@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/domain.js

@@ -0,0 +1,1122 @@
+import { retryWithBackoff } from "../../shared/retry.js";
+import { ErrorCode } from "../../shared/codes.js";
+import { log } from "../log.js";
+import { convexError } from "../errors.js";
+import { createConnectionDomain, createGroupConnection, getConnectionDomainVerification, getGroupConnection, getGroupConnectionByDomain, getScimConfigByConnection, listConnectionDomains, listGroupConnections, removeConnectionDomain, removeConnectionDomainVerification, removeGroupConnection, updateGroupConnection, upsertConnectionDomainVerification, upsertGroupConnectionSecret, verifyConnectionDomain } from "../contract.js";
+import { assertSafeIdpFetchUrl } from "../../shared/fetch/guard.js";
+import { getGroupOidcUrls, getGroupSamlUrls, groupOidcProviderId, groupSamlProviderId, normalizeDomain } from "./shared.js";
+import { getOidcConfig, getPublicConnectionConfig, getPublicOidcConfig, getPublicSamlConfig, getSamlConfig, upsertProtocolConfig, withOidcSecretState } from "./config.js";
+import { createGroupPolicyDomain } from "./policy/domain.js";
+import { createGroupScimDomain } from "./provision.js";
+import { createServiceProviderMetadata, getSamlServiceProviderOptions, parseSamlIdpMetadataChecked } from "./saml.js";
+import { createGroupWebhookDomain } from "./webhook.js";
+
+//#region src/server/connection/domain.ts
+/**
+* Build the connection and Connection management domain.
+*/
+function createGroupConnectionDomain(deps) {
+	const { config, getGroupConnectionSecret, loadConnectionOrThrow, validateGroupConnectionPolicy, emitGroupAuthEvent, connectionNotFoundError, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND, requireEnv, generateRandomString, INVITE_TOKEN_ALPHABET, sha256, encryptSecret, loadGroupPolicyOrThrow } = deps;
+	const webhook = createGroupWebhookDomain({
+		config,
+		encryptSecret,
+		loadConnectionOrThrow,
+		emitGroupAuthEvent
+	});
+	const scim = createGroupScimDomain({
+		config,
+		requireEnv,
+		generateRandomString,
+		INVITE_TOKEN_ALPHABET,
+		sha256,
+		loadGroupPolicyOrThrow,
+		emitGroupAuthEvent
+	});
+	const policy = createGroupPolicyDomain({
+		config,
+		loadGroupPolicyOrThrow,
+		validateGroupConnectionPolicy,
+		emitGroupAuthEvent
+	});
+	const resolveGroupConnectionProtocol = (connection) => {
+		if (connection.protocol === "oidc") return "oidc";
+		if (connection.protocol === "saml") return "saml";
+		throw convexError(ErrorCode.PROVIDER_NOT_CONFIGURED, "Group connection protocol is not configured.");
+	};
+	const GROUP_CONNECTION_DOMAIN_VERIFICATION_PREFIX = "_convex-auth-verification";
+	const GROUP_CONNECTION_DOMAIN_VERIFICATION_TTL_MS = 1e3 * 60 * 60 * 24 * 7;
+	const toDomainSummary = (domain) => ({
+		domainId: domain._id,
+		domain: domain.domain,
+		isPrimary: domain.isPrimary,
+		verified: domain.verifiedAt !== void 0,
+		verifiedAt: domain.verifiedAt ?? null
+	});
+	const getDomainVerificationRecordName = (domain) => `${GROUP_CONNECTION_DOMAIN_VERIFICATION_PREFIX}.${normalizeDomain(domain)}`;
+	const parseTxtAnswer = (value) => {
+		const quoted = [...value.matchAll(/"([^"]*)"/g)].map((match) => match[1]);
+		if (quoted.length > 0) return quoted.join("");
+		return value.replace(/^"|"$/g, "").trim();
+	};
+	const resolveTxtValues = async (recordName) => {
+		const url = new URL("https://dns.google/resolve");
+		url.searchParams.set("name", recordName);
+		url.searchParams.set("type", "TXT");
+		const response = await fetch(url, { headers: { accept: "application/json" } });
+		if (!response.ok) throw new Error(`DNS TXT lookup failed with status ${response.status}.`);
+		const data = await response.json();
+		const normalizeName = (name) => name.replace(/\.$/, "").toLowerCase();
+		const expectedName = normalizeName(recordName);
+		return (data.Answer ?? []).filter((answer) => answer.type === 16 && typeof answer.name === "string" && normalizeName(answer.name) === expectedName).map((answer) => typeof answer.data === "string" ? parseTxtAnswer(answer.data) : null).filter((value) => value !== null && value.length > 0);
+	};
+	async function getConnection(ctx, args) {
+		if (args.id !== void 0) {
+			const record = await getGroupConnection(ctx, config.component.connection, args.id);
+			return record === null ? null : {
+				...record,
+				config: getPublicConnectionConfig(record.config)
+			};
+		}
+		if (args.domain !== void 0) {
+			const lookup = await getGroupConnectionByDomain(ctx, config.component.connection, normalizeDomain(args.domain));
+			if (lookup === null || lookup.connection === null) return lookup;
+			return {
+				...lookup,
+				connection: {
+					...lookup.connection,
+					config: getPublicConnectionConfig(lookup.connection.config)
+				}
+			};
+		}
+		throw convexError(ErrorCode.INVALID_PARAMETERS, "Connection id or domain is required.");
+	}
+	return {
+		connection: {
+			create: async (ctx, data) => {
+				const connectionId = await createGroupConnection(ctx, config.component.connection, data);
+				await emitGroupAuthEvent(ctx, {
+					connectionId,
+					groupId: data.groupId,
+					kind: "connection.created",
+					actor: { type: "system" },
+					subject: {
+						type: "connection",
+						id: connectionId
+					},
+					outcome: "success",
+					data: {
+						connectionId,
+						protocol: data.protocol
+					},
+					webhook: false
+				});
+				return {
+					connectionId,
+					groupId: data.groupId
+				};
+			},
+			get: getConnection,
+			list: async (ctx, opts) => {
+				const result = await listGroupConnections(ctx, config.component.connection, {
+					where: opts.where,
+					paginationOpts: opts.paginationOpts,
+					orderBy: opts.orderBy,
+					order: opts.order
+				});
+				return {
+					...result,
+					page: result.page.map((record) => ({
+						...record,
+						config: getPublicConnectionConfig(record.config)
+					}))
+				};
+			},
+			update: async (ctx, args) => {
+				await updateGroupConnection(ctx, config.component.connection, {
+					connectionId: args.id,
+					patch: args.patch
+				});
+				const updated = await getConnection(ctx, { id: args.id });
+				if (updated !== null) await emitGroupAuthEvent(ctx, {
+					connectionId: args.id,
+					groupId: updated.groupId,
+					kind: "connection.updated",
+					actor: { type: "system" },
+					subject: {
+						type: "connection",
+						id: args.id
+					},
+					outcome: "success",
+					data: {
+						connectionId: args.id,
+						changed: Object.keys(args.patch)
+					},
+					webhook: false
+				});
+				return { connectionId: args.id };
+			},
+			remove: async (ctx, args) => {
+				const connection = await getConnection(ctx, { id: args.id });
+				await removeGroupConnection(ctx, config.component.connection, args.id);
+				if (connection !== null) await emitGroupAuthEvent(ctx, {
+					connectionId: args.id,
+					groupId: connection.groupId,
+					kind: "connection.removed",
+					actor: { type: "system" },
+					subject: {
+						type: "connection",
+						id: args.id
+					},
+					outcome: "success",
+					data: { connectionId: args.id },
+					webhook: false
+				});
+				return { connectionId: args.id };
+			},
+			status: async (ctx, args) => {
+				const connectionId = args.id;
+				const connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				const policy$1 = await loadGroupPolicyOrThrow(ctx, connection.groupId);
+				const oidcConfig = getOidcConfig(connection.config);
+				const oidcSecret = await getGroupConnectionSecret(ctx, connection._id, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND);
+				const samlConfig = getSamlConfig(connection.config);
+				const scimConfig = await getScimConfigByConnection(ctx, config.component.connection, connectionId);
+				const domains = await listConnectionDomains(ctx, config.component.connection, connectionId);
+				const oidcReady = oidcConfig?.enabled === true && typeof oidcConfig?.client?.id === "string" && oidcConfig.client.id.length > 0 && oidcSecret !== null && (typeof oidcConfig?.discovery?.issuer === "string" || typeof oidcConfig?.discovery?.discoveryUrl === "string");
+				const samlReady = samlConfig?.enabled === true && typeof samlConfig?.idp?.entityId === "string";
+				const scimReady = scimConfig?.status === "active";
+				const ready = connection.status === "active" && (connection.protocol === "oidc" ? oidcReady : samlReady);
+				return {
+					connectionId: connection._id,
+					status: connection.status,
+					ready,
+					domainCount: domains.length,
+					protocols: {
+						oidc: {
+							configured: connection.protocol === "oidc" ? oidcReady : false,
+							ready: connection.protocol === "oidc" ? oidcReady : false,
+							clientId: oidcConfig?.client?.id ?? null,
+							issuer: oidcConfig?.discovery?.issuer ?? oidcConfig?.discovery?.discoveryUrl ?? null
+						},
+						saml: {
+							configured: connection.protocol === "saml" ? samlReady : false,
+							ready: connection.protocol === "saml" ? samlReady : false,
+							entityId: samlConfig?.idp?.entityId ?? samlConfig?.idp?.issuer ?? null
+						},
+						scim: {
+							configured: scimReady,
+							ready: scimReady,
+							basePath: scimConfig?.basePath ?? null,
+							deprovisionMode: policy$1.provisioning.deprovision.mode
+						}
+					}
+				};
+			}
+		},
+		domain: {
+			create: async (ctx, data) => {
+				return await createConnectionDomain(ctx, config.component.connection, {
+					...data,
+					domain: normalizeDomain(data.domain)
+				});
+			},
+			list: async (ctx, args) => {
+				return await listConnectionDomains(ctx, config.component.connection, args.connectionId);
+			},
+			validate: async (ctx, args) => {
+				const { connectionId } = args;
+				const connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				const domains = await listConnectionDomains(ctx, config.component.connection, connectionId);
+				const primaryDomains = domains.filter((domain) => domain.isPrimary);
+				const verifiedDomains = domains.filter((domain) => domain.verifiedAt !== void 0);
+				const warnings = [];
+				if (domains.length === 0) warnings.push("No domains configured.");
+				if (primaryDomains.length === 0 && domains.length > 0) warnings.push("No primary domain configured.");
+				if (primaryDomains.length > 1) warnings.push("Multiple primary domains configured.");
+				if (verifiedDomains.length === 0 && domains.length > 0) warnings.push("No verified domains yet.");
+				return {
+					connectionId,
+					ready: connection.status === "active" && domains.length > 0 && primaryDomains.length === 1 && verifiedDomains.length > 0,
+					summary: {
+						domainCount: domains.length,
+						primaryCount: primaryDomains.length,
+						verifiedCount: verifiedDomains.length
+					},
+					domains: domains.map((domain) => toDomainSummary(domain)),
+					warnings
+				};
+			},
+			status: async (ctx, args) => {
+				const { connectionId } = args;
+				const [connection, domains] = await Promise.all([getGroupConnection(ctx, config.component.connection, connectionId), listConnectionDomains(ctx, config.component.connection, connectionId)]);
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				const primaryDomain = domains.find((domain) => domain.isPrimary) ?? null;
+				const verifiedDomains = domains.filter((domain) => domain.verifiedAt !== void 0);
+				const pendingChallenges = (await Promise.all(domains.map(async (domain) => {
+					const verification = await getConnectionDomainVerification(ctx, config.component.connection, domain._id);
+					if (!verification || verification.expiresAt < Date.now()) return null;
+					return {
+						domain: domain.domain,
+						recordName: verification.recordName,
+						expiresAt: verification.expiresAt
+					};
+				}))).filter((challenge) => challenge !== null);
+				const warnings = [];
+				const nextSteps = [];
+				if (domains.length === 0) {
+					warnings.push("No domains configured.");
+					nextSteps.push("Attach at least one domain to this connection.");
+				}
+				if (primaryDomain === null && domains.length > 0) {
+					warnings.push("No primary domain configured.");
+					nextSteps.push("Mark one attached domain as the primary domain.");
+				}
+				if (verifiedDomains.length === 0 && domains.length > 0) {
+					warnings.push("No verified domains yet.");
+					nextSteps.push("Request a TXT challenge and confirm verification for at least one domain.");
+				}
+				if (primaryDomain !== null && primaryDomain.verifiedAt === void 0 && domains.length > 0) nextSteps.push(`Verify the primary domain ${primaryDomain.domain} to establish trusted ownership.`);
+				if (pendingChallenges.length > 0) nextSteps.push("If DNS is already updated, confirm the pending TXT challenge to complete verification.");
+				const primaryDomainVerified = primaryDomain?.verifiedAt !== void 0;
+				return {
+					connectionId,
+					ready: connection.status === "active" && domains.length > 0 && primaryDomain !== null && verifiedDomains.length > 0,
+					primaryDomain: primaryDomain === null ? null : {
+						domainId: primaryDomain._id,
+						domain: primaryDomain.domain,
+						isPrimary: true,
+						verified: primaryDomain.verifiedAt !== void 0,
+						verifiedAt: primaryDomain.verifiedAt ?? null
+					},
+					trustedDomains: verifiedDomains.map((domain) => ({
+						domainId: domain._id,
+						domain: domain.domain,
+						isPrimary: Boolean(domain.isPrimary),
+						verified: true,
+						verifiedAt: domain.verifiedAt ?? null
+					})),
+					pendingChallenges,
+					trust: {
+						domainDiscoveryReady: verifiedDomains.length > 0,
+						primaryDomainVerified,
+						automaticLinkingEligible: primaryDomainVerified && connection.status === "active" && verifiedDomains.length > 0
+					},
+					warnings,
+					nextSteps
+				};
+			},
+			remove: async (ctx, args) => {
+				await removeConnectionDomain(ctx, config.component.connection, args.id);
+			},
+			verification: {
+				request: async (ctx, args) => {
+					const connection = await loadConnectionOrThrow(ctx, args.connectionId);
+					const normalizedDomain = normalizeDomain(args.domain);
+					const domain = (await listConnectionDomains(ctx, config.component.connection, connection._id)).find((entry) => entry.domain === normalizedDomain);
+					if (!domain) throw convexError(ErrorCode.INVALID_PARAMETERS, "Domain is not attached to this connection.");
+					const requestedAt = Date.now();
+					const expiresAt = requestedAt + GROUP_CONNECTION_DOMAIN_VERIFICATION_TTL_MS;
+					const token = generateRandomString(32, INVITE_TOKEN_ALPHABET);
+					const tokenHash = await sha256(token);
+					const recordName = getDomainVerificationRecordName(normalizedDomain);
+					await upsertConnectionDomainVerification(ctx, config.component.connection, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						domainId: domain._id,
+						domain: normalizedDomain,
+						recordName,
+						token,
+						tokenHash,
+						requestedAt,
+						expiresAt
+					});
+					await emitGroupAuthEvent(ctx, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						kind: "connection.domain.verification_requested",
+						actor: { type: "system" },
+						subject: {
+							type: "connection",
+							id: domain._id
+						},
+						data: {
+							connectionId: connection._id,
+							domain: normalizedDomain,
+							recordName,
+							expiresAt
+						}
+					});
+					return {
+						connectionId: connection._id,
+						domain: normalizedDomain,
+						requestedAt,
+						expiresAt,
+						challenge: {
+							recordType: "TXT",
+							recordName,
+							recordValue: token
+						}
+					};
+				},
+				confirm: async (ctx, args) => {
+					const connection = await loadConnectionOrThrow(ctx, args.connectionId);
+					const normalizedDomain = normalizeDomain(args.domain);
+					const domain = (await listConnectionDomains(ctx, config.component.connection, connection._id)).find((entry) => entry.domain === normalizedDomain);
+					if (!domain) throw convexError(ErrorCode.INVALID_PARAMETERS, "Domain is not attached to this connection.");
+					if (domain.verifiedAt !== void 0) return {
+						connectionId: connection._id,
+						domain: normalizedDomain,
+						verifiedAt: domain.verifiedAt,
+						checks: [{
+							name: "domain_verified",
+							ok: true,
+							message: "Domain is already verified."
+						}]
+					};
+					const verification = await getConnectionDomainVerification(ctx, config.component.connection, domain._id);
+					const checks = [];
+					if (!verification) {
+						checks.push({
+							name: "verification_requested",
+							ok: false,
+							message: "No active domain verification challenge exists."
+						});
+						return {
+							connectionId: connection._id,
+							domain: normalizedDomain,
+							checks
+						};
+					}
+					checks.push({
+						name: "verification_requested",
+						ok: true
+					});
+					if (verification.expiresAt < Date.now()) {
+						await removeConnectionDomainVerification(ctx, config.component.connection, domain._id);
+						checks.push({
+							name: "challenge_active",
+							ok: false,
+							message: "The verification challenge expired. Request a new one."
+						});
+						return {
+							connectionId: connection._id,
+							domain: normalizedDomain,
+							checks
+						};
+					}
+					checks.push({
+						name: "challenge_active",
+						ok: true
+					});
+					let txtValues;
+					try {
+						txtValues = await resolveTxtValues(verification.recordName);
+					} catch (error) {
+						throw convexError(ErrorCode.INTERNAL_ERROR, error instanceof Error ? error.message : "Failed to resolve DNS TXT records.");
+					}
+					checks.push({
+						name: "dns_record_present",
+						ok: txtValues.length > 0,
+						message: txtValues.length > 0 ? void 0 : `No TXT records found at ${verification.recordName}.`
+					});
+					const matches = txtValues.includes(verification.token);
+					checks.push({
+						name: "dns_record_matches",
+						ok: matches,
+						message: matches ? void 0 : `TXT record at ${verification.recordName} does not match the expected value.`
+					});
+					if (!checks.every((check) => check.ok)) return {
+						connectionId: connection._id,
+						domain: normalizedDomain,
+						checks
+					};
+					const verifiedAt = Date.now();
+					await verifyConnectionDomain(ctx, config.component.connection, {
+						domainId: domain._id,
+						verifiedAt
+					});
+					await emitGroupAuthEvent(ctx, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						kind: "connection.domain.verified",
+						actor: { type: "system" },
+						subject: {
+							type: "connection",
+							id: domain._id
+						},
+						data: {
+							connectionId: connection._id,
+							domain: normalizedDomain,
+							verifiedAt
+						}
+					});
+					return {
+						connectionId: connection._id,
+						domain: normalizedDomain,
+						verifiedAt,
+						checks
+					};
+				}
+			}
+		},
+		saml: {
+			upsert: async (ctx, data) => {
+				let connection;
+				try {
+					connection = await getGroupConnection(ctx, config.component.connection, data.connectionId);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+				}
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				if (connection.protocol !== "saml") throw convexError(ErrorCode.INVALID_PARAMETERS, "This connection is not a SAML connection.");
+				const metadataUrl = typeof data.metadata.url === "string" && data.metadata.url.length > 0 ? data.metadata.url : void 0;
+				let metadataXml;
+				if (metadataUrl) {
+					assertSafeIdpFetchUrl(metadataUrl);
+					try {
+						metadataXml = await retryWithBackoff(async () => ctx.runAction(config.component.connection.cache.samlMetadata, { url: metadataUrl }));
+					} catch (error) {
+						throw convexError(ErrorCode.INVALID_PARAMETERS, error instanceof Error ? error.message : "Failed to fetch SAML metadata");
+					}
+				} else if (data.metadata.xml) metadataXml = data.metadata.xml;
+				else throw convexError(ErrorCode.INVALID_PARAMETERS, "SAML registration requires metadataXml or metadataUrl.");
+				let parsed;
+				try {
+					parsed = parseSamlIdpMetadataChecked({
+						metadataXml,
+						config: { protocols: { saml: { security: data.security } } }
+					});
+				} catch (error) {
+					throw convexError(ErrorCode.INVALID_PARAMETERS, error instanceof Error ? `Failed to parse SAML metadata: ${error.message}` : "Failed to parse SAML metadata.");
+				}
+				const setIdpSigningCert = parsed.signingCert;
+				if (!(typeof setIdpSigningCert === "string" ? setIdpSigningCert.trim().length > 0 : Array.isArray(setIdpSigningCert) && setIdpSigningCert.some((cert) => typeof cert === "string" && cert.trim().length > 0))) throw convexError(ErrorCode.INVALID_PARAMETERS, "SAML IdP metadata has no usable signing certificate. A signing certificate is required to verify assertions before the connection can be activated.");
+				log("DEBUG", "[group-connection] saml:configure:parsed", {
+					connectionId: data.connectionId,
+					metadataUrl,
+					entityId: parsed.entityId,
+					issuer: parsed.issuer
+				});
+				const baseConfig = upsertProtocolConfig(connection.config, "saml", {
+					enabled: true,
+					idp: {
+						metadataUrl,
+						metadataXml,
+						...parsed
+					},
+					serviceProvider: data.serviceProvider,
+					request: {
+						signAuthnRequests: data.request?.signAuthnRequests ?? parsed.wantsSignedAuthnRequests,
+						nameIdFormat: data.request?.nameIdFormat,
+						forceAuthn: data.request?.forceAuthn,
+						authnContextClassRefs: data.request?.authnContextClassRefs
+					},
+					profile: {
+						mapping: data.profile?.mapping,
+						extraFields: data.profile?.extraFields
+					},
+					security: data.security
+				});
+				const normalizedDomains = data.domains?.map(normalizeDomain);
+				const nextConfig = normalizedDomains ? {
+					...baseConfig,
+					domains: normalizedDomains
+				} : baseConfig;
+				const nextSamlConfig = nextConfig.protocols?.saml ?? void 0;
+				log("DEBUG", "[group-connection] saml:configure:nextConfig", {
+					connectionId: data.connectionId,
+					entityId: nextSamlConfig?.idp?.entityId ?? null,
+					issuer: nextSamlConfig?.idp?.issuer ?? null,
+					metadataUrl: nextSamlConfig?.idp?.metadataUrl ?? null,
+					hasMetadataXml: typeof nextSamlConfig?.idp?.metadataXml === "string"
+				});
+				try {
+					await updateGroupConnection(ctx, config.component.connection, {
+						connectionId: connection._id,
+						patch: {
+							status: "active",
+							config: nextConfig
+						}
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to persist SAML registration.");
+				}
+				if (normalizedDomains) for (const [index, domain] of normalizedDomains.entries()) try {
+					await createConnectionDomain(ctx, config.component.connection, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						domain,
+						isPrimary: index === 0
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to persist connection domain.");
+				}
+				try {
+					await emitGroupAuthEvent(ctx, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						kind: "connection.saml.set",
+						actor: { type: "system" },
+						subject: {
+							type: "connection",
+							id: connection._id
+						},
+						data: {
+							connectionId: connection._id,
+							metadataUrl,
+							domains: normalizedDomains
+						}
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to record SAML registration audit event.");
+				}
+				return {
+					connectionId: connection._id,
+					groupId: connection.groupId
+				};
+			},
+			refresh: async (ctx, data) => {
+				let connection;
+				try {
+					connection = await getGroupConnection(ctx, config.component.connection, data.connectionId);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+				}
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				const samlConfig = connection.config?.protocols?.saml;
+				if (connection.protocol !== "saml") throw convexError(ErrorCode.INVALID_PARAMETERS, "This connection is not a SAML connection.");
+				if (typeof samlConfig?.idp?.metadataUrl !== "string") throw convexError(ErrorCode.INVALID_PARAMETERS, "SAML metadataUrl is not configured.");
+				const metadataUrl = samlConfig.idp.metadataUrl;
+				assertSafeIdpFetchUrl(metadataUrl);
+				let metadataXml;
+				try {
+					metadataXml = await retryWithBackoff(async () => ctx.runAction(config.component.connection.cache.samlMetadata, { url: metadataUrl }));
+				} catch (error) {
+					throw convexError(ErrorCode.INVALID_PARAMETERS, error instanceof Error ? error.message : "Failed to fetch SAML metadata");
+				}
+				let parsed;
+				try {
+					parsed = parseSamlIdpMetadataChecked({
+						metadataXml,
+						config: connection.config
+					});
+				} catch (error) {
+					throw convexError(ErrorCode.INVALID_PARAMETERS, error instanceof Error ? `Failed to parse SAML metadata: ${error.message}` : "Failed to parse SAML metadata.");
+				}
+				const refreshIdpSigningCert = parsed.signingCert;
+				if (!(typeof refreshIdpSigningCert === "string" ? refreshIdpSigningCert.trim().length > 0 : Array.isArray(refreshIdpSigningCert) && refreshIdpSigningCert.some((cert) => typeof cert === "string" && cert.trim().length > 0))) throw convexError(ErrorCode.INVALID_PARAMETERS, "SAML IdP metadata has no usable signing certificate. A signing certificate is required to verify assertions.");
+				const nextConfig = upsertProtocolConfig(connection.config, "saml", {
+					enabled: true,
+					idp: {
+						metadataUrl,
+						metadataXml,
+						...parsed
+					},
+					serviceProvider: samlConfig.serviceProvider,
+					request: samlConfig.request,
+					profile: samlConfig.profile,
+					security: samlConfig.security
+				});
+				try {
+					await updateGroupConnection(ctx, config.component.connection, {
+						connectionId: connection._id,
+						patch: {
+							status: connection.status,
+							config: nextConfig
+						}
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to persist refreshed SAML metadata.");
+				}
+				try {
+					await emitGroupAuthEvent(ctx, {
+						connectionId: connection._id,
+						groupId: connection.groupId,
+						kind: "connection.saml.refreshed",
+						actor: { type: "system" },
+						subject: {
+							type: "connection",
+							id: connection._id
+						},
+						data: {
+							connectionId: connection._id,
+							metadataUrl
+						}
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to record SAML refresh audit event.");
+				}
+				return {
+					connectionId: connection._id,
+					groupId: connection.groupId
+				};
+			},
+			get: async (ctx, args) => {
+				const { connectionId } = args;
+				let connection;
+				try {
+					connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+				}
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				return getPublicSamlConfig(connection.config);
+			},
+			status: (ctx, args) => {
+				const { connectionId } = args;
+				return getGroupConnection(ctx, config.component.connection, connectionId).then((connection) => {
+					if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+					const currentConfig = getPublicSamlConfig(connection.config);
+					const configured = currentConfig.enabled === true;
+					return {
+						connectionId,
+						configured,
+						ready: configured && typeof currentConfig.idp?.entityId === "string",
+						config: currentConfig,
+						checks: [{
+							name: "saml_configured",
+							ok: configured,
+							message: configured ? void 0 : "SAML is not configured."
+						}]
+					};
+				});
+			},
+			metadata: async (ctx, opts) => {
+				const connection = await getGroupConnection(ctx, config.component.connection, opts.connectionId);
+				if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, "Connection not found.");
+				return createServiceProviderMetadata(getSamlServiceProviderOptions({
+					rootUrl: requireEnv("CONVEX_SITE_URL"),
+					source: {
+						kind: "connection",
+						id: connection._id
+					},
+					config: connection.config,
+					overrides: {
+						entityId: opts.entityId,
+						acsUrl: opts.acsUrl,
+						sloUrl: opts.sloUrl
+					}
+				}));
+			},
+			validate: async (ctx, args) => {
+				const { connectionId } = args;
+				const checks = [];
+				const connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				if (!connection) return {
+					ok: false,
+					connectionId,
+					checks: [{
+						name: "group_connection_exists",
+						ok: false,
+						message: "Connection not found."
+					}]
+				};
+				const samlConfig = connection.config?.protocols?.saml;
+				const samlConfigured = samlConfig?.enabled === true && typeof samlConfig?.idp?.metadataXml === "string";
+				checks.push({
+					name: "saml_configured",
+					ok: samlConfigured,
+					message: samlConfigured ? void 0 : "SAML is not configured."
+				});
+				const hasIdpMetadata = typeof samlConfig?.idp?.metadataXml === "string" && samlConfig.idp.metadataXml.length > 0;
+				checks.push({
+					name: "idp_metadata_present",
+					ok: hasIdpMetadata,
+					message: hasIdpMetadata ? void 0 : "IdP metadata XML is missing."
+				});
+				const reparsedIdp = hasIdpMetadata && typeof samlConfig?.idp?.metadataXml === "string" ? (() => {
+					try {
+						return parseSamlIdpMetadataChecked({
+							metadataXml: samlConfig.idp.metadataXml,
+							config: connection.config
+						});
+					} catch {
+						return null;
+					}
+				})() : null;
+				log("DEBUG", "[group-connection] saml:validate:idp", {
+					connectionId,
+					entityId: samlConfig?.idp?.entityId ?? null,
+					issuer: samlConfig?.idp?.issuer ?? null,
+					metadataUrl: samlConfig?.idp?.metadataUrl ?? null,
+					reparsedEntityId: reparsedIdp?.entityId ?? null,
+					reparsedIssuer: reparsedIdp?.issuer ?? null
+				});
+				const hasEntityId = typeof samlConfig?.idp?.entityId === "string" && samlConfig.idp.entityId.length > 0 || typeof samlConfig?.idp?.issuer === "string" && samlConfig.idp.issuer.length > 0 || typeof reparsedIdp?.entityId === "string" && reparsedIdp.entityId.length > 0 || typeof reparsedIdp?.issuer === "string" && reparsedIdp.issuer.length > 0;
+				checks.push({
+					name: "idp_entity_id",
+					ok: hasEntityId,
+					message: hasEntityId ? void 0 : "IdP entityId could not be parsed from metadata."
+				});
+				let spMetadataOk = false;
+				let spMetadataMessage;
+				if (samlConfigured) try {
+					createServiceProviderMetadata(getSamlServiceProviderOptions({
+						rootUrl: requireEnv("CONVEX_SITE_URL"),
+						source: {
+							kind: "connection",
+							id: connection._id
+						},
+						config: connection.config,
+						overrides: {}
+					}));
+					spMetadataOk = true;
+				} catch (e) {
+					spMetadataMessage = e instanceof Error ? e.message : "SP metadata generation failed.";
+				}
+				else spMetadataMessage = "Skipped — SAML not configured.";
+				checks.push({
+					name: "sp_metadata_generates",
+					ok: spMetadataOk,
+					message: spMetadataMessage
+				});
+				const requiresSignedAssertions = samlConfig?.security?.requireSignedAssertions === true;
+				const hasSigningCert = reparsedIdp?.signingCert !== null;
+				checks.push({
+					name: "signed_assertions_compatible",
+					ok: !requiresSignedAssertions || hasSigningCert,
+					message: !requiresSignedAssertions || hasSigningCert ? void 0 : "Signed assertions are required but the IdP metadata has no signing certificate."
+				});
+				const signAuthnRequests = samlConfig?.request?.signAuthnRequests === true;
+				const hasSpPrivateKey = typeof samlConfig?.serviceProvider?.privateKey === "string";
+				checks.push({
+					name: "authn_request_signing_compatible",
+					ok: !signAuthnRequests || hasSpPrivateKey,
+					message: !signAuthnRequests || hasSpPrivateKey ? void 0 : "signAuthnRequests is enabled but no SP privateKey is configured."
+				});
+				checks.push({
+					name: "timestamp_validation_configured",
+					ok: true,
+					message: samlConfig?.security?.requireTimestamps === true ? `Timestamp validation enabled with clock skew ${samlConfig.security.clockSkewSeconds ?? 300} seconds.` : "Timestamp validation uses compatibility defaults."
+				});
+				return {
+					ok: checks.every((c) => c.ok),
+					connectionId: connection._id,
+					checks
+				};
+			}
+		},
+		policy,
+		oidc: {
+			upsert: async (ctx, data) => {
+				if (data.discovery.issuer === void 0 && data.discovery.discoveryUrl === void 0) throw convexError(ErrorCode.INVALID_PARAMETERS, "OIDC registration requires issuer or discoveryUrl.");
+				let connection;
+				try {
+					connection = await getGroupConnection(ctx, config.component.connection, data.connectionId);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+				}
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				if (connection.protocol !== "oidc") throw convexError(ErrorCode.INVALID_PARAMETERS, "This connection is not an OIDC connection.");
+				const nextConfig = upsertProtocolConfig(connection.config, "oidc", {
+					enabled: true,
+					discovery: {
+						issuer: data.discovery.issuer,
+						discoveryUrl: data.discovery.discoveryUrl,
+						jwksUri: data.discovery.jwksUri,
+						audience: data.discovery.audience
+					},
+					client: {
+						id: data.client.id,
+						authMethod: data.client.authMethod
+					},
+					request: {
+						scopes: data.request?.scopes ?? [
+							"openid",
+							"profile",
+							"email"
+						],
+						loginHint: data.request?.loginHint,
+						authorizationParams: data.request?.authorizationParams
+					},
+					security: {
+						clockToleranceSeconds: data.security?.clockToleranceSeconds,
+						strictIssuer: data.security?.strictIssuer
+					},
+					profile: {
+						mapping: data.profile?.mapping,
+						extraFields: data.profile?.extraFields
+					}
+				});
+				try {
+					await updateGroupConnection(ctx, config.component.connection, {
+						connectionId: data.connectionId,
+						patch: { config: nextConfig }
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to persist OIDC registration.");
+				}
+				if (data.client.secret !== void 0) {
+					let ciphertext;
+					try {
+						ciphertext = await encryptSecret(data.client.secret);
+					} catch {
+						throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to encrypt OIDC client secret.");
+					}
+					try {
+						await upsertGroupConnectionSecret(ctx, config.component.connection, {
+							connectionId: data.connectionId,
+							groupId: connection.groupId,
+							kind: GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND,
+							ciphertext,
+							updatedAt: Date.now()
+						});
+					} catch {
+						throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to persist OIDC client secret.");
+					}
+				}
+				try {
+					await emitGroupAuthEvent(ctx, {
+						connectionId: data.connectionId,
+						groupId: connection.groupId,
+						kind: "connection.oidc.set",
+						actor: { type: "system" },
+						subject: {
+							type: "connection",
+							id: data.connectionId
+						},
+						data: {
+							connectionId: data.connectionId,
+							issuer: data.discovery.issuer,
+							discoveryUrl: data.discovery.discoveryUrl,
+							jwksUri: data.discovery.jwksUri,
+							audience: data.discovery.audience,
+							tokenEndpointAuthMethod: data.client.authMethod
+						}
+					});
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to record OIDC registration audit event.");
+				}
+				let secret;
+				try {
+					secret = await getGroupConnectionSecret(ctx, data.connectionId, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load OIDC secret metadata.");
+				}
+				return withOidcSecretState(getPublicOidcConfig(nextConfig), secret !== null);
+			},
+			get: async (ctx, args) => {
+				const { connectionId } = args;
+				let connection;
+				try {
+					connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+				}
+				if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				let secret;
+				try {
+					secret = await getGroupConnectionSecret(ctx, connection._id, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND);
+				} catch {
+					throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load OIDC secret metadata.");
+				}
+				return withOidcSecretState(getPublicOidcConfig(connection.config), secret !== null);
+			},
+			status: (ctx, args) => {
+				const { connectionId } = args;
+				return Promise.all([getGroupConnection(ctx, config.component.connection, connectionId), getGroupConnectionSecret(ctx, connectionId, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND)]).then(([connection, secret]) => {
+					if (!connection) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+					const currentConfig = getPublicOidcConfig(connection.config);
+					const oidcConfig = getOidcConfig(connection.config);
+					const configured = currentConfig.enabled === true && typeof oidcConfig.client?.id === "string" && (typeof oidcConfig.discovery?.issuer === "string" || typeof oidcConfig.discovery?.discoveryUrl === "string");
+					return {
+						connectionId,
+						configured,
+						ready: configured && secret !== null,
+						config: withOidcSecretState(currentConfig, secret !== null),
+						checks: [{
+							name: "oidc_configured",
+							ok: configured,
+							message: configured ? void 0 : "OIDC is not configured."
+						}, {
+							name: "client_secret_stored",
+							ok: secret !== null,
+							message: secret !== null ? void 0 : "OIDC client secret is missing."
+						}]
+					};
+				});
+			},
+			signIn: async (ctx, data) => {
+				log("DEBUG", "[group-connection] resolver:start", {
+					connectionId: data.connectionId,
+					email: data.email,
+					domain: data.domain,
+					redirectTo: data.redirectTo
+				});
+				let connection;
+				if (data.connectionId !== void 0) {
+					try {
+						connection = await getGroupConnection(ctx, config.component.connection, data.connectionId);
+					} catch {
+						throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to load connection.");
+					}
+					if (connection === null) throw convexError(ErrorCode.INVALID_PARAMETERS, connectionNotFoundError);
+				} else if (data.domain !== void 0 || data.email !== void 0) {
+					let result;
+					try {
+						result = await getGroupConnectionByDomain(ctx, config.component.connection, normalizeDomain(data.domain ?? String(data.email).split("@").pop() ?? ""));
+					} catch {
+						throw convexError(ErrorCode.INTERNAL_ERROR, "Failed to resolve connection by domain.");
+					}
+					log("DEBUG", "[group-connection] resolver:domainLookup", result);
+					if (result?.connection && result.domain?.verifiedAt !== void 0) connection = result.connection;
+					else throw convexError(ErrorCode.INVALID_PARAMETERS, "No group connection matched the provided input.");
+				} else throw convexError(ErrorCode.INVALID_PARAMETERS, "No group connection matched the provided input.");
+				if (connection.status !== "active") throw convexError(ErrorCode.INVALID_PARAMETERS, "Group connection is not active.");
+				const protocol = resolveGroupConnectionProtocol(connection);
+				log("DEBUG", "[group-connection] resolver:connection", {
+					connectionId: connection._id,
+					status: connection.status,
+					protocol
+				});
+				const { signInPath, callbackPath, providerId } = protocol === "oidc" ? (() => {
+					const urls = getGroupOidcUrls({
+						rootUrl: requireEnv("CONVEX_SITE_URL"),
+						connectionId: connection._id,
+						sharedRedirectURI: deps.sharedOidcRedirectURI
+					});
+					return {
+						signInPath: urls.signInUrl,
+						callbackPath: urls.callbackUrl,
+						providerId: groupOidcProviderId(connection._id)
+					};
+				})() : (() => {
+					const urls = getGroupSamlUrls({
+						rootUrl: requireEnv("CONVEX_SITE_URL"),
+						source: {
+							kind: "connection",
+							id: connection._id
+						}
+					});
+					return {
+						signInPath: `${requireEnv("CONVEX_SITE_URL")}/connections/${connection._id}/saml/signin`,
+						callbackPath: urls.acsUrl,
+						providerId: groupSamlProviderId(connection._id)
+					};
+				})();
+				log("DEBUG", "[group-connection] resolver:paths", {
+					connectionId: connection._id,
+					signInPath,
+					callbackPath
+				});
+				return {
+					connectionId: connection._id,
+					protocol,
+					providerId,
+					signInPath: protocol === "oidc" && typeof data.loginHint === "string" ? (() => {
+						const signInUrl = new URL(signInPath);
+						signInUrl.searchParams.set("loginHint", data.loginHint);
+						return signInUrl.toString();
+					})() : signInPath,
+					callbackPath,
+					redirectTo: data.redirectTo
+				};
+			},
+			validate: async (ctx, args) => {
+				const { connectionId } = args;
+				const checks = [];
+				const connection = await getGroupConnection(ctx, config.component.connection, connectionId);
+				if (!connection) return {
+					ok: false,
+					connectionId,
+					checks: [{
+						name: "group_connection_exists",
+						ok: false,
+						message: "Connection not found."
+					}]
+				};
+				const oidc = getOidcConfig(connection.config);
+				const secret = await getGroupConnectionSecret(ctx, connection._id, GROUP_CONNECTION_OIDC_CLIENT_SECRET_KIND);
+				const oidcConfigured = oidc.enabled === true && typeof oidc.client?.id === "string" && oidc.client.id.length > 0;
+				checks.push({
+					name: "oidc_configured",
+					ok: oidcConfigured,
+					message: oidcConfigured ? void 0 : "OIDC is not configured."
+				});
+				const hasClientId = typeof oidc.client?.id === "string" && oidc.client.id.length > 0;
+				checks.push({
+					name: "client_id_present",
+					ok: hasClientId,
+					message: hasClientId ? void 0 : "clientId is missing."
+				});
+				checks.push({
+					name: "client_secret_stored",
+					ok: secret !== null,
+					message: secret !== null ? void 0 : "OIDC client secret is missing."
+				});
+				const discoveryConfig = typeof oidc.discovery === "object" && oidc.discovery !== null ? oidc.discovery : {};
+				const clientConfig = typeof oidc.client === "object" && oidc.client !== null ? oidc.client : {};
+				const discoveryTarget = discoveryConfig.discoveryUrl ?? discoveryConfig.issuer;
+				const hasDiscovery = typeof discoveryTarget === "string" && discoveryTarget.length > 0;
+				checks.push({
+					name: "issuer_or_discovery_url_present",
+					ok: hasDiscovery,
+					message: hasDiscovery ? void 0 : "issuer or discoveryUrl is missing."
+				});
+				let discoveryOk = false;
+				let discoveryMessage;
+				if (hasDiscovery) {
+					const discoveryUrl = typeof discoveryConfig.discoveryUrl === "string" && discoveryConfig.discoveryUrl.length > 0 ? discoveryConfig.discoveryUrl : `${String(discoveryConfig.issuer)}/.well-known/openid-configuration`;
+					try {
+						assertSafeIdpFetchUrl(discoveryUrl);
+						const res = await fetch(discoveryUrl, {
+							headers: { Accept: "application/json" },
+							redirect: "manual",
+							signal: AbortSignal.timeout(8e3)
+						});
+						if (!res.ok) discoveryMessage = `Discovery endpoint returned ${res.status}.`;
+						else {
+							const json = await res.json();
+							if (typeof json.issuer !== "string") discoveryMessage = "Discovery document is missing issuer field.";
+							else if (typeof json.authorization_endpoint !== "string") discoveryMessage = "Discovery document is missing authorization_endpoint.";
+							else if (typeof json.token_endpoint !== "string") discoveryMessage = "Discovery document is missing token_endpoint.";
+							else if (discoveryConfig.jwksUri === void 0 && typeof json.jwks_uri !== "string") discoveryMessage = "Discovery document is missing jwks_uri and no jwksUri override is configured.";
+							else discoveryOk = true;
+						}
+					} catch (e) {
+						discoveryMessage = e instanceof Error ? `Discovery fetch failed: ${e.message}` : "Discovery fetch failed.";
+					}
+				} else discoveryMessage = "Skipped — issuer or discoveryUrl not set.";
+				checks.push({
+					name: "discovery_reachable",
+					ok: discoveryOk,
+					message: discoveryMessage
+				});
+				const hasValidTokenAuthMethod = clientConfig.authMethod === void 0 || clientConfig.authMethod === "client_secret_post" || clientConfig.authMethod === "client_secret_basic";
+				checks.push({
+					name: "token_endpoint_auth_method_supported",
+					ok: hasValidTokenAuthMethod,
+					message: hasValidTokenAuthMethod ? void 0 : "tokenEndpointAuthMethod must be client_secret_post or client_secret_basic."
+				});
+				const hasJwksUri = discoveryConfig.jwksUri === void 0 || typeof discoveryConfig.jwksUri === "string" && discoveryConfig.jwksUri.length > 0;
+				checks.push({
+					name: "jwks_uri_present",
+					ok: hasJwksUri,
+					message: hasJwksUri ? void 0 : "jwksUri is empty."
+				});
+				const hasAudience = discoveryConfig.audience === void 0 || typeof discoveryConfig.audience === "string" || Array.isArray(discoveryConfig.audience) && discoveryConfig.audience.every((value) => typeof value === "string");
+				checks.push({
+					name: "audience_valid",
+					ok: hasAudience,
+					message: hasAudience ? void 0 : "audience must be a string or string array."
+				});
+				return {
+					ok: checks.every((c) => c.ok),
+					connectionId: connection._id,
+					checks
+				};
+			}
+		},
+		scim,
+		audit: { list: async (ctx, data) => {
+			return await ctx.runQuery(config.component.connection.audit.list, data);
+		} },
+		webhook
+	};
+}
+
+//#endregion
+export { createGroupConnectionDomain };
+//# sourceMappingURL=domain.js.map