@hilbras/keystone 1.1.0

package/dist/routes/oidcEnterprise.js

@@ -0,0 +1,119 @@
+import crypto from "node:crypto";
+import { provisionEnterpriseUser, defaultRoleForOrg } from "../services/enterpriseSso.js";
+import { createTokenSet } from "../services/tokens.js";
+import { setSessionCookies, clearSessionCookies } from "../plugins/auth.js";
+import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
+import { toPublicUser } from "../types.js";
+import { buildOAuthErrorResponse } from "../lib/errors.js";
+const OIDC_STATE_COOKIE = "keystone_oidc_enterprise_state";
+function publicUrl() {
+    return process.env.AUTH_API_PUBLIC_URL || "http://localhost:4001";
+}
+function setStateCookie(reply, state) {
+    reply.setCookie(OIDC_STATE_COOKIE, state, {
+        path: "/",
+        httpOnly: true,
+        secure: process.env.COOKIE_SECURE === "true",
+        sameSite: "lax",
+        maxAge: 600,
+    });
+}
+function getStateCookie(request) {
+    return request.cookies[OIDC_STATE_COOKIE];
+}
+function clearStateCookie(reply) {
+    reply.clearCookie(OIDC_STATE_COOKIE, { path: "/" });
+}
+export default async function oidcEnterpriseRoutes(app) {
+    app.get("/sso/oidc/:connectionId", async (request, reply) => {
+        const { connectionId } = request.params;
+        const connection = await app.container.oidcConnectionRepository.findActiveById(connectionId);
+        if (!connection) {
+            return reply.status(404).send({ error: "OIDC connection not found" });
+        }
+        const state = crypto.randomBytes(24).toString("base64url");
+        setStateCookie(reply, `${state}:${connectionId}`);
+        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback`;
+        const url = new URL(connection.authorizationEndpoint);
+        url.searchParams.set("client_id", connection.clientId);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("scope", connection.scopes.join(" "));
+        url.searchParams.set("redirect_uri", redirectUri);
+        url.searchParams.set("state", state);
+        return reply.redirect(url.toString());
+    });
+    app.get("/sso/oidc/:connectionId/callback", async (request, reply) => {
+        const { connectionId } = request.params;
+        const query = request.query;
+        if (query.error) {
+            clearSessionCookies(reply);
+            const idpError = new Error(`Identity provider error: ${query.error}${query.error_description ? ` - ${query.error_description}` : ""}`);
+            const { statusCode, body } = buildOAuthErrorResponse(idpError);
+            return reply.status(statusCode).send(body);
+        }
+        const cookieState = getStateCookie(request);
+        clearStateCookie(reply);
+        if (!query.code || !query.state || !cookieState || !cookieState.startsWith(`${query.state}:`)) {
+            return reply.status(400).send({ error: "Invalid OIDC state" });
+        }
+        const connection = await app.container.oidcConnectionRepository.findActiveById(connectionId);
+        if (!connection) {
+            return reply.status(400).send({ error: "OIDC connection not found" });
+        }
+        const redirectUri = `${publicUrl()}/sso/oidc/${connectionId}/callback`;
+        try {
+            const tokenRes = await fetch(connection.tokenEndpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/x-www-form-urlencoded" },
+                body: new URLSearchParams({
+                    grant_type: "authorization_code",
+                    client_id: connection.clientId,
+                    client_secret: connection.clientSecret,
+                    code: query.code,
+                    redirect_uri: redirectUri,
+                }).toString(),
+            });
+            if (!tokenRes.ok) {
+                const text = await tokenRes.text();
+                throw new Error(`Token exchange failed: ${tokenRes.status} ${text}`);
+            }
+            const tokenData = (await tokenRes.json());
+            const userinfoRes = await fetch(connection.userinfoEndpoint ||
+                connection.scopes.includes("openid")
+                ? `${connection.issuer}/oauth/v2/userinfo`
+                : `${connection.issuer}/userinfo`, {
+                headers: { Authorization: `Bearer ${tokenData.access_token}` },
+            });
+            if (!userinfoRes.ok) {
+                throw new Error(`Userinfo request failed: ${userinfoRes.status}`);
+            }
+            const userinfo = (await userinfoRes.json());
+            if (!userinfo.email) {
+                throw new Error("OIDC provider did not return an email");
+            }
+            const org = await app.container.organizationRepository.findById(connection.orgId);
+            const user = await provisionEnterpriseUser(connection.orgId, {
+                email: userinfo.email,
+                name: userinfo.name,
+                username: userinfo.preferred_username,
+            }, org ? defaultRoleForOrg(org) : "member");
+            const fingerprint = fingerprintFromRequest(request);
+            await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], { orgId: connection.orgId }, fingerprint);
+            setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
+            await request.audit("oidc_enterprise_login", {
+                orgId: connection.orgId,
+                connectionId: connection.id,
+                userId: user.id,
+            });
+            return { user: toPublicUser(user) };
+        }
+        catch (err) {
+            request.log.error({ err }, "OIDC enterprise callback failed");
+            clearSessionCookies(reply);
+            const { statusCode, body } = buildOAuthErrorResponse(err);
+            return reply.status(statusCode).send(body);
+        }
+    });
+}
+//# sourceMappingURL=oidcEnterprise.js.map

package/dist/routes/oidcEnterprise.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcEnterprise.js","sourceRoot":"","sources":["../../src/routes/oidcEnterprise.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAE3D,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,uBAAuB,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,KAAmB,EAAE,KAAa;IACxD,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,KAAK,EAAE;QACxC,IAAI,EAAE,GAAG;QACT,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,MAAM;QAC5C,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,OAAuB;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAoB;IACrE,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACxF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,cAAc,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC;QAElD,MAAM,WAAW,GAAG,GAAG,SAAS,EAAE,aAAa,YAAY,WAAW,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAErC,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kCAAkC,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACjG,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAsF,CAAC;QAE7G,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,IAAI,KAAK,CACxB,4BAA4B,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3G,CAAC;YACF,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5C,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAExB,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC9F,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,GAAG,SAAS,EAAE,aAAa,YAAY,WAAW,CAAC;QAEvE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE;gBACrD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,oBAAoB;oBAChC,SAAS,EAAE,UAAU,CAAC,QAAQ;oBAC9B,aAAa,EAAE,UAAU,CAAC,YAAY;oBACtC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,YAAY,EAAE,WAAW;iBAC1B,CAAC,CAAC,QAAQ,EAAE;aACd,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;YAED,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgD,CAAC;YAEzF,MAAM,WAAW,GAAG,MAAM,KAAK,CAC7B,UAAU,CAAC,gBAAgB;gBACzB,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACpC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,oBAAoB;gBAC1C,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,WAAW,EACnC;gBACE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,CAAC,YAAY,EAAE,EAAE;aAC/D,CACF,CAAC;YAEF,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAIzC,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAElF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,UAAU,CAAC,KAAK,EAChB;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,kBAAkB;aACtC,EACD,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CACxC,CAAC;YAEF,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAC3B,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE;gBAC3C,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,iCAAiC,CAAC,CAAC;YAC9D,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/password.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function passwordRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=password.d.ts.map

package/dist/routes/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/routes/password.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAwB7D,wBAA8B,cAAc,CAAC,GAAG,EAAE,eAAe,iBAgEhE"}

package/dist/routes/password.js

@@ -0,0 +1,83 @@
+import { z } from "zod";
+import { getSdk } from "../sdk/index.js";
+import { isZitadelConfigured } from "../config.js";
+import { requestPasswordReset } from "../services/zitadel.js";
+import { findUserByEmail } from "../services/users.js";
+import { emailProvider } from "../services/email.js";
+import { sendResultError } from "./helpers.js";
+import { rateLimit } from "../plugins/rateLimit.js";
+const ForgotSchema = z.object({
+    email: z.string().email(),
+});
+const ResetSchema = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(8).max(128),
+});
+function resetUrl(token) {
+    const base = process.env.RESET_PASSWORD_URL || `${process.env.CLIENT_APP_URL || "http://localhost:5173"}/reset-password`;
+    const separator = base.includes("?") ? "&" : "?";
+    return `${base}${separator}token=${encodeURIComponent(token)}`;
+}
+export default async function passwordRoutes(app) {
+    const sdk = getSdk();
+    app.post("/forgot-password", {
+        preHandler: [
+            rateLimit({
+                keyPrefix: "forgot-password",
+                maxAttempts: 5,
+                windowSeconds: 900,
+            }),
+        ],
+    }, async (request, reply) => {
+        const body = ForgotSchema.parse(request.body);
+        const user = await findUserByEmail(body.email);
+        // Always return success to avoid email enumeration.
+        if (!user) {
+            await request.audit("password_reset_requested", { found: false });
+            return { success: true };
+        }
+        // If Zitadel is configured and the user has a Zitadel mirror, prefer Zitadel's flow.
+        if (isZitadelConfigured() && user.zitadelUserId) {
+            try {
+                const redirectUrl = process.env.RESET_PASSWORD_URL || `${process.env.CLIENT_APP_URL || "http://localhost:5173"}/reset-password`;
+                await requestPasswordReset(user.zitadelUserId, redirectUrl);
+                await request.audit("password_reset_requested", {
+                    found: true,
+                    userId: user.id,
+                    zitadelUserId: user.zitadelUserId,
+                });
+            }
+            catch (err) {
+                request.log.error({ err }, "Zitadel password reset request failed");
+            }
+            return { success: true };
+        }
+        // Local token-based reset flow.
+        const result = await sdk.authentication.createPasswordResetToken(body.email);
+        if (!result.success)
+            return sendResultError(reply, result);
+        if (result.data) {
+            try {
+                await emailProvider.send({
+                    to: user.email,
+                    subject: "Reset your Hilbras Keystone password",
+                    text: `Click the link to reset your password:\n\n${resetUrl(result.data.token)}\n\nThis link expires in 1 hour.`,
+                    html: `<p>Click <a href="${resetUrl(result.data.token)}">here</a> to reset your password.</p><p>This link expires in 1 hour.</p>`,
+                });
+            }
+            catch (err) {
+                request.log.error({ err }, "Failed to send password reset email");
+            }
+        }
+        return { success: true };
+    });
+    app.post("/reset-password", async (request, reply) => {
+        const body = ResetSchema.parse(request.body);
+        const result = await sdk.authentication.resetPasswordWithToken(body.token, body.newPassword);
+        if (!result.success)
+            return sendResultError(reply, result);
+        await request.audit("password_reset_completed", { userId: result.data.id });
+        return { success: true };
+    });
+}
+//# sourceMappingURL=password.js.map

package/dist/routes/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/routes/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAe,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,iBAAiB,CAAC;IACzH,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACjD,OAAO,GAAG,IAAI,GAAG,SAAS,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,cAAc,CAAC,GAAoB;IAC/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IAErB,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC3B,UAAU,EAAE;YACV,SAAS,CAAC;gBACR,SAAS,EAAE,iBAAiB;gBAC5B,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,GAAG;aACnB,CAAC;SACH;KACF,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE/C,oDAAoD;QACpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,qFAAqF;QACrF,IAAI,mBAAmB,EAAE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,uBAAuB,iBAAiB,CAAC;gBAChI,MAAM,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;gBAC5D,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE;oBAC9C,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,aAAa,EAAE,IAAI,CAAC,aAAa;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAE3D,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,IAAI,CAAC;oBACvB,EAAE,EAAE,IAAI,CAAC,KAAK;oBACd,OAAO,EAAE,sCAAsC;oBAC/C,IAAI,EAAE,6CAA6C,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kCAAkC;oBAChH,IAAI,EAAE,qBAAqB,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,2EAA2E;iBAClI,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;YACpE,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/profile.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function profileRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=profile.d.ts.map

package/dist/routes/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../src/routes/profile.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAU7E,wBAA8B,aAAa,CAAC,GAAG,EAAE,eAAe,iBAgC/D"}

package/dist/routes/profile.js

@@ -0,0 +1,43 @@
+import { z } from "zod";
+import { toPublicUser } from "../types.js";
+const UpdateProfileSchema = z.object({
+    name: z.string().max(255).optional(),
+    avatarUrl: z.string().url().max(2048).nullable().optional(),
+    phoneNumber: z.string().max(32).nullable().optional(),
+    metadata: z.record(z.unknown()).optional(),
+});
+export default async function profileRoutes(app) {
+    app.get("/profile", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const userId = request.user?.id;
+        if (!userId)
+            return reply.status(401).send({ error: "Unauthorized" });
+        const user = await app.container.userRepository.findById(userId);
+        if (!user)
+            return reply.status(404).send({ error: "User not found" });
+        return { user: toPublicUser(user) };
+    });
+    app.patch("/profile", { preHandler: [app.authenticate] }, async (request, reply) => {
+        const userId = request.user?.id;
+        if (!userId)
+            return reply.status(401).send({ error: "Unauthorized" });
+        const body = UpdateProfileSchema.parse(request.body);
+        const updates = {};
+        if (body.name !== undefined)
+            updates.name = body.name;
+        if (body.avatarUrl !== undefined)
+            updates.avatarUrl = body.avatarUrl;
+        if (body.metadata !== undefined)
+            updates.metadata = body.metadata;
+        // Changing the phone number resets its verification status.
+        if (body.phoneNumber !== undefined) {
+            updates.phoneNumber = body.phoneNumber;
+            updates.phoneVerified = false;
+        }
+        const updated = await app.container.userRepository.update(userId, updates);
+        if (!updated)
+            return reply.status(404).send({ error: "User not found" });
+        await request.audit("profile_updated", { userId });
+        return { user: toPublicUser(updated) };
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/routes/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/routes/profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,aAAa,CAAC,GAAoB;IAC9D,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEtE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC/G,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QAEtE,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,4DAA4D;QAC5D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;YACvC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC;QAChC,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEzE,MAAM,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/saml.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function samlRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=saml.d.ts.map

package/dist/routes/saml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.d.ts","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAiG7E,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBA8G5D"}

package/dist/routes/saml.js

@@ -0,0 +1,164 @@
+import { z } from "zod";
+import { ServiceProvider, IdentityProvider } from "samlify";
+import { provisionEnterpriseUser, defaultRoleForOrg } from "../services/enterpriseSso.js";
+import { createTokenSet } from "../services/tokens.js";
+import { setSessionCookies } from "../plugins/auth.js";
+import { fingerprintFromRequest, recordDevice } from "../services/devices.js";
+import { toPublicUser } from "../types.js";
+import { config } from "../config.js";
+import { escapeXml } from "./helpers.js";
+const RelayStateSchema = z.object({
+    connectionId: z.string(),
+});
+const DEFAULT_ATTRIBUTE_MAPPING = {
+    email: [
+        "email",
+        "mail",
+        "urn:oid:0.9.2342.19200300.100.1.3",
+        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress",
+        "http://schemas.microsoft.com/identity/claims/email",
+    ],
+    name: [
+        "name",
+        "displayName",
+        "cn",
+        "commonName",
+        "urn:oid:2.16.840.1.113730.3.1.241",
+        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",
+        "http://schemas.microsoft.com/identity/claims/displayname",
+    ],
+};
+function buildSamlEntities(connection) {
+    if (!connection.idpEntityId || !connection.idpSsoUrl || !connection.idpCertificate) {
+        throw new Error("SAML connection is missing IdP metadata");
+    }
+    const sp = ServiceProvider({
+        entityID: connection.spEntityId,
+        wantAssertionsSigned: true,
+        wantMessageSigned: true,
+        assertionConsumerService: [
+            {
+                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
+                Location: connection.spAcsUrl,
+            },
+        ],
+    });
+    const idp = IdentityProvider({
+        entityID: connection.idpEntityId,
+        signingCert: connection.idpCertificate,
+        singleSignOnService: [
+            {
+                Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
+                Location: connection.idpSsoUrl,
+            },
+        ],
+    });
+    return { sp, idp };
+}
+function getAttribute(attributes, key, mapping, fallbackMapping) {
+    const candidates = mapping[key] ?? fallbackMapping[key] ?? [key];
+    for (const candidate of candidates) {
+        const value = attributes?.[candidate];
+        if (value === undefined || value === null)
+            continue;
+        const normalized = Array.isArray(value) ? value[0] : value;
+        if (normalized)
+            return normalized;
+    }
+    return undefined;
+}
+function parseSamlAttributes(attributes, connection) {
+    const mapping = (connection.attributeMapping ?? {});
+    return {
+        email: getAttribute(attributes, "email", mapping, DEFAULT_ATTRIBUTE_MAPPING),
+        name: getAttribute(attributes, "name", mapping, DEFAULT_ATTRIBUTE_MAPPING),
+    };
+}
+function sanitizeSamlError(error) {
+    const message = config.NODE_ENV === "development" && error instanceof Error ? error.message : "SAML validation failed";
+    return { statusCode: 400, body: { error: message } };
+}
+export default async function samlRoutes(app) {
+    app.get("/saml/:connectionId", async (request, reply) => {
+        const { connectionId } = request.params;
+        const connection = await app.container.samlConnectionRepository.findActiveById(connectionId);
+        if (!connection) {
+            return reply.status(404).send({ error: "SAML connection not found" });
+        }
+        if (!connection.idpSsoUrl) {
+            return reply.status(400).send({ error: "SAML connection missing IdP SSO URL" });
+        }
+        try {
+            const { sp, idp } = buildSamlEntities(connection);
+            const relayState = Buffer.from(JSON.stringify({ connectionId })).toString("base64url");
+            const loginRequest = sp.createLoginRequest(idp, "redirect", { relayState });
+            const url = new URL(connection.idpSsoUrl);
+            url.searchParams.set("SAMLRequest", loginRequest.context);
+            if (relayState)
+                url.searchParams.set("RelayState", relayState);
+            return reply.redirect(url.toString());
+        }
+        catch (err) {
+            request.log.error({ err }, "Failed to build SAML login request");
+            const { statusCode, body } = sanitizeSamlError(err);
+            return reply.status(statusCode).send(body);
+        }
+    });
+    app.post("/saml/acs", async (request, reply) => {
+        const body = request.body;
+        if (!body.SAMLResponse) {
+            return reply.status(400).send({ error: "Missing SAMLResponse" });
+        }
+        let relayState;
+        try {
+            relayState = RelayStateSchema.parse(JSON.parse(Buffer.from(body.RelayState || "", "base64url").toString("utf8")));
+        }
+        catch {
+            return reply.status(400).send({ error: "Invalid RelayState" });
+        }
+        const connection = await app.container.samlConnectionRepository.findActiveById(relayState.connectionId);
+        if (!connection) {
+            return reply.status(400).send({ error: "SAML connection not found" });
+        }
+        try {
+            const { sp, idp } = buildSamlEntities(connection);
+            const result = await sp.parseLoginResponse(idp, "post", { body });
+            const claims = parseSamlAttributes(result.extract.attributes, connection);
+            if (!claims.email) {
+                return reply.status(400).send({ error: "SAML response did not contain an email" });
+            }
+            const org = await app.container.organizationRepository.findById(connection.orgId);
+            const user = await provisionEnterpriseUser(connection.orgId, { email: claims.email, name: claims.name }, org ? defaultRoleForOrg(org) : "member");
+            const fingerprint = fingerprintFromRequest(request);
+            await recordDevice(user.id, fingerprint, request.ip, request.headers["user-agent"]);
+            const tokens = await createTokenSet(user, request.ip, request.headers["user-agent"], { orgId: connection.orgId }, fingerprint);
+            setSessionCookies(reply, tokens.accessToken, tokens.refreshToken);
+            await request.audit("saml_sso_login", {
+                orgId: connection.orgId,
+                connectionId: connection.id,
+                userId: user.id,
+            });
+            return { user: toPublicUser(user) };
+        }
+        catch (err) {
+            request.log.error({ err }, "SAML ACS validation failed");
+            const { statusCode, body } = sanitizeSamlError(err);
+            return reply.status(statusCode).send(body);
+        }
+    });
+    app.get("/saml/:connectionId/metadata", async (request, reply) => {
+        const { connectionId } = request.params;
+        const connection = await app.container.samlConnectionRepository.findActiveById(connectionId);
+        if (!connection) {
+            return reply.status(404).send({ error: "SAML connection not found" });
+        }
+        const metadata = `
+<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="${escapeXml(connection.spEntityId)}">
+  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="${escapeXml(connection.spAcsUrl)}" index="0"/>
+  </md:SPSSODescriptor>
+</md:EntityDescriptor>`.trim();
+        return reply.header("Content-Type", "application/xml").send(metadata);
+    });
+}
+//# sourceMappingURL=saml.js.map

package/dist/routes/saml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml.js","sourceRoot":"","sources":["../../src/routes/saml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE5D,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,yBAAyB,GAA6B;IAC1D,KAAK,EAAE;QACL,OAAO;QACP,MAAM;QACN,mCAAmC;QACnC,oEAAoE;QACpE,oDAAoD;KACrD;IACD,IAAI,EAAE;QACJ,MAAM;QACN,aAAa;QACb,IAAI;QACJ,YAAY;QACZ,mCAAmC;QACnC,4DAA4D;QAC5D,0DAA0D;KAC3D;CACF,CAAC;AAEF,SAAS,iBAAiB,CAAC,UAA0B;IACnD,IAAI,CAAC,UAAU,CAAC,WAAW,IAAI,CAAC,UAAU,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,EAAE,GAAG,eAAe,CAAC;QACzB,QAAQ,EAAE,UAAU,CAAC,UAAU;QAC/B,oBAAoB,EAAE,IAAI;QAC1B,iBAAiB,EAAE,IAAI;QACvB,wBAAwB,EAAE;YACxB;gBACE,OAAO,EAAE,gDAAgD;gBACzD,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B;SACF;KACF,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,UAAU,CAAC,WAAW;QAChC,WAAW,EAAE,UAAU,CAAC,cAAc;QACtC,mBAAmB,EAAE;YACnB;gBACE,OAAO,EAAE,oDAAoD;gBAC7D,QAAQ,EAAE,UAAU,CAAC,SAAS;aAC/B;SACF;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,YAAY,CACnB,UAAyD,EACzD,GAAW,EACX,OAAiC,EACjC,eAAyC;IAEzC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACpC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,UAAyD,EACzD,UAA0B;IAE1B,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,gBAAgB,IAAI,EAAE,CAA6B,CAAC;IAChF,OAAO;QACL,KAAK,EAAE,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,CAAC;QAC5E,IAAI,EAAE,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,aAAa,IAAI,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;IACvH,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,UAAU,CAAC,GAAoB;IAC3D,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QACpF,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACvF,MAAM,YAAY,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAE5E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,UAAU;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAE/D,OAAO,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,oCAAoC,CAAC,CAAC;YACjE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAsD,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,UAAgD,CAAC;QACrD,IAAI,CAAC;YACH,UAAU,GAAG,gBAAgB,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,cAAc,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAExG,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YAE1E,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAElF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CACxC,UAAU,CAAC,KAAK,EAChB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAC1C,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CACxC,CAAC;YAEF,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,IAAI,EACJ,OAAO,CAAC,EAAE,EACV,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAC7B,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAC3B,WAAW,CACZ,CAAC;YACF,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;YAElE,MAAM,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE;gBACpC,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,MAAM,EAAE,IAAI,CAAC,EAAE;aAChB,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,4BAA4B,CAAC,CAAC;YACzD,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,8BAA8B,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC7F,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,MAAkC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAE7F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG;iFAC4D,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC;;sGAEX,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;;uBAE7G,CAAC,IAAI,EAAE,CAAC;QAE3B,OAAO,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/scim.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function scimRoutes(app: FastifyInstance): Promise<void>;
+//# sourceMappingURL=scim.d.ts.map

package/dist/routes/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","sourceRoot":"","sources":["../../src/routes/scim.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAqD7E,wBAA8B,UAAU,CAAC,GAAG,EAAE,eAAe,iBAgJ5D"}