@estifanos-sh/convex-auth 0.0.1-preview.0

package/dist/server/connection/oidc.js

@@ -0,0 +1,366 @@
+import { retryWithBackoff } from "../../shared/retry.js";
+import { log } from "../log.js";
+import { withSpan } from "../utils/span.js";
+import { assertSafeIdpFetchUrl, assertSafeIdpHost } from "../../shared/fetch/guard.js";
+import { normalizeOAuthTokenResponse } from "../oauth/normalize.js";
+import { createCache } from "../utils/cache.js";
+import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
+import { getGroupOidcUrls, groupOidcProviderId } from "./shared.js";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeBase64, encodeBase64urlNoPadding } from "@oslojs/encoding";
+import { createRemoteJWKSet, customFetch, decodeProtectedHeader, jwtVerify } from "jose";
+
+//#region src/server/connection/oidc.ts
+const OIDC_JWKS_CACHE = createCache({
+	capacity: 128,
+	timeToLiveMs: 3600 * 1e3,
+	lookup: (cacheKey) => {
+		const key = JSON.parse(cacheKey);
+		const fetchImpl = key.runtimeOrigin !== void 0 || key.externalHost !== void 0 ? createGroupConnectionOidcFetchFromParts(key.runtimeOrigin, key.externalHost) : void 0;
+		return fetchImpl ? createRemoteJWKSet(new URL(key.url), { [customFetch]: fetchImpl }) : createRemoteJWKSet(new URL(key.url));
+	}
+});
+function validateOidcDiscovery(data) {
+	if (typeof data !== "object" || data === null) throw new Error("OIDC discovery response is not an object.");
+	const obj = data;
+	if (typeof obj.issuer !== "string") throw new Error("OIDC discovery is missing 'issuer'.");
+	if (typeof obj.authorization_endpoint !== "string") throw new Error("OIDC discovery is missing 'authorization_endpoint'.");
+	if (typeof obj.token_endpoint !== "string") throw new Error("OIDC discovery is missing 'token_endpoint'.");
+	if (typeof obj.jwks_uri !== "string") throw new Error("OIDC discovery is missing 'jwks_uri'.");
+	return {
+		issuer: obj.issuer,
+		authorization_endpoint: obj.authorization_endpoint,
+		token_endpoint: obj.token_endpoint,
+		jwks_uri: obj.jwks_uri,
+		userinfo_endpoint: typeof obj.userinfo_endpoint === "string" ? obj.userinfo_endpoint : void 0,
+		token_endpoint_auth_methods_supported: Array.isArray(obj.token_endpoint_auth_methods_supported) ? obj.token_endpoint_auth_methods_supported.filter((v) => typeof v === "string") : void 0,
+		id_token_signing_alg_values_supported: Array.isArray(obj.id_token_signing_alg_values_supported) ? obj.id_token_signing_alg_values_supported.filter((v) => typeof v === "string") : void 0
+	};
+}
+function validateOidcUserInfo(data) {
+	if (typeof data !== "object" || data === null) return {};
+	const obj = data;
+	return {
+		sub: typeof obj.sub === "string" ? obj.sub : void 0,
+		email: typeof obj.email === "string" ? obj.email : void 0,
+		email_verified: typeof obj.email_verified === "boolean" ? obj.email_verified : void 0,
+		name: typeof obj.name === "string" ? obj.name : void 0,
+		picture: typeof obj.picture === "string" ? obj.picture : void 0,
+		groups: obj.groups,
+		roles: obj.roles
+	};
+}
+const asError = (error) => error instanceof Error ? error : new Error(String(error));
+function resolveOidcAuthMethod(client, discoveredMethods) {
+	if (client.authMethod === "client_secret_basic" || client.authMethod === "client_secret_post") return client.authMethod;
+	return discoveredMethods.includes("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
+}
+function normalizeOidcIssuer(value) {
+	return typeof value === "string" ? value.replace(/\/$/, "") : "";
+}
+function getOidcSections(config) {
+	return {
+		discovery: typeof config.discovery === "object" && config.discovery !== null ? config.discovery : {},
+		client: typeof config.client === "object" && config.client !== null ? config.client : {},
+		request: typeof config.request === "object" && config.request !== null ? config.request : {},
+		security: typeof config.security === "object" && config.security !== null ? config.security : {},
+		profile: typeof config.profile === "object" && config.profile !== null ? config.profile : {}
+	};
+}
+async function discoverOidcConfiguration(ctx, componentConnection, config) {
+	const { discovery } = getOidcSections(config);
+	const discoveryUrl = typeof discovery.discoveryUrl === "string" ? discovery.discoveryUrl : typeof discovery.issuer === "string" ? `${discovery.issuer.replace(/\/$/, "")}/.well-known/openid-configuration` : null;
+	if (!discoveryUrl) throw new Error("Group connection OIDC requires an issuer or discoveryUrl.");
+	const runtimeOrigin = typeof discovery.discoveryUrl === "string" ? new URL(discovery.discoveryUrl).origin : void 0;
+	const externalHost = typeof discovery.issuer === "string" ? new URL(discovery.issuer).host : void 0;
+	assertSafeIdpFetchUrl(discoveryUrl);
+	return withSpan("convex-auth.connection.oidc.discovery", {}, async () => {
+		return retryWithBackoff(async () => {
+			return validateOidcDiscovery(await ctx.runAction(componentConnection.cache.oidcDiscovery, {
+				url: discoveryUrl,
+				runtimeOrigin,
+				externalHost
+			}));
+		}, {
+			maxRetries: 2,
+			baseMs: 200
+		});
+	});
+}
+function createGroupConnectionOidcFetch(config, discoveredIssuer) {
+	const { discovery } = getOidcSections(config);
+	return createGroupConnectionOidcFetchFromParts(typeof discovery.discoveryUrl === "string" ? new URL(discovery.discoveryUrl).origin : void 0, typeof discovery.issuer === "string" ? new URL(discovery.issuer).host : typeof discoveredIssuer === "string" ? new URL(discoveredIssuer).host : void 0);
+}
+function createGroupConnectionOidcFetchFromParts(runtimeOrigin, externalHost) {
+	return async (input, init) => {
+		const url = new URL(typeof input === "string" ? input : input.toString());
+		const rewrittenUrl = runtimeOrigin !== void 0 && url.origin !== runtimeOrigin ? new URL(`${runtimeOrigin}${url.pathname}${url.search}`) : url;
+		const headers = new Headers(init?.headers);
+		if (runtimeOrigin !== void 0 && externalHost !== void 0) {
+			assertSafeIdpHost(externalHost);
+			headers.set("host", externalHost);
+		}
+		assertSafeIdpFetchUrl(rewrittenUrl.toString());
+		return await fetch(rewrittenUrl, {
+			...init,
+			headers,
+			redirect: "manual"
+		});
+	};
+}
+function normalizeOidcProfile(claims, mapping) {
+	const getMapped = (key) => typeof key === "string" ? claims[key] : void 0;
+	return finalizeNormalizedProfile({
+		id: (typeof getMapped(mapping?.subject) === "string" ? getMapped(mapping?.subject) : void 0) ?? (typeof claims.sub === "string" ? claims.sub : crypto.randomUUID()),
+		email: (typeof getMapped(mapping?.email) === "string" ? getMapped(mapping?.email) : void 0) ?? (typeof claims.email === "string" ? claims.email : void 0),
+		emailVerified: (typeof getMapped(mapping?.emailVerified) === "boolean" ? getMapped(mapping?.emailVerified) : void 0) ?? (typeof claims.email_verified === "boolean" ? claims.email_verified : void 0),
+		name: (typeof getMapped(mapping?.name) === "string" ? getMapped(mapping?.name) : void 0) ?? (typeof claims.name === "string" ? claims.name : void 0),
+		image: (typeof getMapped(mapping?.image) === "string" ? getMapped(mapping?.image) : void 0) ?? (typeof claims.picture === "string" ? claims.picture : void 0),
+		groups: normalizeStringArray(getMapped(mapping?.groups)),
+		roles: normalizeStringArray(getMapped(mapping?.roles))
+	});
+}
+function getOidcJwks(url, runtimeOrigin, externalHost, fetchImpl) {
+	const cacheKey = JSON.stringify({
+		url,
+		runtimeOrigin: fetchImpl ? runtimeOrigin : void 0,
+		externalHost: fetchImpl ? externalHost : void 0
+	});
+	return OIDC_JWKS_CACHE.get(cacheKey);
+}
+async function userInfoProfile(opts) {
+	return withSpan("convex-auth.connection.oidc.userinfo", {}, async () => {
+		let userInfo;
+		try {
+			const response = await (opts.fetchImpl ?? fetch)(opts.endpoint, { headers: { Authorization: `Bearer ${opts.accessToken}` } });
+			if (!response.ok) throw new Error(`OIDC userinfo request failed: ${response.status}`);
+			userInfo = validateOidcUserInfo(await response.json());
+		} catch {
+			return null;
+		}
+		const userInfoSubject = typeof userInfo.sub === "string" ? userInfo.sub : void 0;
+		const tokenSubject = typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0;
+		if (userInfoSubject !== void 0 && tokenSubject !== void 0 && userInfoSubject !== tokenSubject) throw new Error("OIDC userinfo subject does not match ID token subject.");
+		return {
+			id: userInfoSubject ?? (typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0) ?? crypto.randomUUID(),
+			email: typeof userInfo.email === "string" ? userInfo.email : opts.verifiedProfile.email,
+			emailVerified: typeof userInfo.email_verified === "boolean" ? userInfo.email_verified : opts.verifiedProfile.emailVerified,
+			name: typeof userInfo.name === "string" ? userInfo.name : opts.verifiedProfile.name,
+			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image,
+			groups: normalizeStringArray(userInfo.groups) ?? opts.verifiedProfile.groups,
+			roles: normalizeStringArray(userInfo.roles) ?? opts.verifiedProfile.roles
+		};
+	});
+}
+/**
+* Build the OIDC authorization-code provider and oauth config for a group
+* connection from its discovery document and stored config.
+*
+* The authorization URL always uses PKCE with `S256` and a nonce, and rejects
+* attempts to override reserved OAuth parameters. Token validation requires the
+* nonce, verifies the ID token against the JWKS (or the client secret for
+* advertised HS* algorithms), and enforces the audience, the issuer (against
+* the configured/discovered issuer set; exact match when `strictIssuer`), the
+* nonce, and `azp` when present. UserInfo results are rejected if their subject
+* disagrees with the ID token's.
+*
+* @see https://openid.net/specs/openid-connect-core-1_0.html
+* @internal
+*/
+async function createGroupConnectionOidcProvider(ctx, componentConnection, config, redirectUri) {
+	const { discovery: discoveryConfig, client, request, security, profile } = getOidcSections(config);
+	const discovery = await discoverOidcConfiguration(ctx, componentConnection, config);
+	const discoveredIssuer = normalizeOidcIssuer(discovery.issuer);
+	const expectedIssuer = typeof discoveryConfig.issuer === "string" ? normalizeOidcIssuer(discoveryConfig.issuer) : discoveredIssuer;
+	const strictIssuer = security.strictIssuer === true;
+	if (typeof discoveryConfig.issuer === "string" && expectedIssuer !== discoveredIssuer) {
+		if (strictIssuer) throw new Error(`Configured OIDC issuer mismatch. configured=${expectedIssuer} discovery=${discoveredIssuer}`);
+		log("WARN", "Configured OIDC issuer differs from discovery issuer; accepting both for token verification.", {
+			configuredIssuer: expectedIssuer,
+			discoveryIssuer: discoveredIssuer
+		});
+	}
+	const authorizationEndpoint = discovery.authorization_endpoint;
+	const tokenEndpoint = discovery.token_endpoint;
+	const jwksUri = typeof discoveryConfig.jwksUri === "string" ? discoveryConfig.jwksUri : typeof discovery.jwks_uri === "string" ? discovery.jwks_uri : "";
+	const supportedIdTokenSigningAlgs = Array.isArray(discovery.id_token_signing_alg_values_supported) ? discovery.id_token_signing_alg_values_supported.filter((value) => typeof value === "string") : [];
+	const discoveredTokenEndpointAuthMethods = Array.isArray(discovery.token_endpoint_auth_methods_supported) ? discovery.token_endpoint_auth_methods_supported.filter((value) => typeof value === "string") : [];
+	const tokenEndpointAuthMethod = resolveOidcAuthMethod(client, discoveredTokenEndpointAuthMethods);
+	if (typeof client.authMethod === "string" && discoveredTokenEndpointAuthMethods.length > 0 && !discoveredTokenEndpointAuthMethods.includes(tokenEndpointAuthMethod)) throw new Error(`OIDC token endpoint auth method ${tokenEndpointAuthMethod} is not advertised by discovery.`);
+	const userinfoEndpoint = discovery.userinfo_endpoint ?? void 0;
+	const claimMapping = typeof profile.mapping === "object" && profile.mapping !== null ? profile.mapping : void 0;
+	const oidcFetch = createGroupConnectionOidcFetch(config, discovery.issuer);
+	const runtimeOrigin = typeof discoveryConfig.discoveryUrl === "string" ? new URL(discoveryConfig.discoveryUrl).origin : void 0;
+	const externalHost = typeof discoveryConfig.issuer === "string" ? new URL(discoveryConfig.issuer).host : typeof discovery.issuer === "string" ? new URL(discovery.issuer).host : void 0;
+	const scopes = Array.isArray(request.scopes) ? request.scopes.filter((value) => typeof value === "string") : [
+		"openid",
+		"profile",
+		"email"
+	];
+	const expectedAudience = Array.isArray(discoveryConfig.audience) ? discoveryConfig.audience.filter((value) => typeof value === "string") : typeof discoveryConfig.audience === "string" ? discoveryConfig.audience : String(client.id);
+	const clockToleranceSeconds = typeof security.clockToleranceSeconds === "number" ? security.clockToleranceSeconds : 10;
+	if (clockToleranceSeconds < 0 || clockToleranceSeconds > 300) throw new Error("OIDC clockToleranceSeconds must be between 0 and 300.");
+	const expectedIssuers = strictIssuer ? [expectedIssuer] : Array.from(new Set([expectedIssuer, discoveredIssuer]));
+	const jwks = getOidcJwks(jwksUri, runtimeOrigin, externalHost, oidcFetch);
+	let verifiedClaims = null;
+	let verifiedProfile = null;
+	const normalizeProfile = (claims) => normalizeOidcProfile(claims, claimMapping);
+	return {
+		provider: {
+			pkce: "required",
+			createAuthorizationURL({ state, codeVerifier, scopes: requestedScopes, nonce, loginHint }) {
+				if (!codeVerifier) throw new Error("OIDC PKCE requires a code verifier.");
+				const url = new URL(authorizationEndpoint);
+				url.searchParams.set("response_type", "code");
+				url.searchParams.set("client_id", String(client.id));
+				url.searchParams.set("redirect_uri", redirectUri);
+				url.searchParams.set("scope", (requestedScopes.length > 0 ? requestedScopes : scopes).join(" "));
+				url.searchParams.set("state", state);
+				url.searchParams.set("code_challenge_method", "S256");
+				url.searchParams.set("code_challenge", encodeBase64urlNoPadding(sha256(new TextEncoder().encode(codeVerifier))));
+				if (nonce !== void 0) url.searchParams.set("nonce", nonce);
+				if (typeof loginHint === "string") url.searchParams.set("login_hint", loginHint);
+				const authorizationParams = typeof request.authorizationParams === "object" && request.authorizationParams !== null ? request.authorizationParams : {};
+				const reservedAuthorizationParams = new Set([
+					"response_type",
+					"client_id",
+					"redirect_uri",
+					"scope",
+					"state",
+					"code_challenge",
+					"code_challenge_method",
+					"nonce",
+					"login_hint"
+				]);
+				for (const [key, value] of Object.entries(authorizationParams)) {
+					if (reservedAuthorizationParams.has(key)) throw new Error(`OIDC authorizationParams cannot override reserved parameter: ${key}`);
+					if (typeof value === "string") url.searchParams.set(key, value);
+				}
+				return url;
+			},
+			async validateAuthorizationCode({ code, codeVerifier }) {
+				const body = new URLSearchParams({
+					grant_type: "authorization_code",
+					code,
+					redirect_uri: redirectUri
+				});
+				const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+				if (typeof client.secret === "string" && tokenEndpointAuthMethod === "client_secret_basic") {
+					const encodeCredential = (value) => encodeURIComponent(value).replace(/%20/g, "+");
+					const credentials = `${encodeCredential(String(client.id))}:${encodeCredential(client.secret)}`;
+					const basicAuth = encodeBase64(new TextEncoder().encode(credentials));
+					headers.set("Authorization", `Basic ${basicAuth}`);
+				} else {
+					body.set("client_id", String(client.id));
+					if (typeof client.secret === "string") body.set("client_secret", client.secret);
+				}
+				if (codeVerifier) body.set("code_verifier", codeVerifier);
+				const response = await oidcFetch(tokenEndpoint, {
+					method: "POST",
+					headers,
+					body
+				});
+				if (!response.ok) {
+					const detail = await response.text();
+					throw new Error(`OIDC token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`);
+				}
+				return normalizeOAuthTokenResponse(await response.json());
+			}
+		},
+		oauthConfig: {
+			scopes,
+			nonce: true,
+			validateTokens: async (tokens, ctx$1) => {
+				if (ctx$1.nonce === void 0) throw new Error("OIDC nonce is required.");
+				const idToken = tokens.idToken;
+				if (idToken === void 0) throw new Error("OIDC response is missing id_token.");
+				const verifiedIdToken = idToken;
+				const tokenAlg = decodeProtectedHeader(verifiedIdToken).alg;
+				const useSymmetricValidation = typeof tokenAlg === "string" && (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512") && supportedIdTokenSigningAlgs.includes(tokenAlg);
+				const verificationOptions = {
+					audience: expectedAudience,
+					requiredClaims: [
+						"iss",
+						"sub",
+						"aud",
+						"exp",
+						"iat"
+					],
+					clockTolerance: clockToleranceSeconds
+				};
+				let verification;
+				try {
+					verification = await (useSymmetricValidation ? jwtVerify(verifiedIdToken, (() => {
+						if (typeof client.secret !== "string") throw new Error("OIDC provider uses symmetric ID token signatures but clientSecret is missing.");
+						return new TextEncoder().encode(client.secret);
+					})(), verificationOptions) : jwtVerify(verifiedIdToken, jwks, verificationOptions));
+				} catch (error) {
+					throw asError(error);
+				}
+				const payload = verification.payload;
+				const tokenIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
+				const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
+				if (!tokenIssuer || !expectedIssuers.includes(tokenIssuer)) throw new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`);
+				if (payload.nonce !== ctx$1.nonce) throw new Error("OIDC nonce mismatch.");
+				if (payload.azp !== void 0 && payload.azp !== String(client.id)) throw new Error("OIDC authorized party does not match client ID.");
+				verifiedClaims = payload;
+				verifiedProfile = normalizeProfile(payload);
+			},
+			accountLinking: config.accountLinking,
+			profile: async (tokens) => {
+				if (verifiedProfile === null || verifiedClaims === null) throw new Error("OIDC profile requested before the id_token was verified.");
+				if (userinfoEndpoint && typeof tokens.accessToken === "string") {
+					const resolvedProfile = await userInfoProfile({
+						endpoint: userinfoEndpoint,
+						accessToken: tokens.accessToken,
+						verifiedClaims,
+						verifiedProfile,
+						fetchImpl: oidcFetch
+					});
+					if (resolvedProfile !== null) return resolvedProfile;
+				}
+				return verifiedProfile;
+			}
+		}
+	};
+}
+/**
+* Build a minimal {@link OAuthMaterializedConfig} (no runtime provider) for a
+* group connection, used where only the provider id and account-linking mode
+* are needed.
+* @internal
+*/
+function createSyntheticOAuthMaterializedConfig(providerId, options) {
+	return {
+		id: providerId,
+		type: "oauth",
+		provider: null,
+		scopes: [],
+		accountLinking: options?.accountLinking ?? "sameConnection"
+	};
+}
+/**
+* Assemble the per-request OIDC runtime for a group connection: its provider
+* id, the configured provider and oauth config, and the group OIDC URLs.
+* @internal
+*/
+async function createGroupConnectionOidcRuntime(opts) {
+	const providerId = groupOidcProviderId(opts.connectionId);
+	const urls = getGroupOidcUrls({
+		rootUrl: opts.rootUrl,
+		connectionId: opts.connectionId,
+		sharedRedirectURI: opts.sharedRedirectURI
+	});
+	const { provider, oauthConfig } = await createGroupConnectionOidcProvider(opts.ctx, opts.componentConnection, opts.oidc, urls.callbackUrl);
+	return {
+		oidc: opts.oidc,
+		providerId,
+		provider,
+		oauthConfig,
+		...urls
+	};
+}
+
+//#endregion
+export { createGroupConnectionOidcRuntime, createSyntheticOAuthMaterializedConfig };
+//# sourceMappingURL=oidc.js.map

package/dist/server/connection/policy/domain.js

@@ -0,0 +1,59 @@
+import { ErrorCode } from "../../../shared/codes.js";
+import { convexError } from "../../errors.js";
+import { getGroup } from "../../contract.js";
+import { patchGroupConnectionPolicy } from "../policy.js";
+
+//#region src/server/connection/policy/domain.ts
+function createGroupPolicyDomain(deps) {
+	const { config, loadGroupPolicyOrThrow, validateGroupConnectionPolicy, emitGroupAuthEvent } = deps;
+	return {
+		get: async (ctx, args) => {
+			return await loadGroupPolicyOrThrow(ctx, args.groupId);
+		},
+		update: async (ctx, args) => {
+			const { groupId } = args;
+			const group = await getGroup(ctx, config.component.group, groupId);
+			if (!group) throw convexError(ErrorCode.INVALID_PARAMETERS, "Group not found.");
+			const policy = patchGroupConnectionPolicy(group.policy, args.patch);
+			await ctx.runMutation(config.component.group.update, {
+				id: groupId,
+				patch: { policy }
+			});
+			await emitGroupAuthEvent(ctx, {
+				groupId,
+				kind: "connection.policy.updated",
+				actor: { type: "system" },
+				subject: {
+					type: "group",
+					id: groupId
+				},
+				data: { version: policy.version }
+			});
+			return policy;
+		},
+		validate: async (ctx, args) => {
+			const { groupId } = args;
+			if (!await getGroup(ctx, config.component.group, groupId)) return {
+				ok: false,
+				groupId,
+				checks: [{
+					name: "group_exists",
+					ok: false,
+					message: "Group not found."
+				}]
+			};
+			const policy = await loadGroupPolicyOrThrow(ctx, groupId);
+			const checks = validateGroupConnectionPolicy(policy);
+			return {
+				ok: checks.every((check) => check.ok),
+				groupId,
+				policy,
+				checks
+			};
+		}
+	};
+}
+
+//#endregion
+export { createGroupPolicyDomain };
+//# sourceMappingURL=domain.js.map

package/dist/server/connection/policy.d.ts

@@ -0,0 +1 @@
+import "../types.js";

package/dist/server/connection/policy.js

@@ -0,0 +1,163 @@
+import { asRecord } from "./shared.js";
+
+//#region src/server/connection/policy.ts
+const DEFAULT_GROUP_CONNECTION_POLICY = {
+	version: 1,
+	identity: { accountLinking: {
+		oidc: "sameConnection",
+		saml: "sameConnection"
+	} },
+	provisioning: {
+		user: {
+			createOnSignIn: true,
+			updateProfileOnLogin: "missing",
+			updateProfileFromScim: "always",
+			authority: "app"
+		},
+		scimReuse: { user: "externalId" },
+		jit: {
+			mode: "createUserAndMembership",
+			defaultRoleIds: []
+		},
+		deprovision: { mode: "soft" },
+		groups: {
+			mode: "ignore",
+			source: "protocol"
+		},
+		roles: {
+			mode: "ignore",
+			source: "protocol"
+		}
+	}
+};
+/** Accept a value only if it's one of the allowed options, otherwise return the fallback. */
+function oneOf(value, allowed, fallback) {
+	return allowed.includes(value) ? value : fallback;
+}
+/** Parse an object whose values are string arrays (e.g. group→roleIds mapping). */
+function parseStringArrayMapping(raw) {
+	if (typeof raw !== "object" || raw === null) return void 0;
+	return Object.fromEntries(Object.entries(raw).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))]));
+}
+function normalizeGroupConnectionPolicy(policy) {
+	const d = DEFAULT_GROUP_CONNECTION_POLICY;
+	const input = asRecord(policy) ?? {};
+	const accountLinking = asRecord((asRecord(input.identity) ?? {}).accountLinking) ?? {};
+	const provisioning = asRecord(input.provisioning) ?? {};
+	const scimReuse = asRecord(provisioning.scimReuse) ?? {};
+	const user = asRecord(provisioning.user) ?? {};
+	const jit = asRecord(provisioning.jit) ?? {};
+	const deprovision = asRecord(provisioning.deprovision) ?? {};
+	const groups = asRecord(provisioning.groups) ?? {};
+	const roles = asRecord(provisioning.roles) ?? {};
+	const extend = asRecord(input.extend) ?? void 0;
+	const groupsMapping = parseStringArrayMapping(groups.mapping);
+	const rolesMapping = parseStringArrayMapping(roles.mapping);
+	return {
+		version: 1,
+		identity: { accountLinking: {
+			oidc: oneOf(accountLinking.oidc, [
+				"none",
+				"verifiedEmail",
+				"sameConnection"
+			], d.identity.accountLinking.oidc),
+			saml: oneOf(accountLinking.saml, [
+				"none",
+				"verifiedEmail",
+				"sameConnection"
+			], d.identity.accountLinking.saml)
+		} },
+		provisioning: {
+			user: {
+				createOnSignIn: typeof user.createOnSignIn === "boolean" ? user.createOnSignIn : d.provisioning.user.createOnSignIn,
+				updateProfileOnLogin: oneOf(user.updateProfileOnLogin, ["never", "always"], d.provisioning.user.updateProfileOnLogin),
+				updateProfileFromScim: oneOf(user.updateProfileFromScim, ["never", "missing"], d.provisioning.user.updateProfileFromScim),
+				authority: oneOf(user.authority, ["connection", "scim"], d.provisioning.user.authority)
+			},
+			scimReuse: { user: oneOf(scimReuse.user, ["none"], d.provisioning.scimReuse.user) },
+			jit: {
+				mode: oneOf(jit.mode, [
+					"off",
+					"createUser",
+					"createUserAndMembership"
+				], d.provisioning.jit.mode),
+				defaultRoleIds: Array.isArray(jit.defaultRoleIds) ? Array.from(new Set(jit.defaultRoleIds.filter((value) => typeof value === "string" && value.length > 0))) : typeof jit.defaultRole === "string" && jit.defaultRole.length > 0 ? [jit.defaultRole] : d.provisioning.jit.defaultRoleIds
+			},
+			deprovision: { mode: oneOf(deprovision.mode, ["hard"], d.provisioning.deprovision.mode) },
+			groups: {
+				mode: oneOf(groups.mode, ["sync"], d.provisioning.groups.mode),
+				source: "protocol",
+				...groupsMapping ? { mapping: groupsMapping } : {}
+			},
+			roles: {
+				mode: oneOf(roles.mode, ["map"], d.provisioning.roles.mode),
+				source: "protocol",
+				...rolesMapping ? { mapping: rolesMapping } : {}
+			}
+		},
+		...extend ? { extend } : {}
+	};
+}
+function patchGroupConnectionPolicy(current, patch) {
+	const base = normalizeGroupConnectionPolicy(current);
+	return normalizeGroupConnectionPolicy({
+		...base,
+		...patch,
+		identity: {
+			...base.identity,
+			...patch.identity,
+			accountLinking: {
+				...base.identity.accountLinking,
+				...patch.identity?.accountLinking
+			}
+		},
+		provisioning: {
+			...base.provisioning,
+			...patch.provisioning,
+			scimReuse: {
+				...base.provisioning.scimReuse,
+				...patch.provisioning?.scimReuse
+			},
+			user: {
+				...base.provisioning.user,
+				...patch.provisioning?.user
+			},
+			jit: {
+				...base.provisioning.jit,
+				...patch.provisioning?.jit
+			},
+			deprovision: {
+				...base.provisioning.deprovision,
+				...patch.provisioning?.deprovision
+			},
+			groups: {
+				...base.provisioning.groups,
+				...patch.provisioning?.groups
+			},
+			roles: {
+				...base.provisioning.roles,
+				...patch.provisioning?.roles
+			}
+		},
+		extend: patch.extend === void 0 ? base.extend : {
+			...base.extend,
+			...patch.extend
+		}
+	});
+}
+function resolveProvisionedRoleIds(opts) {
+	const roleIds = new Set(opts.policy.provisioning.jit.defaultRoleIds);
+	if (opts.policy.provisioning.groups.mode === "sync") {
+		const mapping = opts.policy.provisioning.groups.mapping ?? {};
+		for (const group of opts.groups ?? []) for (const roleId of mapping[group] ?? []) roleIds.add(roleId);
+	}
+	if (opts.policy.provisioning.roles.mode === "map") {
+		const mapping = opts.policy.provisioning.roles.mapping ?? {};
+		for (const role of opts.roles ?? []) for (const roleId of mapping[role] ?? []) roleIds.add(roleId);
+	}
+	return Array.from(roleIds);
+}
+
+//#endregion
+export { normalizeGroupConnectionPolicy, patchGroupConnectionPolicy, resolveProvisionedRoleIds };
+//# sourceMappingURL=policy.js.map

package/dist/server/connection/profile.js

@@ -0,0 +1,22 @@
+//#region src/server/connection/profile.ts
+/** @internal */
+function normalizeStringArray(value) {
+	if (Array.isArray(value)) {
+		const values = value.filter((item) => typeof item === "string" && item.length > 0);
+		return values.length > 0 ? values : void 0;
+	}
+	if (typeof value === "string" && value.length > 0) return [value];
+}
+/** @internal */
+function finalizeNormalizedProfile(input) {
+	return {
+		...input,
+		groups: normalizeStringArray(input.groups),
+		roles: normalizeStringArray(input.roles),
+		...input.extend && Object.keys(input.extend).length > 0 ? { extend: input.extend } : {}
+	};
+}
+
+//#endregion
+export { finalizeNormalizedProfile, normalizeStringArray };
+//# sourceMappingURL=profile.js.map