@hilbras/keystone 1.5.0 → 1.9.0

package/CHANGELOG.md

@@ -5,6 +5,244 @@ All notable changes to Hilbras Keystone are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.9.0] - 2026-09-25
+
+### Security
+
+SCIM was a single global credential. In 1.8.x a deployment could provision
+exactly one organization, the bearer token was stored and compared in plaintext,
+and mutations reached global user records.
+
+- SCIM credentials are per-organization. Every connection belongs to exactly one
+  organization, at most one is live per organization, and every user and group
+  read and write is filtered by it. A cross-tenant target returns `404`, so the
+  endpoint is not a tenant oracle.
+- Bearer tokens are stored only as a SHA-256 digest and resolved by that digest,
+  so a database dump yields no usable token and the comparison carries no timing
+  signal. Connections can expire, be rotated, and be revoked.
+- Issuing, rotating, and revoking a SCIM credential is owner-only. A SCIM token
+  provisions and deactivates tenant users, so a mere admin or member cannot mint
+  one.
+- Deprovisioning removes the organization's membership and deactivates the
+  account only when no membership remains. Previously it deactivated a shared
+  account in every organization that user belonged to, without those
+  organizations' authorization.
+- SCIM refuses to change the global attributes of a shared user, to reactivate a
+  shared account, and to remove the last owner of an organization.
+- SCIM can no longer attach a user who already belongs to another organization,
+  and the conflict message no longer names the organization that holds them.
+- Unauthenticated SCIM traffic is budgeted before the authentication hook emits
+  audit and webhook events, closing an unauthenticated write-amplification path.
+- SCIM request budgets are keyed per credential, so one noisy identity provider
+  cannot exhaust every other tenant's allowance.
+
+### Changed
+
+- `SCIM_BEARER_TOKEN` and `SCIM_ORG_ID` are deprecated. They are adopted once
+  into a connection at startup and then ignored, so an upgrade does not break an
+  existing identity provider. Adoption is one-time in any state, so a restart
+  cannot resurrect a revoked credential.
+- Deprovisioning a single-tenant user now removes the membership as well as
+  deactivating the account. Deprovisioning a shared user removes only the
+  membership, and a follow-up `DELETE` returns `404`.
+- `POST /scim/v2/Users` is create-or-update; profile fields for an existing
+  member are applied rather than dropped.
+- A user removed from an organization can be re-provisioned. Previously the
+  global email lookup found the inactive row and returned `409` forever.
+- Rotating a credential revokes the previous token immediately
+  (`SCIM_ROTATION_GRACE_SECONDS` defaults to `0`). A grace window is now an
+  explicit opt-in and is not a revocation mechanism.
+- Groups are real organization-scoped records. The synthetic role-bucket
+  projection (`<orgId>:<role>` ids) is removed.
+- Malformed path ids return a SCIM `404` instead of surfacing a driver error, and
+  validation and internal failures return SCIM `Error` objects.
+
+### Added
+
+- `scim_connections` with rotation, revocation, expiry, and a token hint.
+- `scim_groups` and `scim_group_members`, organization-scoped throughout.
+- `PATCH /scim/v2/Users/:userId` and `POST /scim/v2/Users/.search`.
+- Group create, replace, patch, delete, and member management endpoints.
+- `filter`, `startIndex`, and `count` on list endpoints; unsupported filters are
+  rejected rather than silently ignored.
+- `GET /scim/v2/ServiceProviderConfig` and `GET /scim/v2/ResourceTypes`.
+- Owner-only admin API for creating, listing, rotating, and revoking SCIM
+  connections, with a dashboard UI for the same.
+- `findByIdInOrg`, `updateInOrg`, `listOrgIdsForUser`, and `removeFromOrg`
+  repository methods for organization-scoped user access.
+- Audit events `scim_connection_created`, `scim_connection_rotated`,
+  `scim_connection_revoked`, `scim_access_denied`, `scim_authentication_failed`,
+  and the `scim_group_*` group events.
+- `docs/MIGRATION-1.9.md`.
+
+## [1.8.0] - 2026-09-25
+
+### Security
+
+MFA was advisory in 1.7.x. A user with TOTP enabled could sign in with only a
+password, and when a code was supplied it was verified *after* the access token,
+refresh token, and session had already been created. 1.8.0 makes the second
+factor mandatory.
+
+- Password authentication now stops at `requires_mfa` for MFA-enabled accounts.
+  No access token, refresh token, or session row is created at that stage.
+- New `POST /auth/mfa/verify` completes the transition. The challenge is opaque,
+  stored only as a hash, short-lived, single-use, and bounded by an attempt
+  budget enforced in the database.
+- Token issuance is guarded at a single chokepoint. A token cannot be minted for
+  an MFA-enabled user without a recorded factor, so no login path bypasses MFA by
+  omission.
+- TOTP verification uses the user's own decrypted secret. Each time-step is
+  accepted exactly once, so a captured code is rejected even against a freshly
+  issued challenge.
+- Enabling MFA revokes every existing refresh token and session for the account.
+  Sessions record how MFA was satisfied, and refresh rotation refuses sessions
+  with no recorded factor.
+- Backup codes carry 80 bits of entropy, are stored as a keyed (peppered) hash,
+  expire after 90 days, and are consumed by a conditional update so concurrent
+  use has exactly one winner.
+- TOTP secrets are written with AES-256-GCM. Values written by earlier versions
+  used AES-256-CBC and remain readable.
+
+### Changed
+
+- `POST /auth/login` and `POST /auth/token-login` return `401` with
+  `code: "MFA_REQUIRED"` and a challenge when MFA is required. See
+  [MIGRATION-1.8.md](docs/MIGRATION-1.8.md).
+- The undocumented `totp_code` field on the login endpoints is removed and
+  ignored.
+- `POST /auth/totp/backup` now regenerates backup codes and requires a current
+  TOTP code. `POST /auth/totp/backup/verify` consumes a backup code.
+- `POST /auth/totp/verify` additionally reports `sessionsRevoked`.
+- WebAuthn assertions satisfy MFA on their own. Magic links refuse to downgrade a
+  TOTP-protected account, and SAML, enterprise OIDC, federation, and OAuth2
+  report a typed `mfa_required` error.
+- OAuth2 authorization codes carry the MFA factor of the session that approved
+  them, so the token exchange cannot launder an unverified login.
+- Access tokens for MFA sessions carry `mfa_verified`, `mfa_factor`, and `amr`.
+- Factor management requires step-up: `/auth/totp/enroll`, `/auth/totp/verify`,
+  `/auth/totp/backup`, `/auth/totp/disable`, and passkey registration for a
+  TOTP-protected account all require the account password in addition to the
+  session.
+- A passkey registered after TOTP was enabled is treated as a single factor and
+  cannot be used to sign in on its own.
+- Disabling TOTP deletes its backup codes.
+- Failed MFA factor attempts count toward the account lockout.
+- `SDK.authentication.login()` returns a discriminated union; `completeMfa()` is
+  new.
+
+### Fixed
+
+- `/auth/mfa/verify` wrote session cookies under a name derived from the login
+  flow instead of the client id, so MFA-completed sessions were not readable by
+  the auth plugin and every application on the cookie domain shared one name.
+- The MFA step no longer accepted accounts that are deactivated, under review,
+  or locked out, which the password step already refused.
+- Repeated password steps no longer cancel an MFA challenge created moments
+  earlier.
+- `MFA_CHALLENGE_TTL_SECONDS`, `MFA_MAX_ATTEMPTS`, and
+  `TOTP_BACKUP_CODE_TTL_SECONDS` are validated at startup and fall back to their
+  defaults instead of silently breaking every login.
+- The MFA factor copied out of a verified token into the authorization-code
+  table is validated against the column's check constraint.
+- SAML now reports `mfa_required` for MFA-protected accounts instead of
+  collapsing the failure into a generic validation error.
+
+### Added
+
+- `mfa_challenges` table, `MfaChallengeRepository`, and `MfaService`.
+- `MFA_CHALLENGE_TTL_SECONDS`, `MFA_MAX_ATTEMPTS`, and
+  `TOTP_BACKUP_CODE_TTL_SECONDS` configuration.
+- Audit events `mfa_challenge_created`, `mfa_challenge_failed`,
+  `mfa_challenge_expired`, `mfa_challenge_rejected`, `mfa_verified`,
+  `mfa_bypass_blocked`, and `mfa_backup_code_regenerated`.
+- Dedicated rate limits for MFA verification and every TOTP management endpoint.
+- MFA challenge step in the admin dashboard login form.
+- `docs/MIGRATION-1.8.md`.
+- MFA security regression suite (`src/tests/security/mfa.test.ts`).
+
+## [1.7.0] - 2026-09-24
+
+### Added
+
+- Dedicated owner-only platform-role endpoint at `PATCH /v1/admin/platform/users/:userId/role`.
+- Centralized platform and organization authorization guards with explicit organization context.
+- Versioned audit events for platform-role, membership, permission, and denied-authorization transitions.
+- Dedicated authorization regression suite covering privilege escalation, tenant isolation, workflow safety, secret disclosure, and audit metadata.
+- RBAC and authorization-boundary documentation.
+
+### Changed
+
+- Platform roles are explicitly limited to `owner` and `user`.
+- Organization roles are explicitly limited to `owner`, `admin`, and `member`.
+- Authorization checks now require an explicit `organizationId`.
+- Frontend administration clients use the dedicated platform-role endpoint and safe workflow definitions.
+- SAML metadata lookups require both connection and organization identifiers.
+
+### Fixed
+
+- Organization user routes can no longer mutate global users or deactivate shared accounts.
+- Generic profile and in-process identity contracts can no longer carry a platform role.
+- Organization admins cannot promote themselves or other members to organization owner.
+- The sole organization owner cannot be demoted or removed.
+- Tenant workflows now use a closed safe-step allowlist; plugin aliases, arbitrary webhooks, organization creation, and authorization-mutating steps fail closed.
+- Global workflows require platform-owner access, and workflow execution rechecks organization membership.
+- Organization creation always assigns an owner; actorless global deactivation APIs were removed from the organization domain.
+- Last-owner transitions use database row locks to prevent concurrent demotion/removal.
+- Platform-user deactivation now disables login, invalidates existing sessions, revokes refresh tokens and user API keys, and preserves the last active owner invariant.
+- User-management responses redact application secret hashes, OIDC/API-key credentials, configuration values, password hashes, TOTP secrets, and metadata.
+- SAML/OIDC public lookups require an organization context; new OIDC client secrets are encrypted at rest, and legacy plaintext values are re-encrypted on first callback use.
+- OAuth/OIDC client context no longer places an organization claim in a user token unless the user is a member of that application's organization.
+- Failed authorization attempts and role transitions now produce structured audit evidence.
+- SAML schema validation now has a signed-response regression test and audience/destination/recipient checks, alongside one-time transaction claiming and OIDC ID-token/JWKS verification.
+- Enterprise SSO requires an explicit connection/subject identity link and rejects platform-owner tenant login; generic OAuth no longer auto-links by email.
+- SCIM is scoped to `SCIM_ORG_ID`, cannot re-enable quarantined or platform-owner accounts, attributes audits to the SCIM credential, and deactivates rather than deleting users.
+- OIDC endpoint checks cover private, carrier-grade, benchmarking, dotted/hex IPv4-mapped, DNS-pinned, and redirecting targets.
+- Legacy account migration quarantines ambiguous unverified rows instead of activating them.
+- SAML semantic validation and OIDC/JWKS checks are covered by signed-response tests; OAuth2 refresh success and failure emit audit events.
+- Refresh-token rotation and OAuth authorization-code consumption are atomic and client-bound.
+- Legacy unverified accounts are quarantined for explicit review during the deactivation migration.
+- OIDC endpoint configuration blocks private/redirected targets by default; SCIM reflects account deactivation.
+- Added a blocking `oxlint` gate with warnings denied; CI now runs lint separately from typecheck.
+- Pinned safe transitive versions for `@xmldom/xmldom`, `fast-uri`, and `find-my-way`; the High-severity production audit gate now passes.
+- API-key validation uses public user projections and emits `api_key_used` audit events; the compiled OIDC re-encryption helper closes its database pool before exit.
+
+### Security
+
+- Critical organization-admin-to-platform-owner escalation paths are closed at HTTP, application, domain, SDK, and repository boundaries.
+- Cross-tenant authorization context is resolved from authenticated database membership rather than client-controlled application context.
+- Workflow definitions that are malformed or contain blocked authorization steps fail closed.
+
+### Breaking Changes
+
+- Organization user PATCH/DELETE endpoints no longer mutate global accounts; they return a migration response. Use platform user administration or organization member endpoints.
+- `/v1/authz/check` requests must include `organizationId`.
+- Custom organization role names are no longer accepted; only `owner`, `admin`, and `member` are supported.
+- Public SAML/OIDC initiation and metadata URLs require `organizationId`.
+- Direct authorization SDK calls now require both actor and organization IDs.
+- OIDC connections require a JWKS URI; OAuth2 application-bound refresh requests must provide the bound `client_id` and `client_secret`.
+- SCIM requires both `SCIM_BEARER_TOKEN` and `SCIM_ORG_ID`, and operates only within that organization.
+- Legacy unverified accounts may be marked `account_review_required` and require explicit review.
+- Tenant workflow definitions containing authorization-mutating, plugin, organization-creation, or arbitrary webhook steps are rejected or blocked.
+
+### Migration
+
+- Move platform role changes to `PATCH /v1/admin/platform/users/:userId/role`.
+- Use `/v1/admin/organizations/:id/members/:userId` for organization role changes.
+- Remove unsafe workflow steps before deployment.
+- Update SAML/OIDC URLs to include the organization ID.
+- Update authorization-check clients to send the organization ID explicitly.
+
+### Dependencies
+
+- No dependency changes in this release. Existing dependency audit findings remain tracked for the planned supply-chain phase.
+
+### Testing
+
+- Backend typecheck and build pass.
+- Backend test suite passes with the security regression suite enabled.
+- Frontend production build passes.
+
 ## [1.1.0] - 2026-09-19
 
 Security hardening, architecture improvements, and enterprise SSO enhancements.
@@ -112,6 +350,40 @@ Auth & infrastructure upgrades — jose 6, ioredis 6, bullmq 6, simplewebauthn 1
 - **jose 6 migration** — Replaced `KeyLike` with `CryptoKey` in secrets provider, tokens service, and database/environment secrets providers.
 - **simplewebauthn 14 migration** — Renamed `AuthenticatorTransportFuture` to `AuthenticatorTransport` in webauthn service.
 
+## [1.6.0] - 2026-09-20
+
+Frontend upgrades — React 19, Vite 8, Tailwind 4, TypeScript 7.
+
+### Changed
+
+- **React** 18.3.1 → 19.3.0
+- **React DOM** 18.3.1 → 19.3.0
+- **Vite** 5.4.21 → 8.3.0
+- **@vitejs/plugin-react** 4.7.0 → 6.1.1
+- **Tailwind CSS** 3.4.19 → 4.3.3 — complete rewrite: config moved from JS to CSS `@theme` directive, PostCSS plugin replaced with `@tailwindcss/vite`.
+- **@simplewebauthn/browser** 13.3.0 → 14.0.0
+- **TypeScript** 5.9.3 → 7.0.2 (frontend)
+- **@types/react** 18.3.31 → 19.0.0
+- **@types/react-dom** 18.3.7 → 19.0.0
+
+### Removed
+
+- **autoprefixer** — not needed with Tailwind 4.
+- **postcss** — not needed with Tailwind 4.
+- **tailwindcss-animate** — animations built into Tailwind 4.
+
+### Added
+
+- **@tailwindcss/vite** — replaces PostCSS plugin approach.
+
+### Migration notes
+
+- `tailwind.config.js` deleted — config now lives in `src/tailwind.css` using `@theme` directive.
+- `postcss.config.js` deleted — Tailwind 4 uses Vite plugin directly.
+- `src/index.css` updated to use `@import "./tailwind.css"` instead of `@tailwind base/components/utilities`.
+
+[1.7.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.7.0
+[1.6.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.6.0
 [1.5.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.5.0
 [1.4.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.4.0
 [1.3.0]: https://github.com/Hilbras/Keystone/releases/tag/v1.3.0

package/README.md

@@ -1,5 +1,7 @@
 # Hilbras Keystone
 
+**Current version: `1.7.0`**
+
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
 Keystone is a **standalone identity platform**, not a wrapper around another identity system. It authenticates users, issues signed tokens, enforces authorization, audits every security decision, and federates identities from any OIDC provider.
@@ -9,17 +11,31 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 ## What Keystone becomes
 
 - **Identity Provider (IdP)** — OIDC/OAuth2 provider with JWKS discovery.
-- **Authentication Service** — email/password, social login, magic links, WebAuthn/Passkeys, TOTP, SMS OTP.
+- **Authentication Service** — email/password with mandatory MFA enforcement, social login, magic links, WebAuthn/Passkeys, TOTP, SMS OTP.
 - **Authorization Engine** — RBAC/ABAC permissions with `/v1/authz/check`.
 - **Token Authority** — short-lived JWT access tokens, rotating refresh tokens, opaque API keys.
 - **Machine Identity Manager** — scoped, rotatable, auditable service credentials.
 - **Federation Broker** — delegate login to Google, GitHub, Azure, Okta, Keycloak, Zitadel, or any OIDC provider and issue Keystone tokens.
 - **Enterprise SSO** — SAML 2.0 and OIDC enterprise connectors with SCIM user provisioning.
 - **Audit & Compliance** — immutable audit log, event bus, webhooks, and anomaly detection.
-- **Workflow Platform** — configurable post-auth workflows (assign roles, create orgs, send email, fire webhooks).
+- **Workflow Platform** — configurable post-auth workflows (organization-scoped notification, email, and webhook steps).
 
 ---
 
+## What's new in v1.7.0
+
+- **Authorization boundary hardening** — platform roles (`owner`/`user`) and organization roles (`owner`/`admin`/`member`) are now separate namespaces.
+- **Dedicated platform-role API** — platform role changes use `PATCH /v1/admin/platform/users/:userId/role` and require a platform owner.
+- **Tenant-safe workflows** — organization workflows can no longer assign global roles or add cross-organization memberships.
+- **Secret-safe user responses** — administrative and organization user responses use a redacted public projection.
+- **Authorization auditing** — role, membership, permission, and denied-authorization events include actor, target, organization, and transition metadata.
+
+> **Migration:** organization user PATCH/DELETE endpoints no longer mutate global accounts. Use the platform user administration endpoint for account-wide changes and organization member endpoints for membership roles.
+
+## What's new in v1.6.0
+
+- **Frontend overhaul** — React 19, Vite 8, Tailwind 4 (config migrated from JS to CSS `@theme` directive), TypeScript 7. Removed autoprefixer, postcss, tailwindcss-animate in favor of Tailwind 4 built-in features.
+
 ## What's new in v1.5.0
 
 - **Auth & infrastructure upgrades** — jose 6, ioredis 6, bullmq 6, @simplewebauthn/server 14, nodemailer 10. Updated KeyLike→CryptoKey for jose 6 and AuthenticatorTransportFuture→AuthenticatorTransport for simplewebauthn 14.
@@ -540,11 +556,13 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/v1/admin/organizations/:id` | Organization details |
 | POST/GET | `/v1/admin/organizations/:id/applications` | Create / list apps |
 | PATCH | `/v1/admin/organizations/:id/applications/:appId` | Update app |
-| POST/GET | `/v1/admin/organizations/:id/invites` | Invite / list invites |
-| GET | `/v1/admin/organizations/:id/members` | List members |
-| PATCH/DELETE | `/v1/admin/organizations/:id/members/:userId` | Update / remove member |
-| GET | `/v1/admin/organizations/:id/users` | List users in org |
-| GET/PATCH/DELETE | `/v1/admin/organizations/:id/users/:userId` | Manage user |
+| POST | `/v1/admin/organizations/:id/invites` | Invite a member with an organization role |
+| GET | `/v1/admin/organizations/:id/members` | List redacted organization members |
+| PATCH/DELETE | `/v1/admin/organizations/:id/members/:userId` | Update/remove an organization membership role |
+| GET | `/v1/admin/organizations/:id/users` | List redacted users in the organization |
+| GET | `/v1/admin/organizations/:id/users/:userId` | Read a redacted organization user |
+| PATCH | `/v1/admin/platform/users/:userId` | Update non-role platform user fields (**owner only**) |
+| PATCH | `/v1/admin/platform/users/:userId/role` | Change a platform role (`owner`/`user`, **owner only**) |
 | GET | `/v1/admin/permissions` | **Owner only** — list all permissions |
 | GET/POST/DELETE | `/v1/admin/roles/:role/permissions` | **Owner only** — manage role permissions |
 | GET/DELETE | `/v1/admin/organizations/:id/api-keys` | Org-scoped API keys |
@@ -577,24 +595,38 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 
 ### SCIM Provisioning
 
+Every request is authorized by a per-organization SCIM connection and scoped to
+that organization. Cross-tenant targets return `404`.
+
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/scim/v2/Users` | List all users (SCIM) |
-| GET | `/scim/v2/Users/:userId` | Get user by ID (SCIM) |
-| POST | `/scim/v2/Users` | Create user (SCIM) |
-| PUT | `/scim/v2/Users/:userId` | Update user (SCIM) |
-| DELETE | `/scim/v2/Users/:userId` | Delete user (SCIM) |
-| GET | `/scim/v2/Groups` | List groups (SCIM) |
-| GET | `/scim/v2/Groups/:groupId` | Get group by ID (SCIM) |
+| GET | `/scim/v2/Users` | List users (filter, pagination) |
+| GET | `/scim/v2/Users/:userId` | Get user by ID |
+| POST | `/scim/v2/Users` | Provision or update a user |
+| PUT | `/scim/v2/Users/:userId` | Replace user |
+| PATCH | `/scim/v2/Users/:userId` | Partial update |
+| DELETE | `/scim/v2/Users/:userId` | Deprovision user |
+| POST | `/scim/v2/Users/.search` | Search users |
+| GET | `/scim/v2/Groups` | List groups (filter) |
+| GET | `/scim/v2/Groups/:groupId` | Get group by ID |
+| POST/PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage groups |
+| GET/POST | `/scim/v2/Groups/:groupId/members` | Manage group members |
+| GET | `/scim/v2/ServiceProviderConfig` | Supported features |
+
+Bearer tokens are created, rotated, and revoked per organization under
+`/v1/admin/organizations/:id/scim-connections` (owner-only). The token is shown
+once and stored only as a digest.
 
 ### MFA & Security
 
 | Method | Path | Description |
 |--------|------|-------------|
-| POST | `/totp/enroll` | Enroll TOTP MFA |
-| POST | `/totp/verify` | Verify TOTP code |
+| POST | `/mfa/verify` | Complete a login MFA challenge and receive tokens |
+| POST | `/totp/enroll` | Begin TOTP enrollment |
+| POST | `/totp/verify` | Confirm enrollment; revokes existing sessions |
 | POST | `/totp/disable` | Disable TOTP MFA |
-| POST | `/totp/backup` | Verify backup code |
+| POST | `/totp/backup` | Regenerate backup codes (requires a TOTP code) |
+| POST | `/totp/backup/verify` | Consume a backup code |
 | POST | `/sms-otp/send` | Send SMS OTP |
 | POST | `/sms-otp/verify` | Verify SMS OTP |
 | POST | `/magic-link/send` | Send magic link |
@@ -617,11 +649,11 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/workflows` | List workflows (requires orgId) |
-| POST | `/workflows` | Create workflow |
-| GET | `/workflows/:id` | Get workflow |
-| DELETE | `/workflows/:id` | Delete workflow |
-| GET | `/workflows/:id/runs` | List workflow runs |
+| GET | `/v1/admin/workflows?orgId=...` | List organization-scoped workflows |
+| POST | `/v1/admin/workflows` | Create a workflow with safe steps and an `orgId` |
+| GET | `/v1/admin/workflows/:id` | Get a workflow |
+| DELETE | `/v1/admin/workflows/:id` | Delete a workflow |
+| GET | `/v1/admin/workflows/:id/runs` | List workflow runs |
 
 ### Discovery
 
@@ -653,7 +685,7 @@ npx keystone migrate
 # Validate required configuration
 npx keystone config:validate
 
-# Create the first platform owner
+# Create a local platform user (use --role owner for a platform owner)
 npx keystone user:create --email admin@example.com --password 'Str0ngP@ss!' --role owner
 
 # Create an organization from the command line
@@ -671,8 +703,10 @@ npx keystone org:create --name "Acme" --owner-email admin@example.com
 - Every authentication decision is audited.
 - Cookies use `HttpOnly`, `Secure`, and `SameSite`.
 - OAuth2 public clients must use PKCE.
-- All admin endpoints require owner or role-based authorization.
-- All workflow operations require organization membership.
+- Platform roles (`owner`, `user`) are never interchangeable with organization roles (`owner`, `admin`, `member`).
+- Only platform owners can change platform roles; organization member APIs cannot mutate global users.
+- User responses use a redacted public projection and never include password hashes, TOTP secrets, or sensitive metadata.
+- All workflow operations require organization membership and reject authorization-mutating tenant steps.
 - XML output (SAML metadata) is escaped to prevent injection.
 - Rate limit nonces use cryptographically secure random bytes.
 - Internal implementation details are not exposed in API responses.

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 const program = new Command();
-program.name("keystone").description("Hilbras Keystone CLI").version("1.0.0");
+program.name("keystone").description("Hilbras Keystone CLI").version("1.9.0");
 program
     .command("init")
     .description("Create a sample .env file for Keystone")
@@ -48,15 +48,17 @@ program
     .requiredOption("--password <password>", "User password")
     .option("--username <username>", "Username")
     .option("--name <name>", "Display name")
-    .option("--role <role>", "Role (e.g. owner, admin, member)", "member")
+    .option("--role <role>", "Platform role (owner or user)", "user")
     .action(async (options) => {
     const { initializeContainer } = await import("./di.js");
     const { AuthenticationDomainService } = await import("./services/domain/index.js");
-    const { db } = await import("./db/index.js");
-    const { users } = await import("./db/schema.js");
-    const { eq } = await import("drizzle-orm");
+    if (options.role !== "owner" && options.role !== "user") {
+        console.error("Role must be either owner or user");
+        process.exit(1);
+    }
+    const { MfaService } = await import("./services/mfa.js");
     const container = initializeContainer();
-    const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
+    const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository, container.organizationRepository, new MfaService(container.mfaChallengeRepository, container.userRepository));
     const result = await authService.register({
         email: options.email,
         password: options.password,
@@ -68,8 +70,13 @@ program
         console.error(`Failed to create user: ${result.error.message}`);
         process.exit(1);
     }
-    if (options.role !== "member") {
-        await db.update(users).set({ role: options.role }).where(eq(users.id, result.data.user.id));
+    if (options.role === "owner") {
+        await container.userRepository.updateRole(result.data.user.id, "owner");
+        const { persistAudit } = await import("./services/audit.js");
+        await persistAudit({
+            event: "platform_role_changed",
+            metadata: { actor: "cli", targetUserId: result.data.user.id, newRole: "owner" },
+        });
     }
     console.log(`Created user ${result.data.user.id} (${result.data.user.email}) with role ${options.role}`);
 });
@@ -79,38 +86,29 @@ program
     .requiredOption("--name <name>", "Organization name")
     .option("--slug <slug>", "Organization slug")
     .option("--plan <plan>", "Billing plan", "free")
-    .option("--owner-email <email>", "Owner email")
+    .requiredOption("--owner-email <email>", "Existing platform user email that will own the organization")
     .action(async (options) => {
     const { initializeContainer } = await import("./di.js");
     const { OrganizationDomainService } = await import("./services/domain/index.js");
-    const { DrizzleUserRepository, DrizzleOrganizationRepository } = await import("./repositories/index.js");
+    const { DrizzleUserRepository } = await import("./repositories/index.js");
     const container = initializeContainer();
-    const orgService = new OrganizationDomainService(container.organizationRepository, container.applicationRepository, container.userRepository);
+    const orgService = new OrganizationDomainService(container.organizationRepository, container.applicationRepository);
+    const users = new DrizzleUserRepository();
+    const owner = await users.findByEmail(options.ownerEmail);
+    if (!owner) {
+        console.error(`Owner email ${options.ownerEmail} not found; organization was not created`);
+        process.exit(1);
+    }
     const orgResult = await orgService.createOrganization({
         name: options.name,
         slug: options.slug,
         plan: options.plan,
-    });
+    }, owner.id);
     if (!orgResult.success) {
         console.error(`Failed to create organization: ${orgResult.error.message}`);
         process.exit(1);
     }
     const org = orgResult.data;
-    if (options.ownerEmail) {
-        const users = new DrizzleUserRepository();
-        const owner = await users.findByEmail(options.ownerEmail);
-        if (owner) {
-            const orgs = new DrizzleOrganizationRepository();
-            await orgs.addMembership({
-                orgId: org.id,
-                userId: owner.id,
-                role: "owner",
-            });
-        }
-        else {
-            console.warn(`Owner email ${options.ownerEmail} not found; organization created without owner`);
-        }
-    }
     console.log(`Created organization ${org.id} (${org.slug})`);
 });
 program

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,eAAe,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC;KAC3C,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,eAAe,EAAE,kCAAkC,EAAE,QAAQ,CAAC;KACrE,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;IACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnF,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,2BAA2B,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EACN,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrF,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC,CACF,CAAC;AAEJ,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,2BAA2B,CAAC;KACxC,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC;KACpD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;KAC5C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;KAC/C,MAAM,CAAC,uBAAuB,EAAE,aAAa,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,OAA2E,EAAE,EAAE;IAC5F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAC3E,yBAAyB,CAC1B,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,CAAC,sBAAsB,EAChC,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,cAAc,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC;QACpD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,IAAI,6BAA6B,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChB,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,UAAU,gDAAgD,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,eAAe,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC;KAC3C,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,eAAe,EAAE,+BAA+B,EAAE,MAAM,CAAC;KAChE,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;IACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,2BAA2B,CACjD,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,sBAAsB,EAChC,IAAI,UAAU,CAAC,SAAS,CAAC,sBAAsB,EAAE,SAAS,CAAC,cAAc,CAAC,CAC3E,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EACN,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrF,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7D,MAAM,YAAY,CAAC;YACjB,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC,CACF,CAAC;AAEJ,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,2BAA2B,CAAC;KACxC,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC;KACpD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;KAC5C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,6DAA6D,CAAC;KACtG,MAAM,CAAC,KAAK,EAAE,OAA0E,EAAE,EAAE;IAC3F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,CAAC,sBAAsB,EAChC,SAAS,CAAC,qBAAqB,CAChC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,eAAe,OAAO,CAAC,UAAU,0CAA0C,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CACnD;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,EACD,KAAK,CAAC,EAAE,CACT,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/config.d.ts

@@ -15,9 +15,10 @@ export declare const config: {
     readonly ZITADEL_GOOGLE_IDP_ID: string;
     readonly ZITADEL_GITHUB_IDP_ID: string;
     readonly COOKIE_NAME: string;
-    readonly COOKIE_DOMAIN: string;
+    readonly COOKIE_DOMAIN: string | undefined;
     readonly COOKIE_SECURE: boolean;
     readonly COOKIE_SAME_SITE: "strict" | "lax" | "none";
+    readonly ALLOW_PRIVATE_SSO_ENDPOINTS: boolean;
     readonly AUTH_API_PUBLIC_URL: string;
     readonly ACCESS_TOKEN_TTL_SECONDS: number;
     readonly REFRESH_TOKEN_TTL_SECONDS: number;
@@ -43,6 +44,19 @@ export declare const config: {
     readonly OAUTH_CODE_TTL_SECONDS: number;
     readonly TOTP_ISSUER: string;
     readonly TOTP_ENCRYPTION_KEY: string;
+    readonly SCIM_BEARER_TOKEN: string;
+    readonly SCIM_ORG_ID: string;
+    /** How long a rotated-out SCIM token keeps working. */
+    readonly SCIM_ROTATION_GRACE_SECONDS: number;
+    /** Rate limit applied to every SCIM request, keyed by credential. */
+    readonly SCIM_RATE_LIMIT_MAX: number;
+    readonly SCIM_RATE_LIMIT_WINDOW_SECONDS: number;
+    /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
+    readonly SCIM_AUTH_FAILURE_MAX: number;
+    readonly SCIM_AUTH_FAILURE_WINDOW_SECONDS: number;
+    readonly MFA_CHALLENGE_TTL_SECONDS: number;
+    readonly MFA_MAX_ATTEMPTS: number;
+    readonly TOTP_BACKUP_CODE_TTL_SECONDS: number;
     readonly EMAIL_PROVIDER: string;
     readonly EMAIL_FROM: string;
     readonly SMTP_HOST: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;+BA6BsG,QAAQ,GAAG,KAAK,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmExI,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;aAChC,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}