@de-otio/trellis 0.6.0 → 0.7.0

package/dist/lib/tenant/resolve-role.d.ts

@@ -0,0 +1,39 @@
+/**
+ * IdP-group → TenantRole resolution (T2 — JIT provisioning).
+ *
+ * Pure function over the user's IdP `groups` claim and the tenant's
+ * `TenantRoleMapping` rows. The lambda fetches the mappings; this module
+ * applies the priority + role-rank algorithm so unit tests don't need Prisma.
+ *
+ * Algorithm (per doc/02-technical/identity-federation/05-roles-and-permissions.md):
+ *  - No `idpGroups`              → defaultRole
+ *  - No mappings match           → defaultRole
+ *  - Lowest `priority` wins      (priority 0 beats priority 100)
+ *  - Tie on priority             → highest role rank wins
+ *
+ * Role rank: OWNER (4) > ADMIN (3) > MEMBER (2) > GUEST (1).
+ */
+import type { TenantRole } from "@prisma/client";
+export interface RoleMappingInput {
+    idpGroupName: string;
+    tenantRole: TenantRole;
+    priority: number;
+}
+/**
+ * Resolve which TenantRole a federated user should be granted, given:
+ *  - their IdP-emitted group identifiers
+ *  - the tenant's configured role mappings
+ *  - the tenant IdP's configured `defaultRole` (null = deny if no match)
+ *
+ * Returns null when no mapping matches and `defaultRole` is null — the
+ * caller treats this as "do not provision an org TenantMember".
+ *
+ * **OWNER cap (G2 M3):** OWNER is the single-OWNER invariant for a tenant
+ * and is only granted by tenant-creation flow + explicit transfer. A group
+ * mapping or default-role configured to OWNER is downgraded to ADMIN here
+ * as a defense-in-depth backstop. The role-mapping API (T5) must also
+ * reject OWNER on write, but this resolver enforces the invariant on read
+ * so a misconfigured row never escalates a federated user to OWNER.
+ */
+export declare function resolveTenantRole(idpGroups: ReadonlyArray<string>, mappings: ReadonlyArray<RoleMappingInput>, defaultRole: TenantRole | null): TenantRole | null;
+//# sourceMappingURL=resolve-role.d.ts.map

package/dist/lib/tenant/resolve-role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-role.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/resolve-role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,EAChC,QAAQ,EAAE,aAAa,CAAC,gBAAgB,CAAC,EACzC,WAAW,EAAE,UAAU,GAAG,IAAI,GAC7B,UAAU,GAAG,IAAI,CAanB"}

package/dist/lib/tenant/resolve-role.js

@@ -0,0 +1,60 @@
+"use strict";
+/**
+ * IdP-group → TenantRole resolution (T2 — JIT provisioning).
+ *
+ * Pure function over the user's IdP `groups` claim and the tenant's
+ * `TenantRoleMapping` rows. The lambda fetches the mappings; this module
+ * applies the priority + role-rank algorithm so unit tests don't need Prisma.
+ *
+ * Algorithm (per doc/02-technical/identity-federation/05-roles-and-permissions.md):
+ *  - No `idpGroups`              → defaultRole
+ *  - No mappings match           → defaultRole
+ *  - Lowest `priority` wins      (priority 0 beats priority 100)
+ *  - Tie on priority             → highest role rank wins
+ *
+ * Role rank: OWNER (4) > ADMIN (3) > MEMBER (2) > GUEST (1).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTenantRole = resolveTenantRole;
+const ROLE_RANK = {
+    OWNER: 4,
+    ADMIN: 3,
+    MEMBER: 2,
+    GUEST: 1,
+};
+/**
+ * Resolve which TenantRole a federated user should be granted, given:
+ *  - their IdP-emitted group identifiers
+ *  - the tenant's configured role mappings
+ *  - the tenant IdP's configured `defaultRole` (null = deny if no match)
+ *
+ * Returns null when no mapping matches and `defaultRole` is null — the
+ * caller treats this as "do not provision an org TenantMember".
+ *
+ * **OWNER cap (G2 M3):** OWNER is the single-OWNER invariant for a tenant
+ * and is only granted by tenant-creation flow + explicit transfer. A group
+ * mapping or default-role configured to OWNER is downgraded to ADMIN here
+ * as a defense-in-depth backstop. The role-mapping API (T5) must also
+ * reject OWNER on write, but this resolver enforces the invariant on read
+ * so a misconfigured row never escalates a federated user to OWNER.
+ */
+function resolveTenantRole(idpGroups, mappings, defaultRole) {
+    if (idpGroups.length === 0)
+        return capOwner(defaultRole);
+    const groupSet = new Set(idpGroups);
+    const matches = mappings.filter((m) => groupSet.has(m.idpGroupName));
+    if (matches.length === 0)
+        return capOwner(defaultRole);
+    const sorted = [...matches].sort((a, b) => {
+        if (a.priority !== b.priority)
+            return a.priority - b.priority;
+        return ROLE_RANK[b.tenantRole] - ROLE_RANK[a.tenantRole];
+    });
+    return capOwner(sorted[0].tenantRole);
+}
+function capOwner(role) {
+    if (role === "OWNER")
+        return "ADMIN";
+    return role;
+}
+//# sourceMappingURL=resolve-role.js.map

package/dist/lib/tenant/resolve-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-role.js","sourceRoot":"","sources":["../../../src/lib/tenant/resolve-role.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AAiCH,8CAiBC;AAxCD,MAAM,SAAS,GAA+B;IAC5C,KAAK,EAAE,CAAC;IACR,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC;IACT,KAAK,EAAE,CAAC;CACT,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,iBAAiB,CAC/B,SAAgC,EAChC,QAAyC,EACzC,WAA8B;IAE9B,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC9D,OAAO,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAuB;IACvC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/tenant/role-mapping-handler.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Tenant role-mapping CRUD.
+ *
+ * Endpoints (wired in routes/tenant-role-mappings.ts):
+ *   GET    /api/tenants/:id/role-mappings
+ *   POST   /api/tenants/:id/role-mappings
+ *   PATCH  /api/tenants/:id/role-mappings/:mappingId
+ *   DELETE /api/tenants/:id/role-mappings/:mappingId
+ *
+ * Single-OWNER invariant: writes that target `tenantRole = OWNER` return 422.
+ * `resolveTenantRole` (T2) already caps OWNER → ADMIN as defense-in-depth, but
+ * we reject at write time so misconfiguration is loud rather than silent.
+ */
+import type { Env } from "../../env";
+import type { AuthContext } from "../auth/auth-context";
+export declare class RoleMappingHandler {
+    /** GET — list all mappings for the tenant. */
+    handleList(tenantId: string, auth: AuthContext, env: Env): Promise<Response>;
+    /** POST — create a new mapping. Cannot map to OWNER. */
+    handleCreate(tenantId: string, request: Request, auth: AuthContext, env: Env): Promise<Response>;
+    /** PATCH — update tenantRole and/or priority of an existing mapping. */
+    handleUpdate(tenantId: string, mappingId: string, request: Request, auth: AuthContext, env: Env): Promise<Response>;
+    /** DELETE — remove a mapping. */
+    handleDelete(tenantId: string, mappingId: string, auth: AuthContext, env: Env): Promise<Response>;
+}
+//# sourceMappingURL=role-mapping-handler.d.ts.map

package/dist/lib/tenant/role-mapping-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-mapping-handler.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/role-mapping-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAmBxD,qBAAa,kBAAkB;IAC7B,8CAA8C;IACxC,UAAU,CACd,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAyBpB,wDAAwD;IAClD,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAkFpB,wEAAwE;IAClE,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;IAqFpB,iCAAiC;IAC3B,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,QAAQ,CAAC;CAiCrB"}

package/dist/lib/tenant/role-mapping-handler.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Tenant role-mapping CRUD.
+ *
+ * Endpoints (wired in routes/tenant-role-mappings.ts):
+ *   GET    /api/tenants/:id/role-mappings
+ *   POST   /api/tenants/:id/role-mappings
+ *   PATCH  /api/tenants/:id/role-mappings/:mappingId
+ *   DELETE /api/tenants/:id/role-mappings/:mappingId
+ *
+ * Single-OWNER invariant: writes that target `tenantRole = OWNER` return 422.
+ * `resolveTenantRole` (T2) already caps OWNER → ADMIN as defense-in-depth, but
+ * we reject at write time so misconfiguration is loud rather than silent.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleMappingHandler = void 0;
+const auth_middleware_1 = require("../auth/auth-middleware");
+const require_1 = require("../auth/require");
+const audit_emit_1 = require("./audit-emit");
+const JSON_HEADERS = { "content-type": "application/json" };
+function jsonResponse(status, body) {
+    return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function unprocessable(message, remediation) {
+    return jsonResponse(422, {
+        error: "UNPROCESSABLE",
+        message,
+        ...(remediation ? { remediation } : {}),
+    });
+}
+class RoleMappingHandler {
+    /** GET — list all mappings for the tenant. */
+    async handleList(tenantId, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.RoleMappingEdit);
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const mappings = await db.tenantRoleMapping.findMany({
+            where: { tenantId },
+            orderBy: [{ priority: "asc" }, { idpGroupName: "asc" }],
+            select: {
+                id: true,
+                idpGroupName: true,
+                tenantRole: true,
+                priority: true,
+                createdAt: true,
+                updatedAt: true,
+            },
+        });
+        return jsonResponse(200, { mappings });
+    }
+    /** POST — create a new mapping. Cannot map to OWNER. */
+    async handleCreate(tenantId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.RoleMappingEdit);
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return jsonResponse(400, { error: "INVALID_JSON", message: "Body must be valid JSON" });
+        }
+        if (typeof body === "object" &&
+            body !== null &&
+            body.tenantRole === "OWNER") {
+            return unprocessable("Cannot map IdP groups to OWNER", `POST /api/tenants/${tenantId}/transfer-ownership`);
+        }
+        const schema = z.object({
+            idpGroupName: z.string().min(1).max(255),
+            tenantRole: z.enum(["ADMIN", "MEMBER", "GUEST"]),
+            priority: z.number().int().positive().max(100000),
+        });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            const msg = parsed.error.issues[0]?.message ?? "Invalid input";
+            return jsonResponse(400, { error: "VALIDATION_ERROR", message: msg });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        try {
+            const created = await db.tenantRoleMapping.create({
+                data: {
+                    tenantId,
+                    idpGroupName: parsed.data.idpGroupName,
+                    tenantRole: parsed.data.tenantRole,
+                    priority: parsed.data.priority,
+                },
+                select: {
+                    id: true,
+                    idpGroupName: true,
+                    tenantRole: true,
+                    priority: true,
+                },
+            });
+            (0, audit_emit_1.emitTenantAudit)({
+                tenantId,
+                actorUserId: auth.userId,
+                action: "role_mapping.create",
+                targetType: "role_mapping",
+                targetId: created.id,
+                metadata: {
+                    idpGroupName: created.idpGroupName,
+                    tenantRole: created.tenantRole,
+                },
+            });
+            return jsonResponse(201, created);
+        }
+        catch (err) {
+            if (err instanceof Error &&
+                err.code === "P2002") {
+                return jsonResponse(409, {
+                    error: "DUPLICATE",
+                    message: "A mapping for this idpGroupName already exists",
+                });
+            }
+            throw err;
+        }
+    }
+    /** PATCH — update tenantRole and/or priority of an existing mapping. */
+    async handleUpdate(tenantId, mappingId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.RoleMappingEdit);
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let body;
+        try {
+            body = await request.json();
+        }
+        catch {
+            return jsonResponse(400, { error: "INVALID_JSON", message: "Body must be valid JSON" });
+        }
+        if (typeof body === "object" &&
+            body !== null &&
+            body.tenantRole === "OWNER") {
+            return unprocessable("Cannot map IdP groups to OWNER", `POST /api/tenants/${tenantId}/transfer-ownership`);
+        }
+        const schema = z
+            .object({
+            tenantRole: z.enum(["ADMIN", "MEMBER", "GUEST"]).optional(),
+            priority: z.number().int().positive().max(100000).optional(),
+        })
+            .refine((d) => d.tenantRole !== undefined || d.priority !== undefined, {
+            message: "At least one of tenantRole or priority is required",
+        });
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            const msg = parsed.error.issues[0]?.message ?? "Invalid input";
+            return jsonResponse(400, { error: "VALIDATION_ERROR", message: msg });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const existing = await db.tenantRoleMapping.findFirst({
+            where: { id: mappingId, tenantId },
+            select: { id: true, idpGroupName: true, tenantRole: true, priority: true },
+        });
+        if (!existing) {
+            return jsonResponse(404, { error: "NOT_FOUND", message: "Role mapping not found" });
+        }
+        const data = {};
+        if (parsed.data.tenantRole !== undefined) {
+            data.tenantRole = parsed.data.tenantRole;
+        }
+        if (parsed.data.priority !== undefined)
+            data.priority = parsed.data.priority;
+        const updated = await db.tenantRoleMapping.update({
+            where: { id: existing.id },
+            data,
+            select: {
+                id: true,
+                idpGroupName: true,
+                tenantRole: true,
+                priority: true,
+            },
+        });
+        (0, audit_emit_1.emitTenantAudit)({
+            tenantId,
+            actorUserId: auth.userId,
+            action: "role_mapping.update",
+            targetType: "role_mapping",
+            targetId: existing.id,
+            metadata: {
+                previousRole: existing.tenantRole,
+                previousPriority: existing.priority,
+                newRole: updated.tenantRole,
+                newPriority: updated.priority,
+            },
+        });
+        return jsonResponse(200, updated);
+    }
+    /** DELETE — remove a mapping. */
+    async handleDelete(tenantId, mappingId, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.RoleMappingEdit);
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const existing = await db.tenantRoleMapping.findFirst({
+            where: { id: mappingId, tenantId },
+            select: { id: true, idpGroupName: true, tenantRole: true },
+        });
+        if (!existing) {
+            return jsonResponse(404, { error: "NOT_FOUND", message: "Role mapping not found" });
+        }
+        await db.tenantRoleMapping.delete({ where: { id: existing.id } });
+        (0, audit_emit_1.emitTenantAudit)({
+            tenantId,
+            actorUserId: auth.userId,
+            action: "role_mapping.delete",
+            targetType: "role_mapping",
+            targetId: existing.id,
+            metadata: {
+                idpGroupName: existing.idpGroupName,
+                tenantRole: existing.tenantRole,
+            },
+        });
+        return new Response(null, { status: 204 });
+    }
+}
+exports.RoleMappingHandler = RoleMappingHandler;
+//# sourceMappingURL=role-mapping-handler.js.map

package/dist/lib/tenant/role-mapping-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-mapping-handler.js","sourceRoot":"","sources":["../../../src/lib/tenant/role-mapping-handler.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,6DAA8D;AAC9D,6CAAgE;AAChE,6CAA+C;AAE/C,MAAM,YAAY,GAAG,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;AAE5D,SAAS,YAAY,CAAC,MAAc,EAAE,IAAa;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,WAAoB;IAC1D,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,KAAK,EAAE,eAAe;QACtB,OAAO;QACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAa,kBAAkB;IAC7B,8CAA8C;IAC9C,KAAK,CAAC,UAAU,CACd,QAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,2BAAiB,EAAC,IAAI,EAAE,oBAAU,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC;YACnD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;YACvD,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,2BAAiB,EAAC,IAAI,EAAE,oBAAU,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IACE,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACZ,IAAgC,CAAC,UAAU,KAAK,OAAO,EACxD,CAAC;YACD,OAAO,aAAa,CAClB,gCAAgC,EAChC,qBAAqB,QAAQ,qBAAqB,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;YACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACxC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;SAClD,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC;YAC/D,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBAChD,IAAI,EAAE;oBACJ,QAAQ;oBACR,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;oBACtC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAwB;oBAChD,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;iBAC/B;gBACD,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,YAAY,EAAE,IAAI;oBAClB,UAAU,EAAE,IAAI;oBAChB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC,CAAC;YAEH,IAAA,4BAAe,EAAC;gBACd,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,MAAM;gBACxB,MAAM,EAAE,qBAAqB;gBAC7B,UAAU,EAAE,cAAc;gBAC1B,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,QAAQ,EAAE;oBACR,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,UAAU,EAAE,OAAO,CAAC,UAAU;iBAC/B;aACF,CAAC,CAAC;YAEH,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,YAAY,KAAK;gBACnB,GAAyB,CAAC,IAAI,KAAK,OAAO,EAC3C,CAAC;gBACD,OAAO,YAAY,CAAC,GAAG,EAAE;oBACvB,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,gDAAgD;iBAC1D,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,SAAiB,EACjB,OAAgB,EAChB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,2BAAiB,EAAC,IAAI,EAAE,oBAAU,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,CAAC,EAAE,GAAG,wDAAa,KAAK,GAAC,CAAC;QAClC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC1F,CAAC;QAED,IACE,OAAO,IAAI,KAAK,QAAQ;YACxB,IAAI,KAAK,IAAI;YACZ,IAAgC,CAAC,UAAU,KAAK,OAAO,EACxD,CAAC;YACD,OAAO,aAAa,CAClB,gCAAgC,EAChC,qBAAqB,QAAQ,qBAAqB,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC;aACb,MAAM,CAAC;YACN,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;SAC7D,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;YACrE,OAAO,EAAE,oDAAoD;SAC9D,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC;YAC/D,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;YAClC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC3E,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAwC,EAAE,CAAC;QACrD,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAwB,CAAC;QACzD,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAE7E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,IAAI;YACJ,MAAM,EAAE;gBACN,EAAE,EAAE,IAAI;gBACR,YAAY,EAAE,IAAI;gBAClB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QAEH,IAAA,4BAAe,EAAC;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE;gBACR,YAAY,EAAE,QAAQ,CAAC,UAAU;gBACjC,gBAAgB,EAAE,QAAQ,CAAC,QAAQ;gBACnC,OAAO,EAAE,OAAO,CAAC,UAAU;gBAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ;aAC9B;SACF,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,SAAiB,EACjB,IAAiB,EACjB,GAAQ;QAER,MAAM,MAAM,GACV,IAAA,qCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC;YACnC,IAAA,2BAAiB,EAAC,IAAI,EAAE,oBAAU,CAAC,eAAe,CAAC,CAAC;QACtD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,EAAE,YAAY,EAAE,GAAG,wDAAa,UAAU,GAAC,CAAC;QAClD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;YACpD,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;YAClC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;SAC3D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAElE,IAAA,4BAAe,EAAC;YACd,QAAQ;YACR,WAAW,EAAE,IAAI,CAAC,MAAM;YACxB,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,cAAc;YAC1B,QAAQ,EAAE,QAAQ,CAAC,EAAE;YACrB,QAAQ,EAAE;gBACR,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC;SACF,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;CACF;AA1PD,gDA0PC"}

package/dist/lib/tenant/setup-status.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Setup-status: machine-friendly tenant onboarding progress.
+ *
+ * `computeSetupStatus` is a pure function — it does no I/O and can be tested
+ * without a database.  `loadSetupStatus` performs the Prisma query and calls
+ * `computeSetupStatus` with the results.
+ */
+import type { Env } from "../../env";
+export type TenantStatusValue = "ok" | "created" | "missing";
+export interface SetupTenantSection {
+    status: TenantStatusValue;
+    tenantId: string;
+}
+export type DomainStatus = "verified" | "pending" | "failed";
+export interface SetupDomain {
+    domain: string;
+    verifiedAt: string | null;
+    status: DomainStatus;
+}
+export type IdpStatus = "ACTIVE" | "PENDING" | "DISABLED";
+export interface SetupIdp {
+    kind: string;
+    status: IdpStatus;
+    issuerUrl: string | null;
+}
+export interface SetupRoleMapping {
+    id: string;
+    externalGroup: string;
+    tenantRole: string;
+}
+export type NextStepCode = "DOMAIN_REQUIRED" | "DOMAIN_VERIFICATION_PENDING" | "IDP_REQUIRED" | "ROLE_MAPPING_REQUIRED" | "TEST_SIGN_IN" | "COMPLETE";
+export interface NextStep {
+    code: NextStepCode;
+    message: string;
+    endpoint: string;
+    remediation: string;
+}
+export interface SetupStatus {
+    tenant: SetupTenantSection;
+    domains: SetupDomain[];
+    idp: SetupIdp | null;
+    roleMappings: SetupRoleMapping[];
+    nextStep: NextStep;
+}
+export interface SetupStatusInputDomain {
+    domain: string;
+    verifiedAt: Date | null;
+    failedAt?: Date | null;
+}
+export interface SetupStatusInputIdp {
+    kind: string;
+    status: string;
+    issuerUrl: string | null;
+}
+export interface SetupStatusInputRoleMapping {
+    id: string;
+    externalGroup: string;
+    tenantRole: string;
+}
+export interface SetupStatusInput {
+    tenantId: string;
+    tenantExists: boolean;
+    /**
+     * Has at least one successful SSO sign-in been recorded?
+     * Trellis records the first successful federated sign-in so this flag
+     * can flip `TEST_SIGN_IN` → `COMPLETE`.
+     */
+    hasTestSignIn: boolean;
+    domains: SetupStatusInputDomain[];
+    idp: SetupStatusInputIdp | null;
+    roleMappings: SetupStatusInputRoleMapping[];
+}
+/**
+ * Deterministically derive the setup-status object from snapshot data.
+ * No side effects; safe to call in unit tests without any database.
+ */
+export declare function computeSetupStatus(input: SetupStatusInput): SetupStatus;
+/**
+ * Fetch all data needed to compute setup-status in a single read transaction,
+ * then return the computed status object.
+ */
+export declare function loadSetupStatus(tenantId: string, env: Env): Promise<SetupStatus | null>;
+//# sourceMappingURL=setup-status.d.ts.map

package/dist/lib/tenant/setup-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-status.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant/setup-status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAIrC,MAAM,MAAM,iBAAiB,GAAG,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;AAE7D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7D,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;AAE1D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,uBAAuB,GACvB,cAAc,GACd,UAAU,CAAC;AAEf,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,GAAG,EAAE,QAAQ,GAAG,IAAI,CAAC;IACrB,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAID,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,2BAA2B,EAAE,CAAC;CAC7C;AAID;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW,CAmGvE;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,GACP,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAiD7B"}