@hilbras/keystone 1.6.0 → 2.5.0

package/README.md

@@ -1,5 +1,7 @@
 # Hilbras Keystone
 
+**Current version: `2.5.0`**
+
 > A provider-agnostic, API-first identity platform for Hilbras products and third-party applications.
 
 Keystone is a **standalone identity platform**, not a wrapper around another identity system. It authenticates users, issues signed tokens, enforces authorization, audits every security decision, and federates identities from any OIDC provider.
@@ -9,17 +11,112 @@ Keystone is a **standalone identity platform**, not a wrapper around another ide
 ## What Keystone becomes
 
 - **Identity Provider (IdP)** — OIDC/OAuth2 provider with JWKS discovery.
-- **Authentication Service** — email/password, social login, magic links, WebAuthn/Passkeys, TOTP, SMS OTP.
+- **Authentication Service** — email/password with mandatory MFA enforcement, social login, magic links, WebAuthn/Passkeys, TOTP, SMS OTP.
 - **Authorization Engine** — RBAC/ABAC permissions with `/v1/authz/check`.
 - **Token Authority** — short-lived JWT access tokens, rotating refresh tokens, opaque API keys.
 - **Machine Identity Manager** — scoped, rotatable, auditable service credentials.
 - **Federation Broker** — delegate login to Google, GitHub, Azure, Okta, Keycloak, Zitadel, or any OIDC provider and issue Keystone tokens.
 - **Enterprise SSO** — SAML 2.0 and OIDC enterprise connectors with SCIM user provisioning.
 - **Audit & Compliance** — immutable audit log, event bus, webhooks, and anomaly detection.
-- **Workflow Platform** — configurable post-auth workflows (assign roles, create orgs, send email, fire webhooks).
+- **Workflow Platform** — configurable post-auth workflows (organization-scoped notification, email, and webhook steps).
 
 ---
 
+## What's new in v2.5.0
+
+- **The OIDC nonce now reaches the Google connector** — `GoogleConnector.exchangeCode` overrode the base method without forwarding its options, so the nonce added in 2.4.0 was silently discarded for the default provider. Every non-Google OIDC provider validated the nonce; Google, the most likely to be in use, did not.
+- **The unsigned SAML `Issuer` is now validated** — the response-level `<saml:Issuer>` sits outside both signed regions, so rewriting it does not invalidate the signature, and nothing compared it to the registered IdP. An assertion could claim to come from a different identity provider. Keystone now checks it against the connection, as SAML 2.0 §2.5.1.5 requires. The assertion's own issuer is inside the signed region and was always covered.
+- **`RelayState` verification returns false instead of throwing** — a malformed RelayState is a bad request an attacker fully controls, so it produced a 500 rather than a 400.
+- **A missing userinfo endpoint is reported as unconfigured** — it was passed to the fetcher with a non-null assertion, surfacing a misleading "must be a valid URL" for a URL that was never set.
+- **24 adversarial SAML tests** — tampered signatures, untrusted signing keys, rotated-out certificates, unsigned assertions, XML signature wrapping, issuer and audience substitution, destination and recipient prefix/superstring/case variants, expired and not-yet-valid assertions, `InResponseTo` mismatch, transaction replay, and five RelayState tampering scenarios.
+- **[enterprise-sso.md](docs/security/enterprise-sso.md)** — SAML and OIDC setup, every check applied to an assertion or ID token, certificate rotation (and its lack of a grace period), endpoint SSRF policy, organization scoping, and recommendations.
+
+## What's new in v2.4.0
+
+> **Breaking.** The `authorization_code` grant now requires client authentication. A client redeeming an authorization code must present its `client_secret`; requests without one now receive `401 invalid_client`. Clients that were relying on the grant working without a secret must send it.
+
+- **The authorization code grant now authenticates the client** — it previously looked the client up and redeemed the code without ever checking a secret, so the code and its PKCE verifier were the only factors. This violates RFC 6749 §3.2.1 for confidential clients.
+- **`javascript:` and `data:` are refused as redirect URIs** — validation was `z.string().url()`, which accepts anything the URL parser accepts, including script-bearing schemes. A redirect URI is a value Keystone puts in a `Location` header on its own origin, so an org admin could previously register one and hand any user who authorized their app a redirect toward script execution. Also rejects wildcards, fragments, embedded credentials, and plaintext HTTP to non-loopback hosts.
+- **Public clients are supported and must use PKCE** — a `public` client type is issued no secret at all, rather than a secret it is expected to ignore, and a database constraint keeps the two halves of a client type consistent. PKCE is then mandatory for it, because client authentication is the only thing a secretless client cannot do.
+- **Scopes are intersected, not trusted** — the effective set is registered ∩ requested ∩ consented. A scope outside the registration is refused with `invalid_scope` rather than silently dropped, so a client asking for more than it has is visible instead of quietly downgraded. An empty registration preserves existing behaviour.
+- **OIDC federation sends and verifies a nonce** — `state` already proved the callback belonged to a login this browser started, but nothing bound the *ID token* to it. Any ID token the provider considered valid was accepted, including one minted for a different user or session.
+- **ID token verification is stricter** — algorithms are pinned rather than inferred from key material, and `exp`, `iat`, `iss`, `aud`, `sub` are *required* rather than merely checked when present. A token with no expiry was previously accepted indefinitely.
+- **Refresh tokens carry the granted scope set** — rotation preserves the authorization context instead of dropping it at the first refresh, and a refresh can narrow the grant but never widen it.
+
+## What's new in v2.3.0
+
+- **A password reset now actually logs the attacker out** — completing a reset changed the password but left every existing session and refresh token working. A reset is the standard response to a suspected compromise, so this defeated its own purpose: whoever prompted the reset kept their access. Sessions, refresh tokens, and outstanding recovery credentials are now all invalidated.
+- **An intercepted earlier reset email is dead** — reset tokens issued alongside the one used are now spent, so someone who captured a previous reset email cannot complete it after the user has already recovered.
+- **One revocation layer** — `revokeUserSessions`, `revokeRefreshTokens`, `revokeAuthenticationSessions`, and `revokeRecoveryCredentials` live in one place. Revocation was previously open-coded per call site, which is how the reset path came to omit it; the MFA-enable path now routes through the same function so the rule cannot drift.
+- **Recovery is left intact** — resetting revokes access but does not lock the user out: they can immediately log in with the new password. Covered by a test.
+
+> **Not revoked on reset:** API keys. They are separately issued, long-lived credentials belonging to integrations rather than to the person, and killing them silently breaks deployments. The residual gap — a key minted by an attacker who already held the password — is real; see [SECURITY.md](docs/SECURITY.md) for why key expiry is the right fix.
+
+## What's new in v2.2.0
+
+- **Magic links can no longer be redeemed twice at once** — consumption was a conditional `SELECT` followed by an *unconditional* `UPDATE`. Any number of parallel redemptions passed the check and every one of them logged in. The write is now the gate, so exactly one succeeds.
+- **Password reset tokens are spent exactly once** — the same race meant parallel resets each wrote a different password, last writer winning. This was the most consequential of the three, since whoever won held the account.
+- **SMS OTP codes are spent exactly once** — same shape, same fix.
+- **Replays are reported, not just refused** — a credential presented after it was already used now emits `magic_link_replayed`, `sms_otp_replayed`, or `password_reset_token_replayed`, which reaches the audit log. Previously a replay was indistinguishable from a typo, so a leaked token coming back was invisible. An *expired* credential is deliberately not reported as a replay, since that is not a leak.
+- **One shared primitive** — all consumption goes through a single atomic claim, so the pattern exists once rather than in three places that can drift.
+
+## What's new in v2.1.0
+
+- **Dependency tree is clean** — `npm audit` reports zero vulnerabilities across production *and* development trees, including a transitive `esbuild@0.18.20` that `drizzle-kit` was pinning. Resolved with an `overrides` entry rather than `audit fix --force`, which offered only a breaking downgrade of `drizzle-kit`.
+- **Continuous dependency security** — Dependabot for npm, GitHub Actions, and Docker; OSV scanning as an advisory source independent of npm's; enforced `npm audit`; dependency review on pull requests; SBOM generation; container scanning; and a license gate restricted to permissive terms.
+- **Release metadata is verified** — `npm run verify:release` fails the build on a version that disagrees between `package.json` and the lockfile, a missing or malformed license, or a missing `repository` field. Runs in CI and again before `npm publish`.
+- **The container image no longer ships a vulnerable npm** — the runtime image carried 8 HIGH-severity advisories inherited from the base image's bundled `npm@10.9.9`, invisible to `npm audit` and OSV because they are not in the dependency tree. npm is now removed from the production stage, which the app never invokes, clearing all 8 and shrinking the image from 600 MB to 550 MB.
+- **The package now declares its license** — `package.json` had no `license` field despite shipping an MIT `LICENSE` file, so the published package carried no machine-readable terms.
+
+## What's new in v2.0.0
+
+> **Breaking.** Two changes affect every deployment. `x-service-account-id` no
+> longer authenticates on its own, and `x-forwarded-for` is no longer believed
+> unless `KEYSTONE_TRUSTED_PROXIES` is set — behind a proxy with it unset, all
+> clients share one rate-limit budget. Read
+> [MIGRATION-2.0.md](docs/MIGRATION-2.0.md) before upgrading.
+
+- **A service account cannot be named into existence** — `x-service-account-id` previously authenticated as any service account named in the header, with no certificate and no credential. Identity now comes only from a certificate bound to the account or an authenticated credential.
+- **Certificates are bound to a fingerprint** — a service account authenticates by a client certificate whose SHA-256 fingerprint is bound to it, uniquely. A fingerprint can map to at most one account, and malformed values are rejected before they reach the database.
+- **Client identity headers are stripped from untrusted peers** — an `onRequest` hook removes them before routing and authentication, so no route can read a spoofed identity by accident.
+- **Rate limits can no longer be escaped** — the limiter previously read `x-forwarded-for` unconditionally, so any client could present a fresh address per request and never be limited. Keys come from the peer address unless a trusted proxy forwarded one.
+- **`KEYSTONE_TRUSTED_PROXIES`** names the proxies permitted to set identity headers. Unset by default, which trusts nothing.
+- **Service accounts can be revoked** — `POST /v1/admin/organizations/:id/service-accounts/:accountId/revoke` stops both certificate and API-key authentication.
+- **Documented trust boundaries** — [trust-boundaries.md](docs/security/trust-boundaries.md), [proxy-security.md](docs/security/proxy-security.md), and [mtls.md](docs/security/mtls.md).
+
+## What's new in v1.9.0
+
+- **SCIM is organization-scoped** — every SCIM connection belongs to exactly one organization, and every user and group read and write is filtered by it. A cross-tenant target returns `404`, so the endpoint is not a tenant oracle.
+- **SCIM credentials are per organization** — bearer tokens are stored only as a SHA-256 digest, resolved by that digest, and can be expired, rotated, and revoked. Issuing, rotating, and revoking is owner-only.
+- **Deprovisioning no longer reaches outside the tenant** — removing a user removes that organization's membership, and deactivates the account only when no membership remains anywhere. Previously it disabled a shared account in every organization that user belonged to.
+- **Real SCIM groups** — create, read, replace, patch, and delete groups, manage members, and search. Replaces the old synthetic role-bucket projection.
+- **New SCIM surface** — `PATCH /Users/:id`, `Users/.search`, `ServiceProviderConfig`, `ResourceTypes`, and `filter`/`startIndex`/`count`. Unsupported filters are rejected rather than silently ignored.
+
+> **Migration:** `SCIM_BEARER_TOKEN` and `SCIM_ORG_ID` are deprecated. If still set they are adopted once into a connection and then ignored — including after a revocation, so a restart cannot resurrect a credential you revoked. See [MIGRATION-1.9.md](docs/MIGRATION-1.9.md).
+
+## What's new in v1.8.0
+
+- **MFA is mandatory** — a user with TOTP enabled never receives a token before completing the second factor. Password authentication stops at `requires_mfa`; only `POST /auth/mfa/verify` completes the login.
+- **One-time MFA challenges** — opaque, short-lived, stored only as a hash, single-use, with an attempt budget enforced in the database.
+- **A single token-issuance chokepoint** — a token cannot be minted for an MFA-enabled user without a recorded factor, so no login path can bypass MFA by omission.
+- **TOTP verified against the user's own secret**, and each time-step is accepted exactly once, so a captured code is rejected even against a freshly issued challenge.
+- **Hardened backup codes** — 80 bits of entropy, keyed (peppered) hashing, expiry, and single-use consumption via a conditional update.
+- **Step-up on factor changes** — enrolling, confirming, disabling, or regenerating TOTP codes requires the account password, so a leaked session token cannot take over an account's second factor.
+- **Enabling MFA revokes existing sessions and refresh tokens**, and refresh rotation refuses sessions with no recorded factor.
+- **TOTP secrets are encrypted with AES-256-GCM**; values written by earlier versions remain readable.
+
+> **Migration:** `/auth/login` and `/auth/token-login` return `401` with `code: "MFA_REQUIRED"` and a challenge when MFA is required. Clients must render a code step and call `/auth/mfa/verify`. See [MIGRATION-1.8.md](docs/MIGRATION-1.8.md).
+
+## What's new in v1.7.0
+
+- **Authorization boundary hardening** — platform roles (`owner`/`user`) and organization roles (`owner`/`admin`/`member`) are now separate namespaces.
+- **Dedicated platform-role API** — platform role changes use `PATCH /v1/admin/platform/users/:userId/role` and require a platform owner.
+- **Tenant-safe workflows** — organization workflows can no longer assign global roles or add cross-organization memberships.
+- **Secret-safe user responses** — administrative and organization user responses use a redacted public projection.
+- **Authorization auditing** — role, membership, permission, and denied-authorization events include actor, target, organization, and transition metadata.
+
+> **Migration:** organization user PATCH/DELETE endpoints no longer mutate global accounts. Use the platform user administration endpoint for account-wide changes and organization member endpoints for membership roles.
+
 ## What's new in v1.6.0
 
 - **Frontend overhaul** — React 19, Vite 8, Tailwind 4 (config migrated from JS to CSS `@theme` directive), TypeScript 7. Removed autoprefixer, postcss, tailwindcss-animate in favor of Tailwind 4 built-in features.
@@ -477,6 +574,14 @@ services:
 | `KEYSTONE_QUEUE_PROVIDER` | `in-process`, `bullmq`, or empty to auto-select when Redis is available |
 | `KEYSTONE_PLUGINS` | Comma-separated module paths of plugins to load at startup |
 | `KEYSTONE_FEATURE_FLAGS` | Comma-separated `flag=true|false` runtime feature toggles |
+| `KEYSTONE_TOTP_ENCRYPTION_KEY` | Encrypts TOTP secrets and keys the backup-code hash. Falls back to `KEYSTONE_INTERNAL_API_KEY`. Must be stable — changing it invalidates enrolled authenticators |
+| `MFA_CHALLENGE_TTL_SECONDS` | Lifetime of a login MFA challenge (default `300`) |
+| `MFA_MAX_ATTEMPTS` | Factor attempts per challenge before it is locked (default `5`) |
+| `TOTP_BACKUP_CODE_TTL_SECONDS` | Backup-code lifetime (default `7776000`, 90 days) |
+| `SCIM_ROTATION_GRACE_SECONDS` | Grace window for a rotated SCIM token. Defaults to `0`, so rotation revokes the previous token |
+| `SCIM_RATE_LIMIT_MAX` / `SCIM_RATE_LIMIT_WINDOW_SECONDS` | Per-credential SCIM request budget |
+| `SCIM_AUTH_FAILURE_MAX` / `SCIM_AUTH_FAILURE_WINDOW_SECONDS` | Budget for unauthenticated SCIM requests, applied before authentication |
+| `KEYSTONE_TRUSTED_PROXIES` | Comma-separated proxy IPs / CIDRs allowed to set client-identity headers. **Unset means trust nothing** — forwarded headers are stripped and all clients share one rate-limit budget. Required when Keystone runs behind a reverse proxy |
 
 ---
 
@@ -504,8 +609,9 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | Method | Path | Description |
 |--------|------|-------------|
 | POST | `/auth/register` | Email/password signup (local password hashing) |
-| POST | `/auth/login` | Email/password login (sets session cookies) |
+| POST | `/auth/login` | Email/password login (sets session cookies; returns `401 MFA_REQUIRED` + a challenge when MFA is required) |
 | POST | `/auth/token-login` | Email/password login for SPA/dashboard (returns bearer token) |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
 | POST | `/auth/logout` | Revoke session |
 | GET | `/auth/me` | Current user |
 | POST | `/auth/refresh` | Rotate refresh token |
@@ -513,7 +619,8 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/auth/callback/:provider` | OAuth callback |
 | POST | `/auth/forgot-password` | Request password reset |
 | POST | `/auth/reset-password` | Complete password reset |
-| POST/GET/DELETE | `/auth/api-keys` | Personal API keys |
+| POST/GET | `/auth/api-keys` | Create / list personal API keys |
+| DELETE | `/auth/api-keys/:id` | Revoke a personal API key |
 | GET | `/auth/validate` | Internal token/API-key validation |
 
 ### Federation
@@ -544,14 +651,18 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/v1/admin/organizations/:id` | Organization details |
 | POST/GET | `/v1/admin/organizations/:id/applications` | Create / list apps |
 | PATCH | `/v1/admin/organizations/:id/applications/:appId` | Update app |
-| POST/GET | `/v1/admin/organizations/:id/invites` | Invite / list invites |
-| GET | `/v1/admin/organizations/:id/members` | List members |
-| PATCH/DELETE | `/v1/admin/organizations/:id/members/:userId` | Update / remove member |
-| GET | `/v1/admin/organizations/:id/users` | List users in org |
-| GET/PATCH/DELETE | `/v1/admin/organizations/:id/users/:userId` | Manage user |
+| POST | `/v1/admin/organizations/:id/invites` | Invite a member with an organization role |
+| GET | `/v1/admin/organizations/:id/members` | List redacted organization members |
+| PATCH/DELETE | `/v1/admin/organizations/:id/members/:userId` | Update/remove an organization membership role |
+| GET | `/v1/admin/organizations/:id/users` | List redacted users in the organization |
+| GET | `/v1/admin/organizations/:id/users/:userId` | Read a redacted organization user |
+| PATCH | `/v1/admin/platform/users/:userId` | Update non-role platform user fields (**owner only**) |
+| PATCH | `/v1/admin/platform/users/:userId/role` | Change a platform role (`owner`/`user`, **owner only**) |
 | GET | `/v1/admin/permissions` | **Owner only** — list all permissions |
-| GET/POST/DELETE | `/v1/admin/roles/:role/permissions` | **Owner only** — manage role permissions |
-| GET/DELETE | `/v1/admin/organizations/:id/api-keys` | Org-scoped API keys |
+| GET/POST | `/v1/admin/roles/:role/permissions` | **Owner only** — list / assign role permissions |
+| DELETE | `/v1/admin/roles/:role/permissions/:permissionId` | **Owner only** — remove a role permission |
+| GET | `/v1/admin/organizations/:id/api-keys` | List org-scoped API keys |
+| DELETE | `/v1/admin/organizations/:id/api-keys/:keyId` | Revoke an org-scoped API key |
 | GET | `/v1/admin/organizations/:id/audit-logs` | Paginated audit logs |
 | GET | `/v1/admin/platform/users` | **Owner only** — list all users |
 | GET | `/v1/admin/platform/organizations` | **Owner only** — list all organizations |
@@ -563,69 +674,96 @@ If Keystone feels slow or uses a lot of memory during development, see [`docs/PE
 | GET | `/v1/admin/platform/queue/failed` | **Owner only** — failed jobs |
 | POST | `/v1/admin/platform/queue/failed/:id/retry` | **Owner only** — retry failed job |
 | POST | `/v1/admin/platform/queue/retry-all` | **Owner only** — retry all failed jobs |
-| GET/POST/PATCH/DELETE | `/v1/admin/platform/webhooks` | **Owner only** — webhook management |
+| GET/POST | `/v1/admin/platform/webhooks` | **Owner only** — list / create webhooks |
+| PATCH | `/v1/admin/platform/webhooks/:id` | **Owner only** — update a webhook |
+| DELETE | `/v1/admin/platform/webhooks/:id` | **Owner only** — delete a webhook |
 | POST | `/v1/admin/platform/webhooks/:id/rotate-secret` | **Owner only** — rotate webhook secret |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| GET/POST | `/v1/admin/organizations/:id/saml-connections` | SAML connection management |
+| DELETE | `/v1/admin/organizations/:id/saml-connections/:connectionId` | Delete a SAML connection |
 | GET | `/v1/admin/organizations/:id/saml-connections/:connectionId/metadata` | SAML SP metadata |
-| GET/POST/DELETE | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| GET/POST | `/v1/admin/organizations/:id/oidc-connections` | OIDC connection management |
+| DELETE | `/v1/admin/organizations/:id/oidc-connections/:connectionId` | Delete an OIDC connection |
 
 ### Enterprise SSO
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/saml/:connectionId` | Start SAML SSO login |
-| POST | `/saml/acs` | SAML assertion consumer service |
-| GET | `/saml/:connectionId/metadata` | SAML SP metadata |
-| GET | `/sso/oidc/:connectionId` | Start enterprise OIDC SSO login |
-| GET | `/sso/oidc/:connectionId/callback` | Enterprise OIDC callback |
+| GET | `/sso/saml/:connectionId` | Start SAML SSO login (requires `?orgId=`) |
+| POST | `/sso/saml/acs` | SAML assertion consumer service |
+| GET | `/sso/saml/:connectionId/metadata` | SAML SP metadata (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId` | Start enterprise OIDC SSO login (requires `?orgId=`) |
+| GET | `/sso/sso/oidc/:connectionId/callback` | Enterprise OIDC callback (requires `?orgId=`) |
+
+> **Note:** the doubled `/sso/sso/oidc` segment is real, not a typo. The OIDC
+> enterprise routes declare `/sso/oidc/...` *and* are mounted under the `/sso`
+> prefix. SAML is mounted the same way but declares `/saml/...`, so it resolves
+> cleanly to `/sso/saml/...`. Changing the OIDC path would break existing
+> deployments, so it is scheduled for a future minor release.
 
 ### SCIM Provisioning
 
+Every request is authorized by a per-organization SCIM connection and scoped to
+that organization. Cross-tenant targets return `404`.
+
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/scim/v2/Users` | List all users (SCIM) |
-| GET | `/scim/v2/Users/:userId` | Get user by ID (SCIM) |
-| POST | `/scim/v2/Users` | Create user (SCIM) |
-| PUT | `/scim/v2/Users/:userId` | Update user (SCIM) |
-| DELETE | `/scim/v2/Users/:userId` | Delete user (SCIM) |
-| GET | `/scim/v2/Groups` | List groups (SCIM) |
-| GET | `/scim/v2/Groups/:groupId` | Get group by ID (SCIM) |
+| GET | `/scim/v2/Users` | List users (filter, pagination) |
+| GET | `/scim/v2/Users/:userId` | Get user by ID |
+| POST | `/scim/v2/Users` | Provision or update a user |
+| PUT | `/scim/v2/Users/:userId` | Replace user |
+| PATCH | `/scim/v2/Users/:userId` | Partial update |
+| DELETE | `/scim/v2/Users/:userId` | Deprovision user |
+| POST | `/scim/v2/Users/.search` | Search users |
+| GET | `/scim/v2/Groups` | List groups (filter) |
+| GET | `/scim/v2/Groups/:groupId` | Get group by ID |
+| POST | `/scim/v2/Groups` | Create group |
+| PUT/PATCH/DELETE | `/scim/v2/Groups/:groupId` | Manage group |
+| GET/POST | `/scim/v2/Groups/:groupId/members` | Manage group members |
+| GET | `/scim/v2/ServiceProviderConfig` | Supported features |
+
+Bearer tokens are created, rotated, and revoked per organization under
+`/v1/admin/organizations/:id/scim-connections` (owner-only). The token is shown
+once and stored only as a digest.
 
 ### MFA & Security
 
 | Method | Path | Description |
 |--------|------|-------------|
-| POST | `/totp/enroll` | Enroll TOTP MFA |
-| POST | `/totp/verify` | Verify TOTP code |
-| POST | `/totp/disable` | Disable TOTP MFA |
-| POST | `/totp/backup` | Verify backup code |
-| POST | `/sms-otp/send` | Send SMS OTP |
-| POST | `/sms-otp/verify` | Verify SMS OTP |
-| POST | `/magic-link/send` | Send magic link |
-| GET | `/magic-link/verify` | Verify magic link |
-| POST | `/email-verification/send` | Send verification email |
-| POST | `/email-verification/request` | Request verification email |
-| GET | `/email-verification/verify` | Verify email token |
-| POST | `/webauthn/register` | Register WebAuthn credential |
-| POST | `/webauthn/authenticate` | Authenticate with WebAuthn |
+| POST | `/auth/mfa/verify` | Complete a login MFA challenge and receive tokens |
+| POST | `/auth/totp/enroll` | Begin TOTP enrollment (requires `password`) |
+| POST | `/auth/totp/verify` | Confirm enrollment (requires `password` + `code`); revokes existing sessions |
+| POST | `/auth/totp/disable` | Disable TOTP MFA (requires `password` + `code`) |
+| POST | `/auth/totp/backup` | Regenerate backup codes (requires `password` + `code`) |
+| POST | `/auth/totp/backup/verify` | Consume a backup code; never establishes a session |
+| POST | `/auth/sms-otp/send` | Send SMS OTP |
+| POST | `/auth/sms-otp/verify` | Verify SMS OTP |
+| POST | `/auth/magic-link/send` | Send magic link |
+| GET | `/auth/magic-link/verify` | Verify magic link |
+| POST | `/auth/email-verification/send` | Send verification email |
+| POST | `/auth/email-verification/request` | Request verification email |
+| GET | `/auth/email-verification/verify` | Verify email token |
+| GET | `/auth/webauthn/register/options` | WebAuthn creation options |
+| POST | `/auth/webauthn/register/verify` | Register a WebAuthn credential |
+| POST | `/auth/webauthn/authenticate/options` | WebAuthn assertion options |
+| POST | `/auth/webauthn/authenticate/verify` | Authenticate and establish a session |
 
 ### Sessions
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/sessions` | List active sessions |
-| DELETE | `/sessions/:id` | Revoke session |
-| POST | `/sessions/revoke-all` | Revoke all sessions |
+| GET | `/auth/sessions` | List active sessions |
+| DELETE | `/auth/sessions/:id` | Revoke session |
+| POST | `/auth/sessions/revoke-all` | Revoke all sessions |
 
 ### Workflows
 
 | Method | Path | Description |
 |--------|------|-------------|
-| GET | `/workflows` | List workflows (requires orgId) |
-| POST | `/workflows` | Create workflow |
-| GET | `/workflows/:id` | Get workflow |
-| DELETE | `/workflows/:id` | Delete workflow |
-| GET | `/workflows/:id/runs` | List workflow runs |
+| GET | `/v1/admin/workflows?orgId=...` | List organization-scoped workflows |
+| POST | `/v1/admin/workflows` | Create a workflow with safe steps and an `orgId` |
+| GET | `/v1/admin/workflows/:id` | Get a workflow |
+| DELETE | `/v1/admin/workflows/:id` | Delete a workflow |
+| GET | `/v1/admin/workflows/:id/runs` | List workflow runs |
 
 ### Discovery
 
@@ -657,7 +795,7 @@ npx keystone migrate
 # Validate required configuration
 npx keystone config:validate
 
-# Create the first platform owner
+# Create a local platform user (use --role owner for a platform owner)
 npx keystone user:create --email admin@example.com --password 'Str0ngP@ss!' --role owner
 
 # Create an organization from the command line
@@ -675,13 +813,21 @@ npx keystone org:create --name "Acme" --owner-email admin@example.com
 - Every authentication decision is audited.
 - Cookies use `HttpOnly`, `Secure`, and `SameSite`.
 - OAuth2 public clients must use PKCE.
-- All admin endpoints require owner or role-based authorization.
-- All workflow operations require organization membership.
+- Platform roles (`owner`, `user`) are never interchangeable with organization roles (`owner`, `admin`, `member`).
+- Only platform owners can change platform roles; organization member APIs cannot mutate global users.
+- User responses use a redacted public projection and never include password hashes, TOTP secrets, or sensitive metadata.
+- All workflow operations require organization membership and reject authorization-mutating tenant steps.
 - XML output (SAML metadata) is escaped to prevent injection.
 - Rate limit nonces use cryptographically secure random bytes.
 - Internal implementation details are not exposed in API responses.
 - Input validation uses Zod schemas on all routes.
 - Error messages are sanitized in production mode.
+- **MFA is enforced before token issuance.** An account with TOTP enabled cannot receive a token until a second factor is verified, and the check happens at a single chokepoint rather than per route.
+- TOTP secrets are stored encrypted with AES-256-GCM; backup codes are stored as a keyed, peppered hash, expire, and can only be consumed once.
+- Changing how an account proves its identity — enrolling, confirming, disabling TOTP, or registering a passkey — requires the account password in addition to a valid session.
+- **SCIM credentials are per organization.** Tokens are stored only as a digest, and every SCIM read and write is scoped to the credential's organization. A cross-tenant target is reported as not found.
+- SCIM deprovisioning never reaches outside the caller's organization, and cannot remove the last owner of an organization.
+- SCIM credential creation, rotation, and revocation are restricted to organization owners.
 
 ---
 
@@ -696,6 +842,8 @@ Full documentation lives in [`docs/`](docs/README.md):
 | [Deployment](docs/DEPLOYMENT.md) | Docker Compose, Kubernetes, systemd, hardening |
 | [Integration guide](docs/INTEGRATION.md) | Connect your apps to Keystone |
 | [Security model](docs/SECURITY.md) | Threat model and hardening checklist |
+| [v1.8 migration guide](docs/MIGRATION-1.8.md) | Mandatory MFA: new endpoints, response changes, upgrade steps |
+| [v1.9 migration guide](docs/MIGRATION-1.9.md) | SCIM tenancy: per-organization credentials, deprovisioning semantics, upgrade steps |
 | [Performance](docs/PERFORMANCE.md) | Tuning and load-testing notes |
 | [Contributing](docs/CONTRIBUTING.md) | Dev environment and PR process |
 | [Roadmap](docs/ROADMAP.md) | Planned work |

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from "commander";
 const program = new Command();
-program.name("keystone").description("Hilbras Keystone CLI").version("1.0.0");
+program.name("keystone").description("Hilbras Keystone CLI").version("1.9.0");
 program
     .command("init")
     .description("Create a sample .env file for Keystone")
@@ -48,15 +48,17 @@ program
     .requiredOption("--password <password>", "User password")
     .option("--username <username>", "Username")
     .option("--name <name>", "Display name")
-    .option("--role <role>", "Role (e.g. owner, admin, member)", "member")
+    .option("--role <role>", "Platform role (owner or user)", "user")
     .action(async (options) => {
     const { initializeContainer } = await import("./di.js");
     const { AuthenticationDomainService } = await import("./services/domain/index.js");
-    const { db } = await import("./db/index.js");
-    const { users } = await import("./db/schema.js");
-    const { eq } = await import("drizzle-orm");
+    if (options.role !== "owner" && options.role !== "user") {
+        console.error("Role must be either owner or user");
+        process.exit(1);
+    }
+    const { MfaService } = await import("./services/mfa.js");
     const container = initializeContainer();
-    const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository);
+    const authService = new AuthenticationDomainService(container.userRepository, container.applicationRepository, container.organizationRepository, new MfaService(container.mfaChallengeRepository, container.userRepository));
     const result = await authService.register({
         email: options.email,
         password: options.password,
@@ -68,8 +70,13 @@ program
         console.error(`Failed to create user: ${result.error.message}`);
         process.exit(1);
     }
-    if (options.role !== "member") {
-        await db.update(users).set({ role: options.role }).where(eq(users.id, result.data.user.id));
+    if (options.role === "owner") {
+        await container.userRepository.updateRole(result.data.user.id, "owner");
+        const { persistAudit } = await import("./services/audit.js");
+        await persistAudit({
+            event: "platform_role_changed",
+            metadata: { actor: "cli", targetUserId: result.data.user.id, newRole: "owner" },
+        });
     }
     console.log(`Created user ${result.data.user.id} (${result.data.user.email}) with role ${options.role}`);
 });
@@ -79,38 +86,29 @@ program
     .requiredOption("--name <name>", "Organization name")
     .option("--slug <slug>", "Organization slug")
     .option("--plan <plan>", "Billing plan", "free")
-    .option("--owner-email <email>", "Owner email")
+    .requiredOption("--owner-email <email>", "Existing platform user email that will own the organization")
     .action(async (options) => {
     const { initializeContainer } = await import("./di.js");
     const { OrganizationDomainService } = await import("./services/domain/index.js");
-    const { DrizzleUserRepository, DrizzleOrganizationRepository } = await import("./repositories/index.js");
+    const { DrizzleUserRepository } = await import("./repositories/index.js");
     const container = initializeContainer();
-    const orgService = new OrganizationDomainService(container.organizationRepository, container.applicationRepository, container.userRepository);
+    const orgService = new OrganizationDomainService(container.organizationRepository, container.applicationRepository);
+    const users = new DrizzleUserRepository();
+    const owner = await users.findByEmail(options.ownerEmail);
+    if (!owner) {
+        console.error(`Owner email ${options.ownerEmail} not found; organization was not created`);
+        process.exit(1);
+    }
     const orgResult = await orgService.createOrganization({
         name: options.name,
         slug: options.slug,
         plan: options.plan,
-    });
+    }, owner.id);
     if (!orgResult.success) {
         console.error(`Failed to create organization: ${orgResult.error.message}`);
         process.exit(1);
     }
     const org = orgResult.data;
-    if (options.ownerEmail) {
-        const users = new DrizzleUserRepository();
-        const owner = await users.findByEmail(options.ownerEmail);
-        if (owner) {
-            const orgs = new DrizzleOrganizationRepository();
-            await orgs.addMembership({
-                orgId: org.id,
-                userId: owner.id,
-                role: "owner",
-            });
-        }
-        else {
-            console.warn(`Owner email ${options.ownerEmail} not found; organization created without owner`);
-        }
-    }
     console.log(`Created organization ${org.id} (${org.slug})`);
 });
 program

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,eAAe,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC;KAC3C,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,eAAe,EAAE,kCAAkC,EAAE,QAAQ,CAAC;KACrE,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;IACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnF,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACjD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,2BAA2B,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC/G,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EACN,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrF,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC,CACF,CAAC;AAEJ,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,2BAA2B,CAAC;KACxC,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC;KACpD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;KAC5C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;KAC/C,MAAM,CAAC,uBAAuB,EAAE,aAAa,CAAC;KAC9C,MAAM,CAAC,KAAK,EAAE,OAA2E,EAAE,EAAE;IAC5F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,GAAG,MAAM,MAAM,CAC3E,yBAAyB,CAC1B,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,CAAC,sBAAsB,EAChC,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,cAAc,CACzB,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC;QACpD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,IAAI,6BAA6B,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChB,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,UAAU,gDAAgD,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9E,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wCAAwC,CAAC;KACrD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,yBAAyB,CAAC;KACtC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACrE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACvC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,iCAAiC,CAAC;KAC9C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,gBAAgB,CAAC;KACzB,WAAW,CAAC,mCAAmC,CAAC;KAChD,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,oCAAoC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,6BAA6B,CAAC;KAC1C,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,eAAe,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC;KAC3C,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KACvC,MAAM,CAAC,eAAe,EAAE,+BAA+B,EAAE,MAAM,CAAC;KAChE,MAAM,CACL,KAAK,EAAE,OAMN,EAAE,EAAE;IACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,2BAA2B,CACjD,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,qBAAqB,EAC/B,SAAS,CAAC,sBAAsB,EAChC,IAAI,UAAU,CAAC,SAAS,CAAC,sBAAsB,EAAE,SAAS,CAAC,cAAc,CAAC,CAC3E,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EACN,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrF,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,0BAA0B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC7D,MAAM,YAAY,CAAC;YACjB,KAAK,EAAE,uBAAuB;YAC9B,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;SAChF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,eAAe,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC3G,CAAC,CACF,CAAC;AAEJ,OAAO;KACJ,OAAO,CAAC,YAAY,CAAC;KACrB,WAAW,CAAC,2BAA2B,CAAC;KACxC,cAAc,CAAC,eAAe,EAAE,mBAAmB,CAAC;KACpD,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;KAC5C,MAAM,CAAC,eAAe,EAAE,cAAc,EAAE,MAAM,CAAC;KAC/C,cAAc,CAAC,uBAAuB,EAAE,6DAA6D,CAAC;KACtG,MAAM,CAAC,KAAK,EAAE,OAA0E,EAAE,EAAE;IAC3F,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxD,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACjF,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,mBAAmB,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAC9C,SAAS,CAAC,sBAAsB,EAChC,SAAS,CAAC,qBAAqB,CAChC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,eAAe,OAAO,CAAC,UAAU,0CAA0C,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,kBAAkB,CACnD;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,EACD,KAAK,CAAC,EAAE,CACT,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,kCAAkC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAC3B,OAAO,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,8BAA8B,CAAC;KAC3C,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,aAAa,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;IAC1H,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,kDAAkD,CAAC;KAC/D,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,uBAAuB,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,CAAC,yBAAyB,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/config.d.ts

@@ -15,9 +15,10 @@ export declare const config: {
     readonly ZITADEL_GOOGLE_IDP_ID: string;
     readonly ZITADEL_GITHUB_IDP_ID: string;
     readonly COOKIE_NAME: string;
-    readonly COOKIE_DOMAIN: string;
+    readonly COOKIE_DOMAIN: string | undefined;
     readonly COOKIE_SECURE: boolean;
     readonly COOKIE_SAME_SITE: "strict" | "lax" | "none";
+    readonly ALLOW_PRIVATE_SSO_ENDPOINTS: boolean;
     readonly AUTH_API_PUBLIC_URL: string;
     readonly ACCESS_TOKEN_TTL_SECONDS: number;
     readonly REFRESH_TOKEN_TTL_SECONDS: number;
@@ -43,6 +44,27 @@ export declare const config: {
     readonly OAUTH_CODE_TTL_SECONDS: number;
     readonly TOTP_ISSUER: string;
     readonly TOTP_ENCRYPTION_KEY: string;
+    readonly SCIM_BEARER_TOKEN: string;
+    readonly SCIM_ORG_ID: string;
+    /** How long a rotated-out SCIM token keeps working. */
+    readonly SCIM_ROTATION_GRACE_SECONDS: number;
+    /** Rate limit applied to every SCIM request, keyed by credential. */
+    readonly SCIM_RATE_LIMIT_MAX: number;
+    readonly SCIM_RATE_LIMIT_WINDOW_SECONDS: number;
+    /** Budget for unauthenticated SCIM requests, which run before the credential limiter. */
+    readonly SCIM_AUTH_FAILURE_MAX: number;
+    readonly SCIM_AUTH_FAILURE_WINDOW_SECONDS: number;
+    /**
+     * Comma-separated IP addresses and CIDR ranges of reverse proxies allowed to
+     * set client-identity headers (`x-forwarded-for`, `x-forwarded-client-cert`,
+     * ...). Empty means trust nothing: the peer address is used and those headers
+     * are stripped. Set this only when Keystone genuinely sits behind a proxy you
+     * control — an over-broad value lets any client behind it forge an identity.
+     */
+    readonly TRUSTED_PROXIES: string;
+    readonly MFA_CHALLENGE_TTL_SECONDS: number;
+    readonly MFA_MAX_ATTEMPTS: number;
+    readonly TOTP_BACKUP_CODE_TTL_SECONDS: number;
     readonly EMAIL_PROVIDER: string;
     readonly EMAIL_FROM: string;
     readonly SMTP_HOST: string;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;+BA6BsG,QAAQ,GAAG,KAAK,GAAG,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmExI,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AA6DA,eAAO,MAAM,MAAM;aACjB,QAAQ;aACR,IAAI;aACJ,IAAI;aAEJ,YAAY;aACZ,SAAS;aAGT,cAAc;aACd,cAAc;aACd,kBAAkB;aAGlB,yBAAyB;aACzB,6BAA6B;aAC7B,mBAAmB;aAGnB,iBAAiB;aACjB,qBAAqB;aAGrB,qBAAqB;aACrB,qBAAqB;aAErB,WAAW;aACX,aAAa;aACb,aAAa;aACb,gBAAgB,EAAuG,QAAQ,GAAG,KAAK,GAAG,MAAM;aAChJ,2BAA2B;aAE3B,mBAAmB;aACnB,wBAAwB;aACxB,yBAAyB;aAGzB,eAAe;aACf,cAAc;aAGd,uBAAuB;aAGvB,yBAAyB;aAGzB,uBAAuB;aAGvB,gBAAgB;aAGhB,gBAAgB;aAEhB,gBAAgB;aAEhB,gBAAgB;aAEhB,eAAe;aAEf,mBAAmB;aACnB,yBAAyB;aACzB,qBAAqB;aACrB,wBAAwB;aAExB,yBAAyB;aACzB,gCAAgC;aAEhC,kBAAkB;aAIlB,2BAA2B;aAC3B,sBAAsB;aACtB,sBAAsB;aACtB,WAAW;aACX,mBAAmB;aAInB,iBAAiB;aACjB,WAAW;IACX,uDAAuD;aAGvD,2BAA2B;IAC3B,qEAAqE;aACrE,mBAAmB;aACnB,8BAA8B;IAC9B,yFAAyF;aACzF,qBAAqB;aACrB,gCAAgC;IAChC;;;;;;OAMG;aACH,eAAe;aACf,yBAAyB;aACzB,gBAAgB;aAChB,4BAA4B;aAC5B,cAAc;aACd,UAAU;aACV,SAAS;aACT,SAAS;aACT,SAAS;aACT,SAAS;aACT,WAAW;aACX,gBAAgB;aAChB,eAAe;aACf,cAAc;aACd,YAAY;aACZ,kBAAkB;aAClB,iBAAiB;aACjB,kBAAkB;aAClB,4BAA4B;aAC5B,2BAA2B;aAC3B,iBAAiB;aACjB,oBAAoB;aACpB,sBAAsB;CACd,CAAC;AAEX,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}