@de-otio/trellis 0.6.1 → 0.7.1

package/dist/lib/tenant/idp-handler.js

@@ -0,0 +1,693 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdpHandler = void 0;
+const client_cognito_identity_provider_1 = require("@aws-sdk/client-cognito-identity-provider");
+const auth_middleware_1 = require("../auth/auth-middleware");
+const require_1 = require("../auth/require");
+const claims_cache_1 = require("../auth/claims-cache");
+const emit_1 = require("../audit/emit");
+const event_types_1 = require("../audit/event-types");
+const idp_name_1 = require("./idp-name");
+const idp_sdk_1 = require("../cognito/idp-sdk");
+const issuer_probe_1 = require("../cognito/issuer-probe");
+const idp_secrets_1 = require("../secrets/idp-secrets");
+const client_secrets_manager_1 = require("@aws-sdk/client-secrets-manager");
+const JSON_HEADERS = { "content-type": "application/json" };
+function jsonResponse(status, body) {
+    return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+function badRequest(message, code = "VALIDATION_ERROR") {
+    return jsonResponse(400, { error: code, message });
+}
+function unprocessable(message, remediation) {
+    return jsonResponse(422, {
+        error: "UNPROCESSABLE",
+        message,
+        ...(remediation ? { remediation } : {}),
+    });
+}
+function badGateway() {
+    return jsonResponse(502, {
+        error: "COGNITO_ERROR",
+        message: "Identity-provider service is unavailable. Try again in a few minutes.",
+    });
+}
+function notFound() {
+    return jsonResponse(404, { error: "NOT_FOUND", message: "Identity provider not found" });
+}
+const auditEmitter = new emit_1.AuditEventEmitter();
+class IdpHandler {
+    deps;
+    constructor(deps = {}) {
+        this.deps = deps;
+    }
+    // ── Helpers ────────────────────────────────────────────────────────────────
+    getIdp(env) {
+        if (this.deps.idp)
+            return this.deps.idp;
+        return new idp_sdk_1.CognitoIdpSdk(new client_cognito_identity_provider_1.CognitoIdentityProviderClient({
+            region: env.COGNITO_REGION ?? process.env.AWS_REGION,
+        }));
+    }
+    getSecrets(env) {
+        if (this.deps.secrets)
+            return this.deps.secrets;
+        return new idp_secrets_1.IdpSecretsClient(new client_secrets_manager_1.SecretsManagerClient({
+            region: env.COGNITO_REGION ?? process.env.AWS_REGION,
+        }));
+    }
+    async invalidateAllMemberClaims(tenantId, env) {
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const members = await db.tenantMember.findMany({
+            where: { tenantId },
+            select: { user: { select: { cognitoSub: true } } },
+        });
+        const subs = members.map((m) => m.user.cognitoSub).filter((s) => !!s);
+        if (this.deps.invalidateClaimsForSubs) {
+            await this.deps.invalidateClaimsForSubs(subs);
+            return;
+        }
+        if (subs.length === 0)
+            return;
+        try {
+            const cache = (0, claims_cache_1.createClaimsCacheFromEnv)();
+            await Promise.all(subs.map((s) => cache.invalidate(s).catch(() => undefined)));
+        }
+        catch (err) {
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "claims-cache invalidate-all failed",
+                tenantId,
+                error: String(err),
+            }));
+        }
+    }
+    // ── POST ───────────────────────────────────────────────────────────────────
+    async handleCreate(tenantId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.IdpConfigure);
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let raw;
+        try {
+            raw = await request.json();
+        }
+        catch {
+            return badRequest("Body must be valid JSON", "INVALID_JSON");
+        }
+        const kind = raw?.kind;
+        if (kind === "SAML") {
+            return jsonResponse(501, {
+                error: "SAML_NOT_AVAILABLE_IN_MVP",
+                message: "SAML identity providers are not available in MVP. Use OIDC.",
+            });
+        }
+        if (kind !== "OIDC") {
+            return badRequest("kind must be 'OIDC'");
+        }
+        const schema = z.object({
+            kind: z.literal("OIDC"),
+            issuerUrl: z.string().url().max(2048),
+            clientId: z.string().min(1).max(512),
+            clientSecret: z.string().min(1).max(2048),
+            defaultRole: z.enum(["ADMIN", "MEMBER", "GUEST"]).optional(),
+            scopes: z.string().max(1024).optional(),
+            attributeMapping: z.record(z.string(), z.string()).optional(),
+        });
+        const parsed = schema.safeParse(raw);
+        if (!parsed.success) {
+            return badRequest(parsed.error.issues[0]?.message ?? "Invalid input");
+        }
+        const body = parsed.data;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const tenant = await db.tenant.findUnique({
+            where: { id: tenantId },
+            select: { id: true },
+        });
+        if (!tenant)
+            return notFound();
+        const verifiedDomains = await db.tenantDomain.findMany({
+            where: { tenantId, verifiedAt: { not: null } },
+            select: { domain: true },
+            orderBy: { domain: "asc" },
+        });
+        if (verifiedDomains.length === 0) {
+            return unprocessable("Tenant must have at least one verified domain before connecting an IdP", `POST /api/tenants/${tenantId}/domains`);
+        }
+        const existing = await db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: { id: true },
+        });
+        if (existing) {
+            return jsonResponse(409, {
+                error: "IDP_EXISTS",
+                message: "Tenant already has an identity provider",
+                remediation: `PATCH or DELETE /api/tenants/${tenantId}/identity-provider`,
+            });
+        }
+        const probe = await (0, issuer_probe_1.probeOidcIssuer)(body.issuerUrl);
+        if (!probe.ok) {
+            return jsonResponse(422, {
+                error: "ISSUER_UNREACHABLE",
+                message: probe.message,
+                reason: probe.reason,
+                remediation: "Confirm the issuer URL hosts a valid OIDC discovery document at /.well-known/openid-configuration",
+            });
+        }
+        const userPoolId = env.COGNITO_USER_POOL_ID;
+        const userPoolClientId = env.COGNITO_APP_CLIENT_ID;
+        if (!userPoolId || !userPoolClientId) {
+            return badGateway();
+        }
+        const providerName = (0, idp_name_1.cognitoIdpName)(tenantId);
+        const attributeMapping = {
+            ...(0, idp_sdk_1.defaultOidcAttributeMapping)(),
+            ...(body.attributeMapping ?? {}),
+        };
+        const idpIdentifiers = verifiedDomains.map((d) => d.domain);
+        const secrets = this.getSecrets(env);
+        const idp = this.getIdp(env);
+        let secretArn;
+        try {
+            const secret = await secrets.create(tenantId, body.clientSecret);
+            secretArn = secret.arn;
+        }
+        catch (err) {
+            const errName = err.name;
+            if (errName === "ResourceExistsException") {
+                return jsonResponse(409, {
+                    error: "IDP_EXISTS",
+                    message: "An IdP secret already exists for this tenant",
+                    remediation: `PATCH or DELETE /api/tenants/${tenantId}/identity-provider`,
+                });
+            }
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "idp-secret create failed",
+                tenantId,
+                errName,
+            }));
+            return badGateway();
+        }
+        try {
+            await idp.createOidcProvider({
+                userPoolId,
+                providerName,
+                details: {
+                    clientId: body.clientId,
+                    clientSecret: body.clientSecret,
+                    issuerUrl: body.issuerUrl,
+                    ...(body.scopes ? { scopes: body.scopes } : {}),
+                },
+                attributeMapping,
+                idpIdentifiers,
+            });
+        }
+        catch (err) {
+            await secrets.delete(tenantId).catch(() => undefined);
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "Cognito CreateIdentityProvider failed; rolled back secret",
+                tenantId,
+                errName: err.name,
+            }));
+            return badGateway();
+        }
+        let row;
+        try {
+            // 15s — must outlast the Cognito Describe+Update round-trip held under
+            // the advisory lock; default 5s is too short and would release the
+            // lock while the Cognito mutation is still in-flight.
+            row = await db.$transaction(async (tx) => {
+                await (0, idp_sdk_1.withUserPoolClientLock)(tx, userPoolId, async () => {
+                    await idp.setSupportedIdentityProvider(userPoolId, userPoolClientId, providerName, "add");
+                });
+                return tx.tenantIdentityProvider.create({
+                    data: {
+                        tenantId,
+                        kind: "OIDC",
+                        cognitoIdpName: providerName,
+                        issuerUrl: body.issuerUrl,
+                        clientId: body.clientId,
+                        clientSecretArn: secretArn,
+                        scopes: body.scopes ?? "openid email profile groups",
+                        attributeMapping: attributeMapping,
+                        defaultRole: body.defaultRole ?? null,
+                        status: "ACTIVE",
+                        enabledAt: new Date(),
+                    },
+                    select: {
+                        id: true,
+                        tenantId: true,
+                        kind: true,
+                        status: true,
+                        cognitoIdpName: true,
+                        issuerUrl: true,
+                        clientId: true,
+                        defaultRole: true,
+                        attributeMapping: true,
+                        scopes: true,
+                        enabledAt: true,
+                        createdAt: true,
+                        updatedAt: true,
+                    },
+                });
+            }, { timeout: 15000 });
+        }
+        catch (err) {
+            await idp.deleteProvider(userPoolId, providerName).catch(() => undefined);
+            await secrets.delete(tenantId).catch(() => undefined);
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "RDS commit failed; rolled back Cognito + secret",
+                tenantId,
+                errName: err.name,
+            }));
+            return badGateway();
+        }
+        void auditEmitter
+            .emit({
+            type: event_types_1.AuditEventType.TENANT_IDP_CONNECTED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: {
+                idpKind: "OIDC",
+                issuer: body.issuerUrl,
+                idpStatus: "ACTIVE",
+            },
+        }, db)
+            .catch((err) => console.warn(JSON.stringify({
+            event: "audit.emit_failed",
+            error: err?.message ?? "unknown",
+        })));
+        return jsonResponse(201, formatIdpRecord(row));
+    }
+    // ── GET ────────────────────────────────────────────────────────────────────
+    async handleGet(tenantId, auth, env) {
+        const denied = (0, auth_middleware_1.requireOwnTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.IdpView);
+        if (denied)
+            return denied;
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const row = await db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: {
+                id: true,
+                tenantId: true,
+                kind: true,
+                status: true,
+                cognitoIdpName: true,
+                issuerUrl: true,
+                clientId: true,
+                defaultRole: true,
+                attributeMapping: true,
+                scopes: true,
+                enabledAt: true,
+                createdAt: true,
+                updatedAt: true,
+            },
+        });
+        if (!row)
+            return notFound();
+        return jsonResponse(200, formatIdpRecord(row));
+    }
+    // ── PATCH ──────────────────────────────────────────────────────────────────
+    async handlePatch(tenantId, request, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.IdpConfigure);
+        if (denied)
+            return denied;
+        const { z } = await Promise.resolve().then(() => __importStar(require("zod")));
+        let raw;
+        try {
+            raw = await request.json();
+        }
+        catch {
+            return badRequest("Body must be valid JSON", "INVALID_JSON");
+        }
+        const isStatus = typeof raw?.status === "string";
+        if (isStatus) {
+            const schema = z.object({ status: z.enum(["ACTIVE", "DISABLED"]) });
+            const parsed = schema.safeParse(raw);
+            if (!parsed.success) {
+                return badRequest("status must be ACTIVE or DISABLED");
+            }
+            return this.applyStatus(tenantId, parsed.data, auth, env);
+        }
+        const schema = z.object({
+            clientSecret: z.string().min(1).max(2048).optional(),
+            attributeMapping: z.record(z.string(), z.string()).optional(),
+            defaultRole: z
+                .enum(["ADMIN", "MEMBER", "GUEST"])
+                .nullable()
+                .optional(),
+            scopes: z.string().max(1024).optional(),
+        });
+        const parsed = schema.safeParse(raw);
+        if (!parsed.success) {
+            return badRequest(parsed.error.issues[0]?.message ?? "Invalid input");
+        }
+        const body = parsed.data;
+        if (body.clientSecret === undefined &&
+            body.attributeMapping === undefined &&
+            body.defaultRole === undefined &&
+            body.scopes === undefined) {
+            return badRequest("At least one of clientSecret, attributeMapping, defaultRole or scopes is required");
+        }
+        return this.applyConfig(tenantId, body, auth, env);
+    }
+    async applyStatus(tenantId, body, auth, env) {
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const row = await db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: { id: true, status: true, cognitoIdpName: true },
+        });
+        if (!row)
+            return notFound();
+        if (row.status === body.status) {
+            return jsonResponse(200, { id: row.id, status: row.status, unchanged: true });
+        }
+        const userPoolId = env.COGNITO_USER_POOL_ID;
+        const userPoolClientId = env.COGNITO_APP_CLIENT_ID;
+        if (!userPoolId || !userPoolClientId)
+            return badGateway();
+        const idp = this.getIdp(env);
+        const op = body.status === "ACTIVE" ? "add" : "remove";
+        try {
+            // 15s — see handleCreate; the Cognito Describe+Update under the
+            // advisory lock can exceed Prisma's default 5s.
+            await db.$transaction(async (tx) => {
+                await (0, idp_sdk_1.withUserPoolClientLock)(tx, userPoolId, async () => {
+                    await idp.setSupportedIdentityProvider(userPoolId, userPoolClientId, row.cognitoIdpName, op);
+                });
+                await tx.tenantIdentityProvider.update({
+                    where: { id: row.id },
+                    data: {
+                        status: body.status,
+                        ...(body.status === "ACTIVE" ? { enabledAt: new Date() } : {}),
+                    },
+                });
+            }, { timeout: 15000 });
+        }
+        catch (err) {
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "IdP status toggle failed",
+                tenantId,
+                errName: err.name,
+            }));
+            return badGateway();
+        }
+        if (body.status === "DISABLED") {
+            await this.invalidateAllMemberClaims(tenantId, env);
+        }
+        void auditEmitter
+            .emit({
+            type: body.status === "DISABLED"
+                ? event_types_1.AuditEventType.TENANT_IDP_DISABLED
+                : event_types_1.AuditEventType.TENANT_IDP_MODIFIED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: { idpStatus: body.status },
+        }, db)
+            .catch((err) => console.warn(JSON.stringify({
+            event: "audit.emit_failed",
+            error: err?.message ?? "unknown",
+        })));
+        return jsonResponse(200, { id: row.id, status: body.status });
+    }
+    async applyConfig(tenantId, body, auth, env) {
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const row = await db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: {
+                id: true,
+                kind: true,
+                cognitoIdpName: true,
+                attributeMapping: true,
+                scopes: true,
+            },
+        });
+        if (!row)
+            return notFound();
+        if (row.kind !== "OIDC") {
+            return jsonResponse(501, {
+                error: "SAML_NOT_AVAILABLE_IN_MVP",
+                message: "SAML providers cannot be modified in MVP",
+            });
+        }
+        const userPoolId = env.COGNITO_USER_POOL_ID;
+        if (!userPoolId)
+            return badGateway();
+        const idp = this.getIdp(env);
+        const secrets = this.getSecrets(env);
+        const newAttributeMapping = body.attributeMapping
+            ? mergeAttributeMapping(row.attributeMapping, body.attributeMapping)
+            : undefined;
+        // Cognito UpdateIdentityProvider goes first. If it fails, Secrets Manager
+        // is untouched and the old client secret remains the source of truth. The
+        // create flow is structured the other way (secret first) because the
+        // secret must exist before Cognito can reference it; rotation has no such
+        // ordering constraint.
+        try {
+            await idp.updateOidcProvider({
+                userPoolId,
+                providerName: row.cognitoIdpName,
+                ...(body.clientSecret !== undefined
+                    ? { details: { clientSecret: body.clientSecret, ...(body.scopes ? { scopes: body.scopes } : {}) } }
+                    : body.scopes
+                        ? { details: { scopes: body.scopes } }
+                        : {}),
+                ...(newAttributeMapping ? { attributeMapping: newAttributeMapping } : {}),
+            });
+        }
+        catch (err) {
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "Cognito UpdateIdentityProvider failed",
+                tenantId,
+                errName: err.name,
+            }));
+            return badGateway();
+        }
+        if (body.clientSecret !== undefined) {
+            try {
+                await secrets.rotate(tenantId, body.clientSecret);
+            }
+            catch (err) {
+                console.warn(JSON.stringify({
+                    level: "warn",
+                    msg: "idp-secret rotate failed",
+                    tenantId,
+                    errName: err.name,
+                }));
+                return badGateway();
+            }
+        }
+        const data = {};
+        if (newAttributeMapping)
+            data.attributeMapping = newAttributeMapping;
+        if (body.defaultRole !== undefined)
+            data.defaultRole = body.defaultRole;
+        if (body.scopes !== undefined)
+            data.scopes = body.scopes;
+        const updated = await db.tenantIdentityProvider.update({
+            where: { id: row.id },
+            data,
+            select: {
+                id: true,
+                tenantId: true,
+                kind: true,
+                status: true,
+                cognitoIdpName: true,
+                issuerUrl: true,
+                clientId: true,
+                defaultRole: true,
+                attributeMapping: true,
+                scopes: true,
+                enabledAt: true,
+                createdAt: true,
+                updatedAt: true,
+            },
+        });
+        void auditEmitter
+            .emit({
+            type: event_types_1.AuditEventType.TENANT_IDP_MODIFIED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: {
+                idpKind: row.kind,
+                changedAttributes: Object.keys(data),
+            },
+        }, db)
+            .catch((err) => console.warn(JSON.stringify({
+            event: "audit.emit_failed",
+            error: err?.message ?? "unknown",
+        })));
+        return jsonResponse(200, formatIdpRecord(updated));
+    }
+    // ── DELETE ─────────────────────────────────────────────────────────────────
+    async handleDelete(tenantId, url, auth, env) {
+        const denied = (0, auth_middleware_1.requireActiveTenant)(auth, tenantId) ??
+            (0, require_1.requireCapability)(auth, require_1.Capability.IdpConfigure);
+        if (denied)
+            return denied;
+        if (url.searchParams.get("confirm") !== "true") {
+            return jsonResponse(400, {
+                error: "CONFIRM_REQUIRED",
+                message: "Disconnecting an IdP requires confirm=true",
+                remediation: `DELETE /api/tenants/${tenantId}/identity-provider?confirm=true`,
+            });
+        }
+        const { createPrisma } = await Promise.resolve().then(() => __importStar(require("../../db")));
+        const db = createPrisma(env);
+        const row = await db.tenantIdentityProvider.findUnique({
+            where: { tenantId },
+            select: { id: true, cognitoIdpName: true, kind: true },
+        });
+        if (!row)
+            return notFound();
+        const userPoolId = env.COGNITO_USER_POOL_ID;
+        const userPoolClientId = env.COGNITO_APP_CLIENT_ID;
+        if (!userPoolId || !userPoolClientId)
+            return badGateway();
+        const idp = this.getIdp(env);
+        const secrets = this.getSecrets(env);
+        try {
+            // 15s — see handleCreate; both Cognito calls happen under the advisory
+            // lock and can exceed Prisma's default 5s.
+            await db.$transaction(async (tx) => {
+                await (0, idp_sdk_1.withUserPoolClientLock)(tx, userPoolId, async () => {
+                    await idp.setSupportedIdentityProvider(userPoolId, userPoolClientId, row.cognitoIdpName, "remove");
+                });
+                await idp.deleteProvider(userPoolId, row.cognitoIdpName);
+                await tx.tenantIdentityProvider.delete({ where: { id: row.id } });
+            }, { timeout: 15000 });
+        }
+        catch (err) {
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "IdP delete failed",
+                tenantId,
+                errName: err.name,
+            }));
+            return badGateway();
+        }
+        await secrets.delete(tenantId).catch(() => undefined);
+        await this.invalidateAllMemberClaims(tenantId, env);
+        await bestEffortGlobalSignOutAllMembers(env, tenantId, db);
+        void auditEmitter
+            .emit({
+            type: event_types_1.AuditEventType.TENANT_IDP_DELETED,
+            tenantId,
+            actorUserId: auth.userId,
+            payload: { idpKind: row.kind },
+        }, db)
+            .catch((err) => console.warn(JSON.stringify({
+            event: "audit.emit_failed",
+            error: err?.message ?? "unknown",
+        })));
+        return jsonResponse(200, { ok: true });
+    }
+}
+exports.IdpHandler = IdpHandler;
+function mergeAttributeMapping(existing, incoming) {
+    const base = existing && typeof existing === "object" && !Array.isArray(existing)
+        ? existing
+        : (0, idp_sdk_1.defaultOidcAttributeMapping)();
+    return { ...base, ...incoming };
+}
+function formatIdpRecord(row) {
+    return {
+        id: row.id,
+        tenantId: row.tenantId,
+        kind: row.kind,
+        status: row.status,
+        cognitoIdpName: row.cognitoIdpName,
+        issuerUrl: row.issuerUrl,
+        clientId: row.clientId,
+        defaultRole: row.defaultRole,
+        attributeMapping: row.attributeMapping,
+        scopes: row.scopes,
+        enabledAt: row.enabledAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+async function bestEffortGlobalSignOutAllMembers(env, tenantId, db) {
+    const userPoolId = env.COGNITO_USER_POOL_ID;
+    if (!userPoolId)
+        return;
+    let usernames = [];
+    try {
+        const members = await db.tenantMember.findMany({
+            where: { tenantId },
+            select: { user: { select: { email: true } } },
+        });
+        usernames = members.map((m) => m.user.email).filter((e) => !!e);
+    }
+    catch {
+        return;
+    }
+    if (usernames.length === 0)
+        return;
+    try {
+        const { CognitoIdentityProviderClient: CIP, AdminUserGlobalSignOutCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-cognito-identity-provider")));
+        const client = new CIP({
+            region: env.COGNITO_REGION ?? process.env.AWS_REGION,
+        });
+        await Promise.all(usernames.map((u) => client
+            .send(new AdminUserGlobalSignOutCommand({ UserPoolId: userPoolId, Username: u }))
+            .catch((err) => {
+            console.warn(JSON.stringify({
+                level: "warn",
+                msg: "AdminUserGlobalSignOut failed (best effort)",
+                tenantId,
+                errName: err.name,
+            }));
+        })));
+    }
+    catch {
+        return;
+    }
+}
+//# sourceMappingURL=idp-handler.js.map