@objectstack/platform-objects 10.3.0 → 11.0.0

package/dist/identity/index.js

@@ -35,6 +35,13 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Org invitations are a multi-org-only flow (the endpoint resolves
+      // an active org that does not exist in single-org mode). Hide the
+      // affordance unless multi-org is enabled — matching the
+      // `create_organization` gate on sys_organization. This action is the
+      // most exposed of the set because the Users list is always reachable
+      // in single-org, unlike the org/membership lists.
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -78,6 +85,21 @@ var SysUser = data.ObjectSchema.create({
       successMessage: "User unbanned",
       refreshAfter: true
     },
+    {
+      // ADR-0069 D2 — clear a brute-force lockout early (locked_until auto-
+      // expires, but an admin can release a user immediately). Hits the
+      // plugin-auth custom route, which is admin-guarded server-side.
+      name: "unlock_user",
+      label: "Unlock Account",
+      icon: "lock-open",
+      variant: "secondary",
+      locations: ["list_item"],
+      type: "api",
+      target: "/api/v1/auth/admin/unlock-user",
+      recordIdParam: "userId",
+      successMessage: "Account unlocked",
+      refreshAfter: true
+    },
     {
       name: "set_user_password",
       label: "Set Password",
@@ -154,7 +176,11 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-password",
-      visible: "record.id == ctx.user.id",
+      // Managed (IdP-provisioned) users hold no local credential — hide the
+      // password form so they can't self-mint a password that bypasses
+      // enforced SSO. The break-glass owner (env-native, or flipped back when
+      // their break-glass password is set) keeps it. ADR-0024 D4/D5.2.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Password changed",
       refreshAfter: false,
       params: [
@@ -171,7 +197,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-email",
-      visible: "record.id == ctx.user.id",
+      // A managed user's email is owned by the IdP — a local change would
+      // desync. Hide for IdP-provisioned; env-native users keep it.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Verification email sent \u2014 check the new address to confirm.",
       refreshAfter: false,
       params: [
@@ -202,7 +230,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/delete-user",
-      visible: "record.id == ctx.user.id",
+      // Self-delete needs a local password; managed users are deprovisioned
+      // via the IdP (org-removal / SCIM), not local self-service. Hide for them.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       confirmText: "Permanently delete your account? This cannot be undone \u2014 all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
       successMessage: "Account deleted",
       refreshAfter: false,
@@ -285,7 +315,7 @@ var SysUser = data.ObjectSchema.create({
       name: "all_users",
       label: "All Users",
       data: { provider: "object", object: "sys_user" },
-      columns: ["name", "email", "email_verified", "two_factor_enabled", "created_at"],
+      columns: ["name", "email", "email_verified", "source", "two_factor_enabled", "created_at"],
       sort: [{ field: "name", order: "asc" }],
       pagination: { pageSize: 50 }
     },
@@ -372,6 +402,32 @@ var SysUser = data.ObjectSchema.create({
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
+    // ── Anti-brute-force (ADR-0069 D2) — owned by objectql, better-auth is
+    //    oblivious. The auth manager's sign-in hooks maintain these: failures
+    //    increment the counter; crossing `lockout_threshold` stamps
+    //    `locked_until`; a successful sign-in resets both. Admins can clear
+    //    them early via the Unlock action.
+    failed_login_count: data.Field.number({
+      label: "Failed Login Count",
+      required: false,
+      defaultValue: 0,
+      readonly: true,
+      group: "Admin",
+      description: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+    }),
+    locked_until: data.Field.datetime({
+      label: "Locked Until",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+    }),
+    ai_access: data.Field.boolean({
+      label: "AI Access",
+      defaultValue: false,
+      group: "Admin",
+      description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+    }),
     // ── Profile ──────────────────────────────────────────────────
     image: data.Field.url({
       label: "Profile Image",
@@ -392,6 +448,28 @@ var SysUser = data.ObjectSchema.create({
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
     // ── System (auto-managed, hidden from create/edit forms) ─────
+    // Identity provenance (ADR-0024 D4). `idp_provisioned` users were
+    // JIT-created on first federated login (a `sys_account` exists for an
+    // external/OIDC provider — e.g. the cloud-as-IdP `objectstack-cloud`
+    // provider, or a customer's own IdP); `env_native` users registered
+    // locally (email/password) or are app end-users. Stamped automatically by
+    // the AuthManager `account.create.after` hook — never edited by hand.
+    // Drives the managed-vs-native user-mgmt UI gating (the password /
+    // identity-edit actions hide for managed users, who hold no local
+    // credential) and is the marker SCIM lifecycle keys off. Owned by objectql
+    // (better-auth is oblivious to this column — like `ai_access`).
+    source: data.Field.select({
+      label: "Identity Source",
+      required: false,
+      readonly: true,
+      group: "System",
+      defaultValue: "env_native",
+      options: [
+        { label: "IdP-Provisioned", value: "idp_provisioned" },
+        { label: "Env-Native", value: "env_native" }
+      ],
+      description: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit."
+    }),
     id: data.Field.text({
       label: "User ID",
       required: true,
@@ -757,6 +835,16 @@ var SysAccount = data.ObjectSchema.create({
       label: "Password Hash",
       required: false,
       description: "Hashed password for email/password provider"
+    }),
+    // ADR-0069 D1 — bounded ring of previous password hashes (JSON array of
+    // strings), used to reject password reuse on change/reset. Maintained by
+    // the auth manager; never exposed in UI.
+    previous_password_hashes: data.Field.textarea({
+      label: "Previous Password Hashes",
+      required: false,
+      readonly: true,
+      hidden: true,
+      description: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
     })
   },
   indexes: [
@@ -822,7 +910,13 @@ var SysVerification = data.ObjectSchema.create({
     })
   },
   indexes: [
-    { fields: ["value"], unique: true },
+    // `value` must NOT be unique. better-auth's oauth-provider stores OIDC
+    // authorization codes in this table with `value` = a JSON blob keyed by
+    // user+client+state, which can legitimately repeat. A UNIQUE constraint
+    // makes `/api/v1/auth/oauth2/authorize` fail (`UNIQUE constraint failed:
+    // sys_verification.value`) → 503, breaking cloud-as-IdP SSO entirely.
+    // better-auth keys verification lookups on `identifier`, not `value`.
+    { fields: ["value"], unique: false },
     { fields: ["identifier"], unique: false },
     { fields: ["expires_at"], unique: false }
   ],
@@ -890,6 +984,10 @@ var SysOrganization = data.ObjectSchema.create({
       recordIdParam: "organizationId",
       // better-auth `organization/update` nests editable fields under `data`.
       bodyShape: { wrap: "data" },
+      // Org-admin actions are multi-org-only; hide them in single-org for
+      // consistency with `create_organization` (the org list is empty there,
+      // but this also guards direct record-URL access).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Organization updated",
       refreshAfter: true,
       params: [
@@ -908,6 +1006,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/delete",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
       successMessage: "Organization deleted",
       refreshAfter: true
@@ -926,6 +1025,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/set-active",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Active organization switched",
       refreshAfter: true
     },
@@ -942,6 +1042,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/leave",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Leave this organization? You will lose access to all of its resources.",
       successMessage: "You have left the organization",
       refreshAfter: true
@@ -963,6 +1064,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/cloud/organizations/{id}/change-slug",
       method: "POST",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
       successMessage: "Organization slug changed",
       refreshAfter: true,
@@ -1061,7 +1163,10 @@ var SysMember = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization membership records",
-  titleFormat: "{user_id} in {organization_id}",
+  // Org-independent title: organization_id is null in single-org mode, so a
+  // '{user_id} in {organization_id}' format renders "… in null". User + role
+  // identifies the membership in both single- and multi-org deployments.
+  titleFormat: "{user_id} ({role})",
   compactLayout: ["user_id", "organization_id", "role"],
   // Row-level actions: better-auth `organization/update-member-role` and
   // `organization/remove-member`. Generic CRUD is suppressed on better-auth
@@ -1082,6 +1187,11 @@ var SysMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
+      // Org-membership mutations are multi-org-only: the better-auth
+      // endpoints resolve an active org that does not exist in single-org
+      // mode, so these actions would fail at the API. Gate every one on
+      // the multi-org flag (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1099,6 +1209,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1115,6 +1226,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1136,7 +1248,7 @@ var SysMember = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner'",
+      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1221,7 +1333,10 @@ var SysInvitation = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization invitations for user onboarding",
-  titleFormat: "Invitation to {organization_id}",
+  // Title by invitee email rather than organization_id: the latter is null in
+  // single-org mode (renders "Invitation to null"), and the recipient email is
+  // the more useful identifier in both modes anyway.
+  titleFormat: "Invitation for {email}",
   compactLayout: ["email", "organization_id", "status"],
   // Custom actions — generic CRUD is suppressed (better-auth-managed).
   // Mirror the `invite_user` toolbar action from sys_user here so admins
@@ -1235,6 +1350,13 @@ var SysInvitation = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Inviting/managing invitations is a multi-org-only flow (the
+      // endpoint resolves an active org absent in single-org mode). Gate
+      // the admin-side actions on the multi-org flag (mirrors
+      // sys_organization.create_organization). The recipient-side
+      // accept/reject actions below stay record-gated — they are
+      // unreachable in single-org anyway (no invitation rows exist).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1252,6 +1374,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1265,6 +1388,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1449,6 +1573,10 @@ var SysTeam = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/create-team",
+      // Teams are nested inside organizations — a multi-org-only concept.
+      // Gate every team mutation on the multi-org flag so the affordances
+      // disappear in single-org (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1469,6 +1597,7 @@ var SysTeam = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1487,6 +1616,7 @@ var SysTeam = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1597,6 +1727,10 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-team-member",
+      // Team membership lives under organizations — multi-org-only. Gate
+      // both mutations so they vanish in single-org (mirrors
+      // sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1617,6 +1751,7 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -3156,6 +3291,224 @@ var SysJwks = data.ObjectSchema.create({
     mru: false
   }
 });
+var SysSsoProvider = data.ObjectSchema.create({
+  name: "sys_sso_provider",
+  label: "SSO Provider",
+  pluralLabel: "SSO Providers",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/sso) \u2014 see ADR-0024.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "issuer", "domain"],
+  // All mutations go through @better-auth/sso's endpoints under
+  // /api/v1/auth/sso/* (register / delete-provider) rather than the generic
+  // data layer, so server-side config validation + secret handling run.
+  actions: [
+    {
+      name: "register_sso_provider",
+      label: "Register SSO Provider",
+      icon: "plus-circle",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/auth/sso/register",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "okta" or "acme-entra".' },
+        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer / discovery base, e.g. https://acme.okta.com." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP." },
+        { name: "clientId", label: "Client ID", type: "text", required: true },
+        { name: "clientSecret", label: "Client Secret", type: "text", required: true }
+      ]
+    },
+    {
+      name: "delete_sso_provider",
+      label: "Delete SSO Provider",
+      icon: "trash-2",
+      variant: "danger",
+      mode: "delete",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/auth/sso/delete-provider",
+      confirmText: "Delete this SSO provider? Users from its domain will no longer be able to sign in through it.",
+      successMessage: "SSO provider deleted",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
+      ]
+    }
+  ],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_sso_provider" },
+      columns: ["provider_id", "issuer", "domain", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Stable provider identifier (unique within the environment)",
+      group: "Identity"
+    }),
+    issuer: data.Field.text({
+      label: "Issuer",
+      required: true,
+      maxLength: 2048,
+      description: "IdP issuer URL",
+      group: "Identity"
+    }),
+    domain: data.Field.text({
+      label: "Email Domain",
+      required: true,
+      maxLength: 255,
+      description: "Email domain routed to this IdP (e.g. acme.com)",
+      group: "Identity"
+    }),
+    oidc_config: data.Field.textarea({
+      label: "OIDC Config",
+      required: false,
+      description: "JSON: clientId, clientSecret, endpoints, scopes, mapping, pkce (managed by better-auth)",
+      group: "Protocol"
+    }),
+    saml_config: data.Field.textarea({
+      label: "SAML Config",
+      required: false,
+      description: "JSON: entryPoint, cert, identifierFormat, mapping (managed by better-auth)",
+      group: "Protocol"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Registered By",
+      required: false,
+      description: "User who registered this provider",
+      group: "System"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope (when org-scoped SSO is used)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["domain"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    // Mutations go through /api/v1/auth/sso/* (register / delete-provider);
+    // the generic data layer is read-only so sysadmins cannot bypass
+    // server-side validation / secret handling.
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false
+  }
+});
+var SysScimProvider = data.ObjectSchema.create({
+  name: "sys_scim_provider",
+  label: "SCIM Provider",
+  pluralLabel: "SCIM Providers",
+  icon: "users",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/scim) \u2014 see ADR-0071.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment's users",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "organization_id"],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_scim_provider" },
+      // scim_token is intentionally excluded — never surface the credential.
+      columns: ["provider_id", "organization_id", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: 'Stable SCIM provider identifier (e.g. "okta-scim")',
+      group: "Identity"
+    }),
+    scim_token: data.Field.text({
+      label: "SCIM Token (hash)",
+      required: false,
+      readonly: true,
+      maxLength: 1024,
+      description: "Hashed bearer credential for this SCIM connection \u2014 the plaintext is shown once at generate-token. Sensitive; do not expose.",
+      group: "Secret"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope of this token (org-scoped tokens restrict provisioning to that org)",
+      group: "System"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Owned By",
+      required: false,
+      description: "User who generated this token (when provider-ownership is enabled)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["organization_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    // Mutations + token issuance go through @better-auth/scim's endpoints
+    // under /api/v1/auth/scim/*; the generic data layer is read-only so the
+    // credential cannot be written/bypassed through it.
+    apiMethods: ["list"],
+    trash: false,
+    mru: false
+  }
+});
 
 exports.SysAccount = SysAccount;
 exports.SysApiKey = SysApiKey;
@@ -3170,7 +3523,9 @@ exports.SysOauthApplication = SysOauthApplication;
 exports.SysOauthConsent = SysOauthConsent;
 exports.SysOauthRefreshToken = SysOauthRefreshToken;
 exports.SysOrganization = SysOrganization;
+exports.SysScimProvider = SysScimProvider;
 exports.SysSession = SysSession;
+exports.SysSsoProvider = SysSsoProvider;
 exports.SysTeam = SysTeam;
 exports.SysTeamMember = SysTeamMember;
 exports.SysTwoFactor = SysTwoFactor;