straight into row-level ACL\n *                   variables, so enable it only when the variable legitimately holds claim values\n *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.\n * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).\n */\nexport const ClaimMappingVariable = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tname: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Constant values, set regardless of any claim (the original static form). */\n\t\tvalues: Typesafe.array(Typesafe.string),\n\t\t/** Derive (additional) values from a claim. */\n\t\tfrom: ClaimValueSource,\n\t\t/** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */\n\t\tmap: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),\n\t\t/** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */\n\t\tpassthrough: Typesafe.boolean,\n\t\t/** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */\n\t\tallow: Typesafe.array(Typesafe.string),\n\t}),\n))\n\nexport type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>\n\nexport const ClaimMappingMembership = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tproject: Typesafe.string,\n\t\trole: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)\n\t\t * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).\n\t\t */\n\t\tvariables: Typesafe.array(ClaimMappingVariable),\n\t}),\n))\n\nexport type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>\n\nexport const ClaimMappingRule = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Match when the claim equals this value (array claims: when it contains this element). */\n\t\tequals: Typesafe.scalar,\n\t\t/** Match when the claim contains this value (substring for strings, element for arrays). */\n\t\tcontains: Typesafe.scalar,\n\t\t/** Project membership to grant when the rule matches. */\n\t\tgrantMembership: ClaimMappingMembership,\n\t}),\n))\n\nexport type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>\n\n/**\n * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a\n * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only\n * `claimMapping` is treated as \"no role mapping\", not an error).\n */\nexport const ClaimMapping = Typesafe.intersection(\n\tTypesafe.object({\n\t\trules: Typesafe.array(ClaimMappingRule),\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * When to apply the mapping:\n\t\t * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).\n\t\t * - `sticky`           — apply only when the account is first created by auto-sign-up; existing\n\t\t *                        accounts (including one being linked to this IdP for the first time) are\n\t\t *                        left untouched.\n\t\t */\n\t\tsyncPolicy: Typesafe.enumeration('always', 'sticky'),\n\t\t/**\n\t\t * How to treat existing grants the mapping does NOT (re)assign on this sign-in:\n\t\t * - `keep`   (default, safer) — leave pre-existing memberships untouched.\n\t\t * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of\n\t\t *              truth). Only ever touches grants the mapping itself could have made; memberships\n\t\t *              outside the mapping's vocabulary are never removed.\n\t\t */\n\t\tunmatched: Typesafe.enumeration('keep', 'remove'),\n\t}),\n)\n\nexport type ClaimMapping = ReturnType<typeof ClaimMapping>\n\nexport const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']> = 'always'\nexport const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']> = 'keep'\n\nexport const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/**\n * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no\n * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no\n * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both\n * the pre-A09 sign-in path and the OIDC remap untouched.\n *\n * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the\n * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via\n * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required\n * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.\n *\n * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in\n * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is\n * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a\n * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object\n * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/\n * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)\n * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap\n * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),\n * not a strict object. The removed `grantRoles` key is still caught separately by\n * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic\n * extra-property error `noExtraProps` would otherwise raise.\n */\nexport const parseClaimMapping = (configuration: Record<string, unknown>): ClaimMapping | null => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || raw.rules === undefined || raw.rules === null) {\n\t\treturn null\n\t}\n\tconst input: Record<string, unknown> = { rules: raw.rules }\n\tif (raw.syncPolicy !== undefined) {\n\t\tinput.syncPolicy = raw.syncPolicy\n\t}\n\tif (raw.unmatched !== undefined) {\n\t\tinput.unmatched = raw.unmatched\n\t}\n\treturn ClaimMapping(input, ['claimMapping'])\n}\n\n/**\n * The set of A09 rule keys that were removed when global-role mapping was dropped. Detected\n * explicitly (rather than relying on Typesafe's generic \"extra property\" rejection) so a config\n * that still tries to grant global roles gets an actionable error.\n */\nconst REMOVED_RULE_KEYS = ['grantRoles'] as const\n\n/**\n * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,\n * so config-time validation can reject them with a clear message pointing at `grantMembership`.\n */\nexport const findRemovedRuleKeys = (configuration: Record<string, unknown>): string[] => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || !Array.isArray(raw.rules)) {\n\t\treturn []\n\t}\n\tconst found = new Set<string>()\n\tfor (const rule of raw.rules) {\n\t\tif (isRecord(rule)) {\n\t\t\tfor (const key of REMOVED_RULE_KEYS) {\n\t\t\t\tif (key in rule) {\n\t\t\t\t\tfound.add(key)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn [...found]\n}\n\n/**\n * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one\n * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a\n * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:\n * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`\n *   when both are set, so the other would be silently ignored);\n * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY\n *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the\n *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;\n * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*\n *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during\n *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,\n *   which the `partial` schema permits.)\n * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there\n *   is nothing to project, so the source can only ever resolve to no values;\n * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value\n *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).\n */\nexport const findClaimMappingShapeErrors = (mapping: ClaimMapping): string[] => {\n\tconst errors: string[] = []\n\tfor (const rule of mapping.rules) {\n\t\tif (rule.grantMembership === undefined) {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`,\n\t\t\t)\n\t\t}\n\t\tif (rule.equals !== undefined && rule.contains !== undefined) {\n\t\t\terrors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`)\n\t\t}\n\t\tif (typeof rule.equals === 'string' && rule.equals.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tif (typeof rule.contains === 'string' && rule.contains.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tfor (const variable of rule.grantMembership?.variables ?? []) {\n\t\t\tif (variable.from?.where !== undefined && variable.from.pick === undefined) {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`,\n\t\t\t\t)\n\t\t\t}\n\t\t\tif (variable.from?.split === '') {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\treturn errors\n}\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0CO,MAAM,mBAAmBA,oBAAS,aAAaA,oBAAS;AAAA,EAC9DA,oBAAS,OAAO;AAAA;AAAA,IAEf,OAAOA,oBAAS;AAAA,EAAA,CAChB;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,OAAOA,oBAAS;AAAA;AAAA,IAEhB,MAAMA,oBAAS;AAAA;AAAA,IAEf,OAAOA,oBAAS,aAAaA,oBAAS,OAAO;AAAA,MAC5C,OAAOA,oBAAS;AAAA,MAChB,QAAQA,oBAAS;AAAA,IAAA,CACjB,CAAC;AAAA,EAAA,CACF;AACF,CAAC;AAeM,MAAM,uBAAuBA,oBAAS,aAAaA,oBAAS;AAAA,EAClEA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS;AAAA,EAAA,CACf;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQA,oBAAS,MAAMA,oBAAS,MAAM;AAAA;AAAA,IAEtC,MAAM;AAAA;AAAA,IAEN,KAAKA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAMA,oBAAS,MAAM,CAAC;AAAA;AAAA,IAErE,aAAaA,oBAAS;AAAA;AAAA,IAEtB,OAAOA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAAA,CACrC;AACF,CAAC;AAIM,MAAM,yBAAyBA,oBAAS,aAAaA,oBAAS;AAAA,EACpEA,oBAAS,OAAO;AAAA,IACf,SAASA,oBAAS;AAAA,IAClB,MAAMA,oBAAS;AAAA,EAAA,CACf;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,WAAWA,oBAAS,MAAM,oBAAoB;AAAA,EAAA,CAC9C;AACF,CAAC;AAIM,MAAM,mBAAmBA,oBAAS,aAAaA,oBAAS;AAAA,EAC9DA,oBAAS,OAAO;AAAA;AAAA,IAEf,OAAOA,oBAAS;AAAA,EAAA,CAChB;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQA,oBAAS;AAAA;AAAA,IAEjB,UAAUA,oBAAS;AAAA;AAAA,IAEnB,iBAAiB;AAAA,EAAA,CACjB;AACF,CAAC;AASM,MAAM,eAAeA,oBAAS;AAAA,EACpCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS,MAAM,gBAAgB;AAAA,EAAA,CACtC;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQhB,YAAYA,oBAAS,YAAY,UAAU,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQnD,WAAWA,oBAAS,YAAY,QAAQ,QAAQ;AAAA,EAAA,CAChD;AACF;AAIO,MAAM,sBAA+D;AACrE,MAAM,oBAA4D;AAElE,MAAM,WAAW,CAAC,UAAqD,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAyB1I,MAAM,oBAAoB,CAAC,kBAAgE;AACjG,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,IAAI,UAAU,UAAa,IAAI,UAAU,MAAM;AACpE,WAAO;AAAA,EACR;AACA,QAAM,QAAiC,EAAE,OAAO,IAAI,MAAA;AACpD,MAAI,IAAI,eAAe,QAAW;AACjC,UAAM,aAAa,IAAI;AAAA,EACxB;AACA,MAAI,IAAI,cAAc,QAAW;AAChC,UAAM,YAAY,IAAI;AAAA,EACvB;AACA,SAAO,aAAa,OAAO,CAAC,cAAc,CAAC;AAC5C;AAOA,MAAM,oBAAoB,CAAC,YAAY;AAMhC,MAAM,sBAAsB,CAAC,kBAAqD;AACxF,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,QAAQ,IAAI,KAAK,GAAG;AAChD,WAAO,CAAA;AAAA,EACR;AACA,QAAM,4BAAY,IAAA;AAClB,aAAW,QAAQ,IAAI,OAAO;AAC7B,QAAI,SAAS,IAAI,GAAG;AACnB,iBAAW,OAAO,mBAAmB;AACpC,YAAI,OAAO,MAAM;AAChB,gBAAM,IAAI,GAAG;AAAA,QACd;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,SAAO,CAAC,GAAG,KAAK;AACjB;AAoBO,MAAM,8BAA8B,CAAC,YAAoC;AAC/E,QAAM,SAAmB,CAAA;AACzB,aAAW,QAAQ,QAAQ,OAAO;AACjC,QAAI,KAAK,oBAAoB,QAAW;AACvC,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,KAAK,WAAW,UAAa,KAAK,aAAa,QAAW;AAC7D,aAAO,KAAK,gCAAgC,KAAK,KAAK,iEAAiE;AAAA,IACxH;AACA,QAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAA,MAAW,IAAI;AACjE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAA,MAAW,IAAI;AACrE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,eAAW,YAAY,KAAK,iBAAiB,aAAa,CAAA,GAAI;AAC7D,UAAI,SAAS,MAAM,UAAU,UAAa,SAAS,KAAK,SAAS,QAAW;AAC3E,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AACA,UAAI,SAAS,MAAM,UAAU,IAAI;AAChC,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AAAA,IACD;AAAA,EACD;AACA,SAAO;AACR;;;;;;;;;;;;"}

package/dist/production/src/model/service/idp/ClaimMapping.js

@@ -0,0 +1,170 @@
+import * as Typesafe from "@contember/typesafe";
+const ClaimValueSource = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    /** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */
+    claim: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */
+    split: Typesafe.string,
+    /** For an array-of-objects claim, take this (dot-path) field from each element. */
+    pick: Typesafe.string,
+    /** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */
+    where: Typesafe.noExtraProps(Typesafe.object({
+      field: Typesafe.string,
+      equals: Typesafe.scalar
+    }))
+  })
+));
+const ClaimMappingVariable = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    name: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Constant values, set regardless of any claim (the original static form). */
+    values: Typesafe.array(Typesafe.string),
+    /** Derive (additional) values from a claim. */
+    from: ClaimValueSource,
+    /** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */
+    map: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),
+    /** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */
+    passthrough: Typesafe.boolean,
+    /** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */
+    allow: Typesafe.array(Typesafe.string)
+  })
+));
+const ClaimMappingMembership = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    project: Typesafe.string,
+    role: Typesafe.string
+  }),
+  Typesafe.partial({
+    /**
+     * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)
+     * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).
+     */
+    variables: Typesafe.array(ClaimMappingVariable)
+  })
+));
+const ClaimMappingRule = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    /** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */
+    claim: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Match when the claim equals this value (array claims: when it contains this element). */
+    equals: Typesafe.scalar,
+    /** Match when the claim contains this value (substring for strings, element for arrays). */
+    contains: Typesafe.scalar,
+    /** Project membership to grant when the rule matches. */
+    grantMembership: ClaimMappingMembership
+  })
+));
+const ClaimMapping = Typesafe.intersection(
+  Typesafe.object({
+    rules: Typesafe.array(ClaimMappingRule)
+  }),
+  Typesafe.partial({
+    /**
+     * When to apply the mapping:
+     * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).
+     * - `sticky`           — apply only when the account is first created by auto-sign-up; existing
+     *                        accounts (including one being linked to this IdP for the first time) are
+     *                        left untouched.
+     */
+    syncPolicy: Typesafe.enumeration("always", "sticky"),
+    /**
+     * How to treat existing grants the mapping does NOT (re)assign on this sign-in:
+     * - `keep`   (default, safer) — leave pre-existing memberships untouched.
+     * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of
+     *              truth). Only ever touches grants the mapping itself could have made; memberships
+     *              outside the mapping's vocabulary are never removed.
+     */
+    unmatched: Typesafe.enumeration("keep", "remove")
+  })
+);
+const DEFAULT_SYNC_POLICY = "always";
+const DEFAULT_UNMATCHED = "keep";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseClaimMapping = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || raw.rules === void 0 || raw.rules === null) {
+    return null;
+  }
+  const input = { rules: raw.rules };
+  if (raw.syncPolicy !== void 0) {
+    input.syncPolicy = raw.syncPolicy;
+  }
+  if (raw.unmatched !== void 0) {
+    input.unmatched = raw.unmatched;
+  }
+  return ClaimMapping(input, ["claimMapping"]);
+};
+const REMOVED_RULE_KEYS = ["grantRoles"];
+const findRemovedRuleKeys = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || !Array.isArray(raw.rules)) {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Set();
+  for (const rule of raw.rules) {
+    if (isRecord(rule)) {
+      for (const key of REMOVED_RULE_KEYS) {
+        if (key in rule) {
+          found.add(key);
+        }
+      }
+    }
+  }
+  return [...found];
+};
+const findClaimMappingShapeErrors = (mapping) => {
+  const errors = [];
+  for (const rule of mapping.rules) {
+    if (rule.grantMembership === void 0) {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`
+      );
+    }
+    if (rule.equals !== void 0 && rule.contains !== void 0) {
+      errors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`);
+    }
+    if (typeof rule.equals === "string" && rule.equals.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    if (typeof rule.contains === "string" && rule.contains.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    for (const variable of rule.grantMembership?.variables ?? []) {
+      if (variable.from?.where !== void 0 && variable.from.pick === void 0) {
+        errors.push(
+          `claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`
+        );
+      }
+      if (variable.from?.split === "") {
+        errors.push(
+          `claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`
+        );
+      }
+    }
+  }
+  return errors;
+};
+export {
+  ClaimMapping,
+  ClaimMappingMembership,
+  ClaimMappingRule,
+  ClaimMappingVariable,
+  ClaimValueSource,
+  DEFAULT_SYNC_POLICY,
+  DEFAULT_UNMATCHED,
+  findClaimMappingShapeErrors,
+  findRemovedRuleKeys,
+  isRecord,
+  parseClaimMapping
+};
+//# sourceMappingURL=ClaimMapping.js.map

package/dist/production/src/model/service/idp/ClaimMapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMapping.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\n/**\n * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).\n * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing\n * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`\n * already accept an opaque configuration object.\n *\n * The mapping grants **project memberships only** (a project role plus optional membership\n * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing\n * and granting them from external claims would be a privilege-escalation path, so global-role\n * mapping was dropped. A project membership stays within what the IdP configurer\n * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.\n *\n * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated\n * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only\n * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}\n * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.\n *\n * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,\n * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project\n * membership. Rules are independent and additive — every matching rule contributes; a\n * non-matching rule is simply skipped.\n *\n * Matching is declarative, never code:\n * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one\n *                of the elements).\n * - `contains` — the claim contains the value: substring for string claims, membership for array\n *                claims. This is the natural fit for multi-valued `groups`.\n * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).\n */\n/**\n * Where a membership variable's values come from when they are not constant. Reads one `claim` from the\n * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path\n * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:\n * - array claim       → its elements (`languages: ['cs','en']`)\n * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements\n * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their\n *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)\n *\n * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.\n */\nexport const ClaimValueSource = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */\n\t\tsplit: Typesafe.string,\n\t\t/** For an array-of-objects claim, take this (dot-path) field from each element. */\n\t\tpick: Typesafe.string,\n\t\t/** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */\n\t\twhere: Typesafe.noExtraProps(Typesafe.object({\n\t\t\tfield: Typesafe.string,\n\t\t\tequals: Typesafe.scalar,\n\t\t})),\n\t}),\n))\n\nexport type ClaimValueSource = ReturnType<typeof ClaimValueSource>\n\n/**\n * One membership variable to set on a granted membership. Either constant (`values`), claim-derived\n * (`from`), or both — the two sets are unioned. When derived from a claim:\n * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.\n *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…\n * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by\n *                   default: raw external claim values then flow straight into row-level ACL\n *                   variables, so enable it only when the variable legitimately holds claim values\n *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.\n * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).\n */\nexport const ClaimMappingVariable = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tname: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Constant values, set regardless of any claim (the original static form). */\n\t\tvalues: Typesafe.array(Typesafe.string),\n\t\t/** Derive (additional) values from a claim. */\n\t\tfrom: ClaimValueSource,\n\t\t/** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */\n\t\tmap: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),\n\t\t/** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */\n\t\tpassthrough: Typesafe.boolean,\n\t\t/** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */\n\t\tallow: Typesafe.array(Typesafe.string),\n\t}),\n))\n\nexport type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>\n\nexport const ClaimMappingMembership = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tproject: Typesafe.string,\n\t\trole: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)\n\t\t * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).\n\t\t */\n\t\tvariables: Typesafe.array(ClaimMappingVariable),\n\t}),\n))\n\nexport type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>\n\nexport const ClaimMappingRule = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Match when the claim equals this value (array claims: when it contains this element). */\n\t\tequals: Typesafe.scalar,\n\t\t/** Match when the claim contains this value (substring for strings, element for arrays). */\n\t\tcontains: Typesafe.scalar,\n\t\t/** Project membership to grant when the rule matches. */\n\t\tgrantMembership: ClaimMappingMembership,\n\t}),\n))\n\nexport type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>\n\n/**\n * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a\n * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only\n * `claimMapping` is treated as \"no role mapping\", not an error).\n */\nexport const ClaimMapping = Typesafe.intersection(\n\tTypesafe.object({\n\t\trules: Typesafe.array(ClaimMappingRule),\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * When to apply the mapping:\n\t\t * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).\n\t\t * - `sticky`           — apply only when the account is first created by auto-sign-up; existing\n\t\t *                        accounts (including one being linked to this IdP for the first time) are\n\t\t *                        left untouched.\n\t\t */\n\t\tsyncPolicy: Typesafe.enumeration('always', 'sticky'),\n\t\t/**\n\t\t * How to treat existing grants the mapping does NOT (re)assign on this sign-in:\n\t\t * - `keep`   (default, safer) — leave pre-existing memberships untouched.\n\t\t * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of\n\t\t *              truth). Only ever touches grants the mapping itself could have made; memberships\n\t\t *              outside the mapping's vocabulary are never removed.\n\t\t */\n\t\tunmatched: Typesafe.enumeration('keep', 'remove'),\n\t}),\n)\n\nexport type ClaimMapping = ReturnType<typeof ClaimMapping>\n\nexport const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']> = 'always'\nexport const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']> = 'keep'\n\nexport const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/**\n * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no\n * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no\n * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both\n * the pre-A09 sign-in path and the OIDC remap untouched.\n *\n * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the\n * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via\n * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required\n * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.\n *\n * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in\n * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is\n * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a\n * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object\n * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/\n * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)\n * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap\n * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),\n * not a strict object. The removed `grantRoles` key is still caught separately by\n * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic\n * extra-property error `noExtraProps` would otherwise raise.\n */\nexport const parseClaimMapping = (configuration: Record<string, unknown>): ClaimMapping | null => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || raw.rules === undefined || raw.rules === null) {\n\t\treturn null\n\t}\n\tconst input: Record<string, unknown> = { rules: raw.rules }\n\tif (raw.syncPolicy !== undefined) {\n\t\tinput.syncPolicy = raw.syncPolicy\n\t}\n\tif (raw.unmatched !== undefined) {\n\t\tinput.unmatched = raw.unmatched\n\t}\n\treturn ClaimMapping(input, ['claimMapping'])\n}\n\n/**\n * The set of A09 rule keys that were removed when global-role mapping was dropped. Detected\n * explicitly (rather than relying on Typesafe's generic \"extra property\" rejection) so a config\n * that still tries to grant global roles gets an actionable error.\n */\nconst REMOVED_RULE_KEYS = ['grantRoles'] as const\n\n/**\n * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,\n * so config-time validation can reject them with a clear message pointing at `grantMembership`.\n */\nexport const findRemovedRuleKeys = (configuration: Record<string, unknown>): string[] => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || !Array.isArray(raw.rules)) {\n\t\treturn []\n\t}\n\tconst found = new Set<string>()\n\tfor (const rule of raw.rules) {\n\t\tif (isRecord(rule)) {\n\t\t\tfor (const key of REMOVED_RULE_KEYS) {\n\t\t\t\tif (key in rule) {\n\t\t\t\t\tfound.add(key)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn [...found]\n}\n\n/**\n * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one\n * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a\n * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:\n * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`\n *   when both are set, so the other would be silently ignored);\n * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY\n *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the\n *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;\n * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*\n *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during\n *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,\n *   which the `partial` schema permits.)\n * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there\n *   is nothing to project, so the source can only ever resolve to no values;\n * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value\n *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).\n */\nexport const findClaimMappingShapeErrors = (mapping: ClaimMapping): string[] => {\n\tconst errors: string[] = []\n\tfor (const rule of mapping.rules) {\n\t\tif (rule.grantMembership === undefined) {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`,\n\t\t\t)\n\t\t}\n\t\tif (rule.equals !== undefined && rule.contains !== undefined) {\n\t\t\terrors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`)\n\t\t}\n\t\tif (typeof rule.equals === 'string' && rule.equals.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tif (typeof rule.contains === 'string' && rule.contains.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tfor (const variable of rule.grantMembership?.variables ?? []) {\n\t\t\tif (variable.from?.where !== undefined && variable.from.pick === undefined) {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`,\n\t\t\t\t)\n\t\t\t}\n\t\t\tif (variable.from?.split === '') {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\treturn errors\n}\n"],"names":[],"mappings":";AA0CO,MAAM,mBAAmB,SAAS,aAAa,SAAS;AAAA,EAC9D,SAAS,OAAO;AAAA;AAAA,IAEf,OAAO,SAAS;AAAA,EAAA,CAChB;AAAA,EACD,SAAS,QAAQ;AAAA;AAAA,IAEhB,OAAO,SAAS;AAAA;AAAA,IAEhB,MAAM,SAAS;AAAA;AAAA,IAEf,OAAO,SAAS,aAAa,SAAS,OAAO;AAAA,MAC5C,OAAO,SAAS;AAAA,MAChB,QAAQ,SAAS;AAAA,IAAA,CACjB,CAAC;AAAA,EAAA,CACF;AACF,CAAC;AAeM,MAAM,uBAAuB,SAAS,aAAa,SAAS;AAAA,EAClE,SAAS,OAAO;AAAA,IACf,MAAM,SAAS;AAAA,EAAA,CACf;AAAA,EACD,SAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQ,SAAS,MAAM,SAAS,MAAM;AAAA;AAAA,IAEtC,MAAM;AAAA;AAAA,IAEN,KAAK,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM,SAAS,MAAM,CAAC;AAAA;AAAA,IAErE,aAAa,SAAS;AAAA;AAAA,IAEtB,OAAO,SAAS,MAAM,SAAS,MAAM;AAAA,EAAA,CACrC;AACF,CAAC;AAIM,MAAM,yBAAyB,SAAS,aAAa,SAAS;AAAA,EACpE,SAAS,OAAO;AAAA,IACf,SAAS,SAAS;AAAA,IAClB,MAAM,SAAS;AAAA,EAAA,CACf;AAAA,EACD,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,WAAW,SAAS,MAAM,oBAAoB;AAAA,EAAA,CAC9C;AACF,CAAC;AAIM,MAAM,mBAAmB,SAAS,aAAa,SAAS;AAAA,EAC9D,SAAS,OAAO;AAAA;AAAA,IAEf,OAAO,SAAS;AAAA,EAAA,CAChB;AAAA,EACD,SAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQ,SAAS;AAAA;AAAA,IAEjB,UAAU,SAAS;AAAA;AAAA,IAEnB,iBAAiB;AAAA,EAAA,CACjB;AACF,CAAC;AASM,MAAM,eAAe,SAAS;AAAA,EACpC,SAAS,OAAO;AAAA,IACf,OAAO,SAAS,MAAM,gBAAgB;AAAA,EAAA,CACtC;AAAA,EACD,SAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQhB,YAAY,SAAS,YAAY,UAAU,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQnD,WAAW,SAAS,YAAY,QAAQ,QAAQ;AAAA,EAAA,CAChD;AACF;AAIO,MAAM,sBAA+D;AACrE,MAAM,oBAA4D;AAElE,MAAM,WAAW,CAAC,UAAqD,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAyB1I,MAAM,oBAAoB,CAAC,kBAAgE;AACjG,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,IAAI,UAAU,UAAa,IAAI,UAAU,MAAM;AACpE,WAAO;AAAA,EACR;AACA,QAAM,QAAiC,EAAE,OAAO,IAAI,MAAA;AACpD,MAAI,IAAI,eAAe,QAAW;AACjC,UAAM,aAAa,IAAI;AAAA,EACxB;AACA,MAAI,IAAI,cAAc,QAAW;AAChC,UAAM,YAAY,IAAI;AAAA,EACvB;AACA,SAAO,aAAa,OAAO,CAAC,cAAc,CAAC;AAC5C;AAOA,MAAM,oBAAoB,CAAC,YAAY;AAMhC,MAAM,sBAAsB,CAAC,kBAAqD;AACxF,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,QAAQ,IAAI,KAAK,GAAG;AAChD,WAAO,CAAA;AAAA,EACR;AACA,QAAM,4BAAY,IAAA;AAClB,aAAW,QAAQ,IAAI,OAAO;AAC7B,QAAI,SAAS,IAAI,GAAG;AACnB,iBAAW,OAAO,mBAAmB;AACpC,YAAI,OAAO,MAAM;AAChB,gBAAM,IAAI,GAAG;AAAA,QACd;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,SAAO,CAAC,GAAG,KAAK;AACjB;AAoBO,MAAM,8BAA8B,CAAC,YAAoC;AAC/E,QAAM,SAAmB,CAAA;AACzB,aAAW,QAAQ,QAAQ,OAAO;AACjC,QAAI,KAAK,oBAAoB,QAAW;AACvC,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,KAAK,WAAW,UAAa,KAAK,aAAa,QAAW;AAC7D,aAAO,KAAK,gCAAgC,KAAK,KAAK,iEAAiE;AAAA,IACxH;AACA,QAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAA,MAAW,IAAI;AACjE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAA,MAAW,IAAI;AACrE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,eAAW,YAAY,KAAK,iBAAiB,aAAa,CAAA,GAAI;AAC7D,UAAI,SAAS,MAAM,UAAU,UAAa,SAAS,KAAK,SAAS,QAAW;AAC3E,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AACA,UAAI,SAAS,MAAM,UAAU,IAAI;AAChC,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AAAA,IACD;AAAA,EACD;AACA,SAAO;AACR;"}

package/dist/production/src/model/service/idp/ClaimMappingEvaluator.cjs

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ClaimMapping = require("./ClaimMapping.cjs");
+const evaluateClaimMapping = (mapping, claims) => {
+  const membershipByKey = /* @__PURE__ */ new Map();
+  for (const rule of mapping.rules) {
+    if (!ruleMatches(rule, resolvePath(claims, rule.claim))) {
+      continue;
+    }
+    if (rule.grantMembership) {
+      const membership = toMembership(rule.grantMembership, claims);
+      const key = JSON.stringify([membership.project, membership.role]);
+      const existing = membershipByKey.get(key);
+      membershipByKey.set(key, existing ? mergeMembershipVariables(existing, membership) : membership);
+    }
+  }
+  return [...membershipByKey.values()];
+};
+const toMembership = (membership, claims) => ({
+  project: membership.project,
+  role: membership.role,
+  // Union by name so a single grant that lists the same variable twice (e.g. two `locale` entries)
+  // combines their values into one entry, rather than emitting duplicate entries that would later race
+  // and clobber each other when each is written as a full-replace of the same (membership, variable).
+  variables: unionVariablesByName(
+    (membership.variables ?? []).map((variable) => ({ name: variable.name, values: resolveVariableValues(variable, claims) }))
+  )
+});
+const mergeMembershipVariables = (a, b) => ({
+  project: a.project,
+  role: a.role,
+  variables: unionVariablesByName([...a.variables, ...b.variables])
+});
+const unionVariablesByName = (variables) => {
+  const valuesByName = /* @__PURE__ */ new Map();
+  for (const variable of variables) {
+    const values = valuesByName.get(variable.name) ?? /* @__PURE__ */ new Set();
+    for (const value of variable.values) {
+      values.add(value);
+    }
+    valuesByName.set(variable.name, values);
+  }
+  return [...valuesByName].map(([name, values]) => ({ name, values: [...values].sort() }));
+};
+const resolveVariableValues = (variable, claims) => {
+  const values = new Set(variable.values ?? []);
+  if (variable.from) {
+    const allow = variable.allow ? new Set(variable.allow) : null;
+    for (const raw of extractClaimValues(variable.from, claims)) {
+      const mapped = variable.map && Object.prototype.hasOwnProperty.call(variable.map, raw) ? variable.map[raw] : variable.passthrough ? [raw] : [];
+      for (const value of mapped) {
+        if (!allow || allow.has(value)) {
+          values.add(value);
+        }
+      }
+    }
+  }
+  return [...values];
+};
+const extractClaimValues = (source, claims) => {
+  const resolved = resolvePath(claims, source.claim);
+  const items = Array.isArray(resolved) ? resolved : [resolved];
+  const out = [];
+  for (const item of items) {
+    let value = item;
+    if (source.where !== void 0 || source.pick !== void 0) {
+      if (!ClaimMapping.isRecord(item)) {
+        continue;
+      }
+      if (source.where && !scalarEquals(resolvePath(item, source.where.field), source.where.equals)) {
+        continue;
+      }
+      value = source.pick !== void 0 ? resolvePath(item, source.pick) : void 0;
+    }
+    if (typeof value === "string" && source.split !== void 0) {
+      for (const part of value.split(source.split)) {
+        const trimmed = part.trim();
+        if (trimmed.length > 0) {
+          out.push(trimmed);
+        }
+      }
+      continue;
+    }
+    const scalar = coerceToString(value);
+    if (scalar !== null) {
+      out.push(scalar);
+    }
+  }
+  return [...new Set(out)];
+};
+const resolvePath = (root, path) => {
+  if (ClaimMapping.isRecord(root) && Object.prototype.hasOwnProperty.call(root, path)) {
+    return root[path];
+  }
+  let current = root;
+  for (const key of path.split(".")) {
+    if (!ClaimMapping.isRecord(current) || !Object.prototype.hasOwnProperty.call(current, key)) {
+      return void 0;
+    }
+    current = current[key];
+  }
+  return current;
+};
+const coerceToString = (value) => {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return String(value);
+  }
+  return null;
+};
+const ruleMatches = (rule, claimValue) => {
+  if (rule.equals !== void 0) {
+    return matchEquals(claimValue, rule.equals);
+  }
+  if (rule.contains !== void 0) {
+    return matchContains(claimValue, rule.contains);
+  }
+  if (claimValue === void 0 || claimValue === null || claimValue === false || claimValue === "") {
+    return false;
+  }
+  if (Array.isArray(claimValue)) {
+    return claimValue.length > 0;
+  }
+  return true;
+};
+const matchEquals = (claimValue, expected) => {
+  if (Array.isArray(claimValue)) {
+    return claimValue.some((it) => scalarEquals(it, expected));
+  }
+  return scalarEquals(claimValue, expected);
+};
+const matchContains = (claimValue, needle) => {
+  if (needle === "") {
+    return false;
+  }
+  if (Array.isArray(claimValue)) {
+    return claimValue.some((it) => scalarEquals(it, needle));
+  }
+  if (typeof claimValue === "string" && typeof needle === "string") {
+    return claimValue.includes(needle);
+  }
+  return scalarEquals(claimValue, needle);
+};
+const scalarEquals = (value, expected) => {
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) {
+    return value === expected;
+  }
+  return false;
+};
+exports.evaluateClaimMapping = evaluateClaimMapping;
+exports.extractClaimValues = extractClaimValues;
+exports.resolveVariableValues = resolveVariableValues;
+//# sourceMappingURL=ClaimMappingEvaluator.cjs.map

package/dist/production/src/model/service/idp/ClaimMappingEvaluator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMappingEvaluator.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMappingEvaluator.ts"],"sourcesContent":["import { ClaimMapping, ClaimMappingMembership, ClaimMappingRule, ClaimMappingVariable, ClaimValueSource, isRecord } from './ClaimMapping.js'\n\nexport type MappedMembership = {\n\treadonly project: string\n\treadonly role: string\n\treadonly variables: readonly { readonly name: string; readonly values: readonly string[] }[]\n}\n\n/**\n * Evaluate every rule of a claim mapping against the claims of an IdP response and collect the union\n * of granted project memberships (keyed implicitly by (project, role)). Pure: no DB, no side effects —\n * the caller decides how to apply the result (and whether to add-only or replace, per `unmatched`).\n */\nexport const evaluateClaimMapping = (mapping: ClaimMapping, claims: Record<string, unknown>): MappedMembership[] => {\n\tconst membershipByKey = new Map<string, MappedMembership>()\n\n\tfor (const rule of mapping.rules) {\n\t\tif (!ruleMatches(rule, resolvePath(claims, rule.claim))) {\n\t\t\tcontinue\n\t\t}\n\t\tif (rule.grantMembership) {\n\t\t\tconst membership = toMembership(rule.grantMembership, claims)\n\t\t\t// JSON-encode the (project, role) pair so the dedup key can't collide on a delimiter that a\n\t\t\t// slug could itself contain (a plain `${project}::${role}` would fold `a::b`/`c` into `a`/`b::c`).\n\t\t\tconst key = JSON.stringify([membership.project, membership.role])\n\t\t\tconst existing = membershipByKey.get(key)\n\t\t\tmembershipByKey.set(key, existing ? mergeMembershipVariables(existing, membership) : membership)\n\t\t}\n\t}\n\n\treturn [...membershipByKey.values()]\n}\n\nconst toMembership = (membership: ClaimMappingMembership, claims: Record<string, unknown>): MappedMembership => ({\n\tproject: membership.project,\n\trole: membership.role,\n\t// Union by name so a single grant that lists the same variable twice (e.g. two `locale` entries)\n\t// combines their values into one entry, rather than emitting duplicate entries that would later race\n\t// and clobber each other when each is written as a full-replace of the same (membership, variable).\n\tvariables: unionVariablesByName(\n\t\t(membership.variables ?? []).map(variable => ({ name: variable.name, values: resolveVariableValues(variable, claims) })),\n\t),\n})\n\n/**\n * Merge two grants of the same (project, role) by unioning their membership variables per name — so\n * several matching rules granting the same membership combine their variables (consistent with how\n * global roles union), rather than the last rule silently overwriting the variables of the earlier ones.\n */\nconst mergeMembershipVariables = (a: MappedMembership, b: MappedMembership): MappedMembership => ({\n\tproject: a.project,\n\trole: a.role,\n\tvariables: unionVariablesByName([...a.variables, ...b.variables]),\n})\n\n/**\n * Union a list of membership variables by name: several entries for the same variable name — whether from\n * one grant listing it twice or from several rules granting the same membership — combine their values into\n * a single entry. Values are de-duplicated and SORTED so the result is canonical: the same effective grant\n * always yields the same value array regardless of claim/rule order. That keeps the persisted JSON stable\n * (no redundant rewrite when an IdP returns a multi-valued claim in a different order across sign-ins) and\n * the audit delta order-insensitive. Variable entries keep first-seen order.\n */\nconst unionVariablesByName = (\n\tvariables: readonly { readonly name: string; readonly values: readonly string[] }[],\n): { name: string; values: string[] }[] => {\n\tconst valuesByName = new Map<string, Set<string>>()\n\tfor (const variable of variables) {\n\t\tconst values = valuesByName.get(variable.name) ?? new Set<string>()\n\t\tfor (const value of variable.values) {\n\t\t\tvalues.add(value)\n\t\t}\n\t\tvaluesByName.set(variable.name, values)\n\t}\n\treturn [...valuesByName].map(([name, values]) => ({ name, values: [...values].sort() }))\n}\n\n/**\n * Resolve a membership variable to its final string values: constant `values` (always kept) unioned\n * with values derived from `from` (extracted from the claims, then mapped / passed through / allow-\n * filtered). Pure; an empty result simply means the variable is not applied — `IDPClaimSyncService`\n * drops empty-valued variables so an empty `set` never soft-deletes the membership.\n */\nexport const resolveVariableValues = (variable: ClaimMappingVariable, claims: Record<string, unknown>): string[] => {\n\tconst values = new Set<string>(variable.values ?? [])\n\tif (variable.from) {\n\t\tconst allow = variable.allow ? new Set(variable.allow) : null\n\t\tfor (const raw of extractClaimValues(variable.from, claims)) {\n\t\t\t// `raw` is an external claim value used as a `map` key — look it up as an OWN property only.\n\t\t\t// A plain `map?.[raw]` would let a hostile claim like `__proto__` / `constructor` resolve to an\n\t\t\t// inherited prototype member (a non-array object/function), which then slips past `?? []` and\n\t\t\t// throws `not iterable` in the loop below — aborting the sign-in transaction.\n\t\t\tconst mapped = variable.map && Object.prototype.hasOwnProperty.call(variable.map, raw)\n\t\t\t\t? variable.map[raw]\n\t\t\t\t: (variable.passthrough ? [raw] : [])\n\t\t\tfor (const value of mapped) {\n\t\t\t\tif (!allow || allow.has(value)) {\n\t\t\t\t\tvalues.add(value)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn [...values]\n}\n\n/**\n * Extract a flat, de-duplicated list of string values from a single claim per a {@link ClaimValueSource}:\n * resolves the (possibly nested) claim, normalises scalar/array, optionally filters + projects an\n * array of objects (`where` / `pick`), and optionally splits a delimited string (`split`). Non-scalar\n * leaves (objects, null/undefined) are skipped; finite numbers are coerced to their string form.\n */\nexport const extractClaimValues = (source: ClaimValueSource, claims: Record<string, unknown>): string[] => {\n\tconst resolved = resolvePath(claims, source.claim)\n\tconst items: unknown[] = Array.isArray(resolved) ? resolved : [resolved]\n\tconst out: string[] = []\n\tfor (const item of items) {\n\t\tlet value: unknown = item\n\t\tif (source.where !== undefined || source.pick !== undefined) {\n\t\t\tif (!isRecord(item)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif (source.where && !scalarEquals(resolvePath(item, source.where.field), source.where.equals)) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tvalue = source.pick !== undefined ? resolvePath(item, source.pick) : undefined\n\t\t}\n\t\tif (typeof value === 'string' && source.split !== undefined) {\n\t\t\tfor (const part of value.split(source.split)) {\n\t\t\t\tconst trimmed = part.trim()\n\t\t\t\tif (trimmed.length > 0) {\n\t\t\t\t\tout.push(trimmed)\n\t\t\t\t}\n\t\t\t}\n\t\t\tcontinue\n\t\t}\n\t\tconst scalar = coerceToString(value)\n\t\tif (scalar !== null) {\n\t\t\tout.push(scalar)\n\t\t}\n\t}\n\treturn [...new Set(out)]\n}\n\n/**\n * Resolve a claim name — a rule's `claim` and a variable's `from.claim` / `pick` / `where.field` all\n * use this same lookup. The EXACT name is tried first, so a claim whose name literally contains dots\n * (URL-namespaced, e.g. Auth0's `https://example.com/roles`) stays addressable and wins over a nested\n * path of the same spelling; only then is the name treated as a dot-path into nested objects\n * (`realm_access.roles`). Own-property only at every step: never descend into inherited members, so a\n * claim object can't surface `Object.prototype` via a `__proto__` segment (and a configured path can't\n * read a prototype member).\n */\nconst resolvePath = (root: unknown, path: string): unknown => {\n\tif (isRecord(root) && Object.prototype.hasOwnProperty.call(root, path)) {\n\t\treturn root[path]\n\t}\n\tlet current: unknown = root\n\tfor (const key of path.split('.')) {\n\t\tif (!isRecord(current) || !Object.prototype.hasOwnProperty.call(current, key)) {\n\t\t\treturn undefined\n\t\t}\n\t\tcurrent = current[key]\n\t}\n\treturn current\n}\n\nconst coerceToString = (value: unknown): string | null => {\n\tif (typeof value === 'string') {\n\t\treturn value\n\t}\n\tif (typeof value === 'number' && Number.isFinite(value)) {\n\t\treturn String(value)\n\t}\n\treturn null\n}\n\nconst ruleMatches = (rule: ClaimMappingRule, claimValue: unknown): boolean => {\n\tif (rule.equals !== undefined) {\n\t\treturn matchEquals(claimValue, rule.equals)\n\t}\n\tif (rule.contains !== undefined) {\n\t\treturn matchContains(claimValue, rule.contains)\n\t}\n\t// No condition: match on mere PRESENCE of a non-empty value. Treated as absent: `undefined` / `null`\n\t// (claim not present), the boolean `false` (a `groups`-style flag only grants when truthy), an empty\n\t// array (e.g. `groups: []` — the user is in no group), and an empty string. \"Presence\" therefore means\n\t// the claim actually carries a value, not merely that the field exists but is empty.\n\tif (claimValue === undefined || claimValue === null || claimValue === false || claimValue === '') {\n\t\treturn false\n\t}\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.length > 0\n\t}\n\treturn true\n}\n\nconst matchEquals = (claimValue: unknown, expected: string | number | boolean | null): boolean => {\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.some(it => scalarEquals(it, expected))\n\t}\n\treturn scalarEquals(claimValue, expected)\n}\n\nconst matchContains = (claimValue: unknown, needle: string | number | boolean | null): boolean => {\n\t// An empty-string needle would substring-match EVERY string claim (`s.includes('') === true`) — a\n\t// match-everyone grant to every user of the IdP. Config-time validation rejects it, but a config planted\n\t// out-of-band (a direct `identity_provider.configuration` JSONB edit) bypasses that guard; refuse it here\n\t// too so the evaluator never honours a degenerate match-everyone rule, regardless of how it arrived (SEC-1).\n\tif (needle === '') {\n\t\treturn false\n\t}\n\tif (Array.isArray(claimValue)) {\n\t\treturn claimValue.some(it => scalarEquals(it, needle))\n\t}\n\tif (typeof claimValue === 'string' && typeof needle === 'string') {\n\t\treturn claimValue.includes(needle)\n\t}\n\treturn scalarEquals(claimValue, needle)\n}\n\nconst scalarEquals = (value: unknown, expected: string | number | boolean | null): boolean => {\n\tif (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' || value === null) {\n\t\treturn value === expected\n\t}\n\treturn false\n}\n"],"names":["isRecord"],"mappings":";;;AAaO,MAAM,uBAAuB,CAAC,SAAuB,WAAwD;AACnH,QAAM,sCAAsB,IAAA;AAE5B,aAAW,QAAQ,QAAQ,OAAO;AACjC,QAAI,CAAC,YAAY,MAAM,YAAY,QAAQ,KAAK,KAAK,CAAC,GAAG;AACxD;AAAA,IACD;AACA,QAAI,KAAK,iBAAiB;AACzB,YAAM,aAAa,aAAa,KAAK,iBAAiB,MAAM;AAG5D,YAAM,MAAM,KAAK,UAAU,CAAC,WAAW,SAAS,WAAW,IAAI,CAAC;AAChE,YAAM,WAAW,gBAAgB,IAAI,GAAG;AACxC,sBAAgB,IAAI,KAAK,WAAW,yBAAyB,UAAU,UAAU,IAAI,UAAU;AAAA,IAChG;AAAA,EACD;AAEA,SAAO,CAAC,GAAG,gBAAgB,QAAQ;AACpC;AAEA,MAAM,eAAe,CAAC,YAAoC,YAAuD;AAAA,EAChH,SAAS,WAAW;AAAA,EACpB,MAAM,WAAW;AAAA;AAAA;AAAA;AAAA,EAIjB,WAAW;AAAA,KACT,WAAW,aAAa,CAAA,GAAI,IAAI,CAAA,cAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,sBAAsB,UAAU,MAAM,IAAI;AAAA,EAAA;AAEzH;AAOA,MAAM,2BAA2B,CAAC,GAAqB,OAA2C;AAAA,EACjG,SAAS,EAAE;AAAA,EACX,MAAM,EAAE;AAAA,EACR,WAAW,qBAAqB,CAAC,GAAG,EAAE,WAAW,GAAG,EAAE,SAAS,CAAC;AACjE;AAUA,MAAM,uBAAuB,CAC5B,cAC0C;AAC1C,QAAM,mCAAmB,IAAA;AACzB,aAAW,YAAY,WAAW;AACjC,UAAM,SAAS,aAAa,IAAI,SAAS,IAAI,yBAAS,IAAA;AACtD,eAAW,SAAS,SAAS,QAAQ;AACpC,aAAO,IAAI,KAAK;AAAA,IACjB;AACA,iBAAa,IAAI,SAAS,MAAM,MAAM;AAAA,EACvC;AACA,SAAO,CAAC,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,MAAM,MAAM,OAAO,EAAE,MAAM,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAA,IAAS;AACxF;AAQO,MAAM,wBAAwB,CAAC,UAAgC,WAA8C;AACnH,QAAM,SAAS,IAAI,IAAY,SAAS,UAAU,CAAA,CAAE;AACpD,MAAI,SAAS,MAAM;AAClB,UAAM,QAAQ,SAAS,QAAQ,IAAI,IAAI,SAAS,KAAK,IAAI;AACzD,eAAW,OAAO,mBAAmB,SAAS,MAAM,MAAM,GAAG;AAK5D,YAAM,SAAS,SAAS,OAAO,OAAO,UAAU,eAAe,KAAK,SAAS,KAAK,GAAG,IAClF,SAAS,IAAI,GAAG,IACf,SAAS,cAAc,CAAC,GAAG,IAAI,CAAA;AACnC,iBAAW,SAAS,QAAQ;AAC3B,YAAI,CAAC,SAAS,MAAM,IAAI,KAAK,GAAG;AAC/B,iBAAO,IAAI,KAAK;AAAA,QACjB;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,SAAO,CAAC,GAAG,MAAM;AAClB;AAQO,MAAM,qBAAqB,CAAC,QAA0B,WAA8C;AAC1G,QAAM,WAAW,YAAY,QAAQ,OAAO,KAAK;AACjD,QAAM,QAAmB,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,QAAQ;AACvE,QAAM,MAAgB,CAAA;AACtB,aAAW,QAAQ,OAAO;AACzB,QAAI,QAAiB;AACrB,QAAI,OAAO,UAAU,UAAa,OAAO,SAAS,QAAW;AAC5D,UAAI,CAACA,aAAAA,SAAS,IAAI,GAAG;AACpB;AAAA,MACD;AACA,UAAI,OAAO,SAAS,CAAC,aAAa,YAAY,MAAM,OAAO,MAAM,KAAK,GAAG,OAAO,MAAM,MAAM,GAAG;AAC9F;AAAA,MACD;AACA,cAAQ,OAAO,SAAS,SAAY,YAAY,MAAM,OAAO,IAAI,IAAI;AAAA,IACtE;AACA,QAAI,OAAO,UAAU,YAAY,OAAO,UAAU,QAAW;AAC5D,iBAAW,QAAQ,MAAM,MAAM,OAAO,KAAK,GAAG;AAC7C,cAAM,UAAU,KAAK,KAAA;AACrB,YAAI,QAAQ,SAAS,GAAG;AACvB,cAAI,KAAK,OAAO;AAAA,QACjB;AAAA,MACD;AACA;AAAA,IACD;AACA,UAAM,SAAS,eAAe,KAAK;AACnC,QAAI,WAAW,MAAM;AACpB,UAAI,KAAK,MAAM;AAAA,IAChB;AAAA,EACD;AACA,SAAO,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC;AACxB;AAWA,MAAM,cAAc,CAAC,MAAe,SAA0B;AAC7D,MAAIA,aAAAA,SAAS,IAAI,KAAK,OAAO,UAAU,eAAe,KAAK,MAAM,IAAI,GAAG;AACvE,WAAO,KAAK,IAAI;AAAA,EACjB;AACA,MAAI,UAAmB;AACvB,aAAW,OAAO,KAAK,MAAM,GAAG,GAAG;AAClC,QAAI,CAACA,aAAAA,SAAS,OAAO,KAAK,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,GAAG,GAAG;AAC9E,aAAO;AAAA,IACR;AACA,cAAU,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACR;AAEA,MAAM,iBAAiB,CAAC,UAAkC;AACzD,MAAI,OAAO,UAAU,UAAU;AAC9B,WAAO;AAAA,EACR;AACA,MAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GAAG;AACxD,WAAO,OAAO,KAAK;AAAA,EACpB;AACA,SAAO;AACR;AAEA,MAAM,cAAc,CAAC,MAAwB,eAAiC;AAC7E,MAAI,KAAK,WAAW,QAAW;AAC9B,WAAO,YAAY,YAAY,KAAK,MAAM;AAAA,EAC3C;AACA,MAAI,KAAK,aAAa,QAAW;AAChC,WAAO,cAAc,YAAY,KAAK,QAAQ;AAAA,EAC/C;AAKA,MAAI,eAAe,UAAa,eAAe,QAAQ,eAAe,SAAS,eAAe,IAAI;AACjG,WAAO;AAAA,EACR;AACA,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,SAAS;AAAA,EAC5B;AACA,SAAO;AACR;AAEA,MAAM,cAAc,CAAC,YAAqB,aAAwD;AACjG,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,KAAK,CAAA,OAAM,aAAa,IAAI,QAAQ,CAAC;AAAA,EACxD;AACA,SAAO,aAAa,YAAY,QAAQ;AACzC;AAEA,MAAM,gBAAgB,CAAC,YAAqB,WAAsD;AAKjG,MAAI,WAAW,IAAI;AAClB,WAAO;AAAA,EACR;AACA,MAAI,MAAM,QAAQ,UAAU,GAAG;AAC9B,WAAO,WAAW,KAAK,CAAA,OAAM,aAAa,IAAI,MAAM,CAAC;AAAA,EACtD;AACA,MAAI,OAAO,eAAe,YAAY,OAAO,WAAW,UAAU;AACjE,WAAO,WAAW,SAAS,MAAM;AAAA,EAClC;AACA,SAAO,aAAa,YAAY,MAAM;AACvC;AAEA,MAAM,eAAe,CAAC,OAAgB,aAAwD;AAC7F,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,YAAY,OAAO,UAAU,aAAa,UAAU,MAAM;AAC3G,WAAO,UAAU;AAAA,EAClB;AACA,SAAO;AACR;;;;"}