@crombolo/entra 0.0.0-stage → 0.14.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kineco
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,69 @@
+crombolo
+Copyright (c) 2026 Kineco
+
+This product includes third-party software. crombolo is an independent project.
+It is not affiliated with, endorsed by, or sponsored by Umbraco A/S, which owns
+the Umbraco trademark.
+
+There are three places third-party material is redistributed, rather than merely
+depended on:
+
+  @crombolo/backoffice-dist   the built Umbraco backoffice and the browser
+                              packages bundled into it, produced by
+                              `bun run vendor:backoffice`
+  @crombolo/backoffice-dist   three CSS files copied unmodified from the Umbraco
+                              client source tree
+  @crombolo/contracts         the Umbraco Management API OpenAPI document,
+                              copied unmodified
+
+No Umbraco trademark is redistributed. The Umbraco wordmark, the "U" roundel
+favicon and the installer illustration are deliberately not carried in this
+repository: MIT grants copyright permission and says nothing about trademarks, so
+crombolo's own marks are served at those paths instead. See `BRANDED_ASSETS` in
+`@crombolo/backoffice-host`.
+
+The Umbraco backoffice
+----------------------
+@umbraco-cms/backoffice 18.2.0 — MIT — https://github.com/umbraco/Umbraco-CMS
+@umbraco-ui/uui 2.0.2 — MIT — https://github.com/umbraco/Umbraco.UI
+
+Static files from the Umbraco client source tree
+------------------------------------------------
+css/umb-css.css, css/rte-content.css, css/umbraco-blockgridlayout.css
+  — copied unmodified from Umbraco-CMS release-18.2.0 — MIT
+  — https://github.com/umbraco/Umbraco-CMS
+Shipped in @crombolo/backoffice-dist under `upstream-static/`.
+
+`rte-content.css` itself carries Tiptap's default editor styles, copied from
+tiptap v2.11.7 (MIT); the file records this in its own header.
+
+The Umbraco Management API contract
+-----------------------------------
+OpenApi.json — copied unmodified from Umbraco-CMS release-18.2.0
+  (src/Umbraco.Cms.Api.Management/OpenApi.json) — MIT
+  — https://github.com/umbraco/Umbraco-CMS
+Shipped in @crombolo/contracts, which also ships the TypeScript types generated
+from it.
+
+Browser runtime dependencies bundled into the backoffice build
+--------------------------------------------------------------
+@heximal/expressions 0.1.5 — BSD-3-Clause
+@microsoft/signalr 10.0.11 — MIT
+@tiptap/* 3.31.3 — MIT
+diff 9.0.0 — BSD-3-Clause
+dompurify 3.4.16 — Apache-2.0, elected from "MPL-2.0 OR Apache-2.0"
+element-internals-polyfill 3.0.2 — MIT
+lit 3.3.3 — BSD-3-Clause
+luxon 3.7.2 — MIT
+marked 18.0.14 — MIT
+monaco-editor 0.57.0 — MIT
+rxjs 7.8.2 — Apache-2.0
+uuid 14.0.2 — MIT
+
+dompurify is offered under either licence; Apache-2.0 is elected here, so no
+MPL-2.0 obligation attaches to the copy bundled into the backoffice build. Of the
+Apache-2.0 packages above, none ships a NOTICE file of its own, so Apache-2.0
+section 4(d) adds nothing to this file.
+
+Each package's own licence text ships inside its npm distribution and applies
+unchanged to the copies bundled here.

package/package.json

@@ -1,6 +1,75 @@
 {
   "name": "@crombolo/entra",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.14.1",
+  "description": "Edit a Microsoft Entra sign-in from the Crombolo backoffice: tenant, app credentials and group mappings, over the provider the site declares in code.",
+  "license": "MIT",
+  "author": "Crombolo",
+  "homepage": "https://github.com/kineco-au/crombolo-cms#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kineco-au/crombolo-cms.git",
+    "directory": "packages/entra"
+  },
+  "bugs": {
+    "url": "https://github.com/kineco-au/crombolo-cms/issues"
+  },
+  "keywords": [
+    "crombolo",
+    "crombolo-bundle",
+    "entra",
+    "azure-ad",
+    "single-sign-on",
+    "cms"
+  ],
+  "engines": {
+    "bun": ">=1.3.0"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "files": [
+    "plugin",
+    "src",
+    "NOTICE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "crombolo": {
+    "id": "entra",
+    "name": "Microsoft Entra",
+    "server": "entraSettings",
+    "extensions": [
+      {
+        "type": "menuItem",
+        "alias": "Crombolo.MenuItem.Entra",
+        "name": "Microsoft Entra Menu Item",
+        "weight": 240,
+        "meta": {
+          "label": "Microsoft Entra",
+          "icon": "icon-key",
+          "entityType": "crombolo-entra",
+          "menus": [
+            "Umb.Menu.AdvancedSettings"
+          ]
+        }
+      },
+      {
+        "type": "workspace",
+        "alias": "Crombolo.Workspace.Entra",
+        "name": "Microsoft Entra Workspace",
+        "element": "plugin/entra-workspace.js",
+        "meta": {
+          "entityType": "crombolo-entra"
+        }
+      }
+    ]
+  },
+  "dependencies": {
+    "@crombolo/server": "0.14.1"
+  },
+  "peerDependencies": {
+    "@crombolo/crombolo": ">=0.14.1"
+  }
+}

package/plugin/entra-client.js

@@ -0,0 +1,40 @@
+/**
+ * Reads and drives this bundle's endpoints at
+ * `<backoffice>/crombolo/api/bundle/entra/*`. The session cookie carries the
+ * auth, as it does for the framework's own plugin endpoints; the base comes from
+ * `<base href>`, because the backoffice path is configurable.
+ */
+const base = () => {
+  const href = document.querySelector('base')?.getAttribute('href') ?? '/umbraco/'
+  return `${href.replace(/\/$/, '')}/crombolo/api/bundle/entra`
+}
+
+const json = async (path, init) => {
+  const response = await fetch(`${base()}${path}`, {
+    credentials: 'include',
+    headers: {
+      accept: 'application/json',
+      ...(init?.body ? { 'content-type': 'application/json' } : {}),
+    },
+    ...init,
+  })
+  const body = await response.json().catch(() => ({}))
+  // A refusal carries a message the screen shows.
+  if (!response.ok && ![400, 403, 404].includes(response.status))
+    throw new Error(`The Entra settings endpoint answered ${response.status}`)
+  return body
+}
+
+const at = (provider) =>
+  `/providers/${encodeURIComponent(provider.audience)}/${encodeURIComponent(provider.id)}`
+
+export const listProviders = () => json('/providers')
+
+export const listGroups = (audience) => json(`/groups/${encodeURIComponent(audience)}`)
+
+export const saveProvider = (provider, changes) =>
+  json(at(provider), { method: 'PUT', body: JSON.stringify(changes) })
+
+export const resetProvider = (provider) => json(at(provider), { method: 'DELETE' })
+
+export const testProvider = (provider) => json(`${at(provider)}/test`, { method: 'POST' })

package/plugin/entra-workspace.js

@@ -0,0 +1,347 @@
+/**
+ * The Microsoft Entra screen, in Settings under Advanced (story 033).
+ *
+ * One card per Entra sign-in the site declares in code: for the backoffice, for
+ * members, or both. Each field shows what is in force and says when it was
+ * changed here rather than in code; saving changes only what differs, and
+ * "Use the code's settings" removes every change. The client secret is never
+ * shown: it can be replaced or removed, and the card says whether there is one.
+ */
+import '@umbraco-cms/backoffice/components'
+import { css, html, nothing, repeat } from '@umbraco-cms/backoffice/external/lit'
+import { UmbLitElement } from '@umbraco-cms/backoffice/lit-element'
+import { UMB_NOTIFICATION_CONTEXT } from '@umbraco-cms/backoffice/notification'
+import {
+  listGroups,
+  listProviders,
+  resetProvider,
+  saveProvider,
+  testProvider,
+} from './entra-client.js'
+
+const AUDIENCE = { user: 'Backoffice users', member: 'Members' }
+
+/** What a card edits, from a provider as the server describes it. */
+const draftOf = (provider) => ({
+  name: provider.name,
+  tenantId: provider.tenantId ?? '',
+  clientId: provider.clientId,
+  clientSecret: '',
+  autoCreate: provider.autoCreate,
+  linkByEmail: provider.linkByEmail,
+  emailsVerified: provider.emailsVerified,
+  mappings: Object.entries(provider.groupMap).map(([claim, group]) => ({ claim, group })),
+  defaultGroups: [...provider.defaultGroups],
+})
+
+export default class CromboloEntraWorkspaceElement extends UmbLitElement {
+  static properties = {
+    _providers: { state: true },
+    _drafts: { state: true },
+    _groups: { state: true },
+    _canEdit: { state: true },
+    _loading: { state: true },
+    _problem: { state: true },
+    _results: { state: true },
+    _busy: { state: true },
+  }
+
+  #notifications
+
+  constructor() {
+    super()
+    this._providers = []
+    this._drafts = {}
+    this._groups = { user: [], member: [] }
+    this._canEdit = false
+    this._loading = true
+    this._problem = ''
+    this._results = {}
+    this._busy = ''
+    this.consumeContext(UMB_NOTIFICATION_CONTEXT, (context) => {
+      this.#notifications = context
+    })
+  }
+
+  connectedCallback() {
+    super.connectedCallback()
+    this.#load()
+  }
+
+  async #load() {
+    this._loading = true
+    try {
+      const result = await listProviders()
+      this._providers = result.providers ?? []
+      this._canEdit = Boolean(result.canEdit)
+      this._drafts = Object.fromEntries(this._providers.map((p) => [this.#key(p), draftOf(p)]))
+      const audiences = [...new Set(this._providers.map((p) => p.audience))]
+      const groups = { user: [], member: [] }
+      for (const audience of audiences) groups[audience] = (await listGroups(audience)).groups ?? []
+      this._groups = groups
+      this._problem = ''
+    } catch (error) {
+      this._problem = error instanceof Error ? error.message : String(error)
+    } finally {
+      this._loading = false
+    }
+  }
+
+  #key(provider) {
+    return `${provider.audience}:${provider.id}`
+  }
+
+  #change(provider, field, value) {
+    const key = this.#key(provider)
+    this._drafts = { ...this._drafts, [key]: { ...this._drafts[key], [field]: value } }
+  }
+
+  #setMapping(provider, index, field, value) {
+    const draft = this._drafts[this.#key(provider)]
+    const mappings = draft.mappings.map((m, i) => (i === index ? { ...m, [field]: value } : m))
+    this.#change(provider, 'mappings', mappings)
+  }
+
+  /** Only what differs from what is in force goes to the server. */
+  #changes(provider) {
+    const draft = this._drafts[this.#key(provider)]
+    const changes = {}
+    for (const field of [
+      'name',
+      'tenantId',
+      'clientId',
+      'autoCreate',
+      'linkByEmail',
+      'emailsVerified',
+    ])
+      if (draft[field] !== (provider[field] ?? '')) changes[field] = draft[field]
+    if (draft.clientSecret) changes.clientSecret = draft.clientSecret
+    const map = Object.fromEntries(
+      draft.mappings.filter((m) => m.claim.trim() && m.group).map((m) => [m.claim.trim(), m.group]),
+    )
+    if (JSON.stringify(map) !== JSON.stringify(provider.groupMap)) changes.groupMap = map
+    if (JSON.stringify(draft.defaultGroups) !== JSON.stringify(provider.defaultGroups))
+      changes.defaultGroups = draft.defaultGroups
+    return changes
+  }
+
+  async #run(provider, label, action) {
+    this._busy = this.#key(provider)
+    try {
+      const result = await action()
+      if (result.ok === false) {
+        this.#notifications?.peek('danger', { data: { message: result.message } })
+        return
+      }
+      this.#notifications?.peek('positive', { data: { message: label } })
+      await this.#load()
+    } catch (error) {
+      this.#notifications?.peek('danger', {
+        data: { message: error instanceof Error ? error.message : String(error) },
+      })
+    } finally {
+      this._busy = ''
+    }
+  }
+
+  #save(provider) {
+    const changes = this.#changes(provider)
+    if (Object.keys(changes).length === 0) return
+    return this.#run(provider, 'Entra settings saved', () => saveProvider(provider, changes))
+  }
+
+  #removeSecret(provider) {
+    return this.#run(provider, 'Client secret removed', () =>
+      saveProvider(provider, { clientSecret: null }),
+    )
+  }
+
+  #reset(provider) {
+    return this.#run(provider, "Using the code's settings again", () => resetProvider(provider))
+  }
+
+  async #test(provider) {
+    this._busy = this.#key(provider)
+    try {
+      const result = await testProvider(provider)
+      this._results = { ...this._results, [this.#key(provider)]: result }
+    } finally {
+      this._busy = ''
+    }
+  }
+
+  render() {
+    return html`<umb-body-layout headline="Microsoft Entra">
+      ${this._problem ? html`<uui-box><p class="problem">${this._problem}</p></uui-box>` : nothing}
+      ${this._loading ? html`<uui-loader></uui-loader>` : this.#body()}
+    </umb-body-layout>`
+  }
+
+  #body() {
+    if (this._providers.length === 0)
+      return html`<uui-box headline="No Entra sign-in">
+        <p>
+          This site declares no Microsoft Entra sign-in. Add one with <code>entra()</code> in
+          <code>crombolo.config.ts</code>, under <code>backofficeIdentityProviders</code> or
+          <code>memberIdentityProviders</code>; its settings can then be changed here.
+        </p>
+      </uui-box>`
+    return html`
+      ${
+        this._canEdit
+          ? nothing
+          : html`<uui-box><p>Only an administrator can change how people sign in.</p></uui-box>`
+      }
+      ${repeat(
+        this._providers,
+        (p) => this.#key(p),
+        (p) => this.#card(p),
+      )}
+    `
+  }
+
+  #label(provider, field, text) {
+    return html`${text}${
+      provider.overridden.includes(field)
+        ? html` <uui-tag look="secondary" color="warning">Changed here</uui-tag>`
+        : nothing
+    }`
+  }
+
+  #card(provider) {
+    const draft = this._drafts[this.#key(provider)]
+    const groups = this._groups[provider.audience] ?? []
+    const disabled = !this._canEdit
+    const result = this._results[this.#key(provider)]
+    const busy = this._busy === this.#key(provider)
+    return html`<uui-box headline=${`${AUDIENCE[provider.audience]} — ${provider.name}`}>
+      <div slot="header-actions" class="actions">
+        <uui-button look="secondary" label="Test connection" ?disabled=${busy}
+          @click=${() => this.#test(provider)}>Test connection</uui-button>
+        ${
+          this._canEdit && provider.overridden.length > 0
+            ? html`<uui-button look="secondary" color="danger" label="Use the code's settings"
+                ?disabled=${busy} @click=${() => this.#reset(provider)}>Use the code's settings</uui-button>`
+            : nothing
+        }
+      </div>
+      ${result ? html`<p class=${result.ok ? 'ok' : 'problem'}>${result.message}</p>` : nothing}
+      <umb-property-layout label="Redirect URL" description="Register this with the app in Entra">
+        <code slot="editor">${window.location.origin}${provider.callbackPath}</code>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'name', 'Button text')}>
+        <uui-input slot="editor" label="Button text" ?readonly=${disabled} .value=${draft.name}
+          @change=${(e) => this.#change(provider, 'name', e.target.value)}></uui-input>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'tenantId', 'Tenant ID')}>
+        <uui-input slot="editor" label="Tenant ID" ?readonly=${disabled} .value=${draft.tenantId}
+          @change=${(e) => this.#change(provider, 'tenantId', e.target.value)}></uui-input>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'clientId', 'Application (client) ID')}>
+        <uui-input slot="editor" label="Client ID" ?readonly=${disabled} .value=${draft.clientId}
+          @change=${(e) => this.#change(provider, 'clientId', e.target.value)}></uui-input>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'clientSecret', 'Client secret')}
+        description=${provider.hasClientSecret ? 'A secret is set. Enter a new one to replace it.' : 'No secret is set.'}>
+        <div slot="editor" class="row">
+          <uui-input type="password" label="Client secret" autocomplete="off" ?readonly=${disabled}
+            .value=${draft.clientSecret} placeholder=${provider.hasClientSecret ? '••••••••' : ''}
+            @change=${(e) => this.#change(provider, 'clientSecret', e.target.value)}></uui-input>
+          ${
+            this._canEdit && provider.overridden.includes('clientSecret')
+              ? html`<uui-button look="secondary" label="Remove the secret kept here"
+                  @click=${() => this.#removeSecret(provider)}>Remove</uui-button>`
+              : nothing
+          }
+        </div>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'autoCreate', 'Create accounts')}
+        description="Create an account for someone signing in for the first time">
+        <uui-toggle slot="editor" label="Create accounts" ?disabled=${disabled} ?checked=${draft.autoCreate}
+          @change=${(e) => this.#change(provider, 'autoCreate', e.target.checked)}></uui-toggle>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'linkByEmail', 'Link by email')}
+        description="Link a first sign-in to an existing account with the same, verified, email">
+        <uui-toggle slot="editor" label="Link by email" ?disabled=${disabled} ?checked=${draft.linkByEmail}
+          @change=${(e) => this.#change(provider, 'linkByEmail', e.target.checked)}></uui-toggle>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'emailsVerified', 'Trust emails')}
+        description="Treat every email from this tenant as verified. Entra sends no verification claim.">
+        <uui-toggle slot="editor" label="Trust emails" ?disabled=${disabled} ?checked=${draft.emailsVerified}
+          @change=${(e) => this.#change(provider, 'emailsVerified', e.target.checked)}></uui-toggle>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'groupMap', 'Group mappings')}
+        description="An Entra group's object ID, and the group here its members join. Made to match on every sign-in.">
+        <div slot="editor" class="mappings">
+          ${draft.mappings.map(
+            (m, i) => html`<div class="row">
+              <uui-input label="Entra group object ID" placeholder="Entra group object ID" ?readonly=${disabled}
+                .value=${m.claim} @change=${(e) => this.#setMapping(provider, i, 'claim', e.target.value)}></uui-input>
+              <uui-select label="Group here" ?disabled=${disabled}
+                .options=${[{ name: 'Choose a group', value: '', selected: !m.group }, ...groups.map((g) => ({ name: g.name, value: g.value, selected: g.value === m.group }))]}
+                @change=${(e) => this.#setMapping(provider, i, 'group', e.target.value)}></uui-select>
+              ${
+                disabled
+                  ? nothing
+                  : html`<uui-button look="secondary" label="Remove mapping" compact
+                      @click=${() =>
+                        this.#change(
+                          provider,
+                          'mappings',
+                          draft.mappings.filter((_, j) => j !== i),
+                        )}>Remove</uui-button>`
+              }
+            </div>`,
+          )}
+          ${
+            disabled
+              ? nothing
+              : html`<uui-button look="secondary" label="Add a mapping" compact
+                  @click=${() => this.#change(provider, 'mappings', [...draft.mappings, { claim: '', group: '' }])}>Add a mapping</uui-button>`
+          }
+        </div>
+      </umb-property-layout>
+      <umb-property-layout .label=${this.#label(provider, 'defaultGroups', 'Default groups')}
+        description="Groups a new account joins">
+        <div slot="editor" class="checks">
+          ${groups.map(
+            (g) => html`<uui-checkbox label=${g.name} ?disabled=${disabled}
+              ?checked=${draft.defaultGroups.includes(g.value)}
+              @change=${(e) =>
+                this.#change(
+                  provider,
+                  'defaultGroups',
+                  e.target.checked
+                    ? [...draft.defaultGroups, g.value]
+                    : draft.defaultGroups.filter((v) => v !== g.value),
+                )}>${g.name}</uui-checkbox>`,
+          )}
+        </div>
+      </umb-property-layout>
+      ${
+        this._canEdit
+          ? html`<div class="save">
+              <uui-button look="primary" color="positive" label="Save" ?disabled=${busy || Object.keys(this.#changes(provider)).length === 0}
+                @click=${() => this.#save(provider)}>Save</uui-button>
+            </div>`
+          : nothing
+      }
+    </uui-box>`
+  }
+
+  static styles = css`
+    :host { display: block; height: 100%; }
+    uui-box { margin-bottom: var(--uui-size-layout-1); }
+    .actions { display: flex; gap: var(--uui-size-space-3); }
+    .row { display: flex; gap: var(--uui-size-space-3); align-items: center; }
+    .row uui-input { flex: 1; }
+    .mappings, .checks { display: flex; flex-direction: column; gap: var(--uui-size-space-3); }
+    uui-input, uui-select { width: 100%; }
+    .save { display: flex; justify-content: flex-end; margin-top: var(--uui-size-space-5); }
+    .ok { color: var(--uui-color-positive); }
+    .problem { color: var(--uui-color-danger); }
+    code { word-break: break-all; }
+  `
+}
+
+customElements.define('crombolo-entra-workspace', CromboloEntraWorkspaceElement)

package/src/index.ts

@@ -0,0 +1,161 @@
+/**
+ * The Microsoft Entra bundle (story 033): a Settings screen for the Entra sign-ins
+ * a site declares in code with `entra()`. It changes their settings — tenant, app
+ * credentials, the sign-in options and group mappings — and puts them back; it
+ * never declares a provider. The overrides live in core, behind the
+ * `identityProviders` capability, and apply at the next sign-in on every node.
+ *
+ * Reading is for anyone with the Settings section. Changing is for
+ * administrators only, because a group mapping can make someone an administrator.
+ */
+import type {
+  BundleRequest,
+  BundleSection,
+  ProviderOverrideInput,
+  ServerBundle,
+} from '@crombolo/server'
+import manifest from '../package.json' with { type: 'json' }
+
+const CAPABILITIES = ['identityProviders', 'log'] as const
+
+type Capability = (typeof CAPABILITIES)[number]
+
+export const ENTRA_BUNDLE_ID = manifest.crombolo.id
+
+export interface EntraSettingsOptions {
+  /** The section a caller must have to see the screen; Settings by default. */
+  section?: BundleSection
+}
+
+const json = (body: unknown, status = 200) =>
+  Response.json(body, { status, headers: { 'cache-control': 'no-store' } })
+
+const AUDIENCES = new Set(['member', 'user'])
+
+/** The fields the screen sends, each checked for its type; nothing else is passed on. */
+export function readOverrides(body: Record<string, unknown>): ProviderOverrideInput {
+  const out: ProviderOverrideInput = {}
+  for (const field of ['name', 'tenantId', 'clientId'] as const)
+    if (field in body && (typeof body[field] === 'string' || body[field] === null))
+      out[field] = (body[field] as string | null)?.trim() || undefined
+  if ('clientSecret' in body) {
+    const secret = body.clientSecret
+    if (secret === null) out.clientSecret = null
+    else if (typeof secret === 'string' && secret.trim()) out.clientSecret = secret.trim()
+  }
+  for (const field of ['autoCreate', 'linkByEmail', 'emailsVerified'] as const)
+    if (field in body) out[field] = typeof body[field] === 'boolean' ? body[field] : undefined
+  if ('groupMap' in body) {
+    const map = body.groupMap
+    if (map === null) out.groupMap = undefined
+    else if (map && typeof map === 'object' && !Array.isArray(map)) {
+      const entries = Object.entries(map as Record<string, unknown>)
+        .filter(([key, value]) => key.trim() && typeof value === 'string' && value.trim())
+        .map(([key, value]) => [key.trim(), (value as string).trim()])
+      out.groupMap = Object.fromEntries(entries)
+    }
+  }
+  if ('defaultGroups' in body) {
+    const groups = body.defaultGroups
+    out.defaultGroups = Array.isArray(groups)
+      ? groups
+          .filter((g): g is string => typeof g === 'string' && g.trim() !== '')
+          .map((g) => g.trim())
+      : undefined
+  }
+  return out
+}
+
+const parseBody = async (request: Request): Promise<Record<string, unknown>> => {
+  const body = await request.json().catch(() => undefined)
+  return body && typeof body === 'object' ? (body as Record<string, unknown>) : {}
+}
+
+type Context = BundleRequest<Capability>
+
+/** The provider a route names, when it is an Entra one the config declares. */
+async function entraProvider(context: Context) {
+  const { audience, id } = context.params
+  if (!audience || !AUDIENCES.has(audience)) return undefined
+  const all = await context.host.identityProviders.list()
+  return all.find((p) => p.kind === 'entra' && p.audience === audience && p.id === id)
+}
+
+const adminOnly = () =>
+  json({ ok: false, message: 'Only an administrator can change how people sign in.' }, 403)
+
+/** The Entra settings screen's server half, for `bundles: [entraSettings()]` in `crombolo.config.ts`. */
+export function entraSettings(options: EntraSettingsOptions = {}): ServerBundle<Capability> {
+  return {
+    id: ENTRA_BUNDLE_ID,
+    section: options.section ?? 'settings',
+    capabilities: CAPABILITIES,
+    routes: [
+      {
+        method: 'GET',
+        path: 'providers',
+        async handler({ host, principal }) {
+          const providers = (await host.identityProviders.list()).filter((p) => p.kind === 'entra')
+          return json({ canEdit: principal.isAdmin, providers })
+        },
+      },
+      {
+        method: 'GET',
+        path: 'groups/:audience',
+        async handler({ host, params }) {
+          if (!params.audience || !AUDIENCES.has(params.audience))
+            return json({ ok: false, message: 'Groups are for members or users.' }, 404)
+          return json({
+            groups: await host.identityProviders.groups(params.audience as 'member' | 'user'),
+          })
+        },
+      },
+      {
+        method: 'PUT',
+        path: 'providers/:audience/:id',
+        async handler(context) {
+          if (!context.principal.isAdmin) return adminOnly()
+          const provider = await entraProvider(context)
+          if (!provider) return json({ ok: false, message: 'There is no such Entra sign-in.' }, 404)
+          const outcome = await context.host.identityProviders.update(
+            provider.audience,
+            provider.id,
+            readOverrides(await parseBody(context.request)),
+          )
+          if (!outcome.ok) return json({ ok: false, message: outcome.error }, 400)
+          context.host.log.info('{user} changed the {audience} Entra sign-in {id}', {
+            user: context.principal.email,
+            audience: provider.audience,
+            id: provider.id,
+          })
+          return json({ ok: true, provider: await entraProvider(context) })
+        },
+      },
+      {
+        method: 'DELETE',
+        path: 'providers/:audience/:id',
+        async handler(context) {
+          if (!context.principal.isAdmin) return adminOnly()
+          const provider = await entraProvider(context)
+          if (!provider) return json({ ok: false, message: 'There is no such Entra sign-in.' }, 404)
+          await context.host.identityProviders.reset(provider.audience, provider.id)
+          context.host.log.info('{user} put the {audience} Entra sign-in {id} back to the code', {
+            user: context.principal.email,
+            audience: provider.audience,
+            id: provider.id,
+          })
+          return json({ ok: true, provider: await entraProvider(context) })
+        },
+      },
+      {
+        method: 'POST',
+        path: 'providers/:audience/:id/test',
+        async handler(context) {
+          const provider = await entraProvider(context)
+          if (!provider) return json({ ok: false, message: 'There is no such Entra sign-in.' }, 404)
+          return json(await context.host.identityProviders.test(provider.audience, provider.id))
+        },
+      },
+    ],
+  }
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.