@objectstack/platform-objects 10.3.0 → 11.1.0

package/dist/identity/index.js

@@ -35,6 +35,13 @@ var SysUser = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Org invitations are a multi-org-only flow (the endpoint resolves
+      // an active org that does not exist in single-org mode). Hide the
+      // affordance unless multi-org is enabled — matching the
+      // `create_organization` gate on sys_organization. This action is the
+      // most exposed of the set because the Users list is always reachable
+      // in single-org, unlike the org/membership lists.
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -78,6 +85,21 @@ var SysUser = data.ObjectSchema.create({
       successMessage: "User unbanned",
       refreshAfter: true
     },
+    {
+      // ADR-0069 D2 — clear a brute-force lockout early (locked_until auto-
+      // expires, but an admin can release a user immediately). Hits the
+      // plugin-auth custom route, which is admin-guarded server-side.
+      name: "unlock_user",
+      label: "Unlock Account",
+      icon: "lock-open",
+      variant: "secondary",
+      locations: ["list_item"],
+      type: "api",
+      target: "/api/v1/auth/admin/unlock-user",
+      recordIdParam: "userId",
+      successMessage: "Account unlocked",
+      refreshAfter: true
+    },
     {
       name: "set_user_password",
       label: "Set Password",
@@ -154,7 +176,11 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-password",
-      visible: "record.id == ctx.user.id",
+      // Managed (IdP-provisioned) users hold no local credential — hide the
+      // password form so they can't self-mint a password that bypasses
+      // enforced SSO. The break-glass owner (env-native, or flipped back when
+      // their break-glass password is set) keeps it. ADR-0024 D4/D5.2.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Password changed",
       refreshAfter: false,
       params: [
@@ -171,7 +197,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_header", "record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/change-email",
-      visible: "record.id == ctx.user.id",
+      // A managed user's email is owned by the IdP — a local change would
+      // desync. Hide for IdP-provisioned; env-native users keep it.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       successMessage: "Verification email sent \u2014 check the new address to confirm.",
       refreshAfter: false,
       params: [
@@ -202,7 +230,9 @@ var SysUser = data.ObjectSchema.create({
       locations: ["record_more", "record_section"],
       type: "api",
       target: "/api/v1/auth/delete-user",
-      visible: "record.id == ctx.user.id",
+      // Self-delete needs a local password; managed users are deprovisioned
+      // via the IdP (org-removal / SCIM), not local self-service. Hide for them.
+      visible: 'record.id == ctx.user.id && record.source != "idp_provisioned"',
       confirmText: "Permanently delete your account? This cannot be undone \u2014 all your sessions will be terminated and all data you own will be removed per the configured retention policy.",
       successMessage: "Account deleted",
       refreshAfter: false,
@@ -285,7 +315,7 @@ var SysUser = data.ObjectSchema.create({
       name: "all_users",
       label: "All Users",
       data: { provider: "object", object: "sys_user" },
-      columns: ["name", "email", "email_verified", "two_factor_enabled", "created_at"],
+      columns: ["name", "email", "email_verified", "source", "two_factor_enabled", "created_at"],
       sort: [{ field: "name", order: "asc" }],
       pagination: { pageSize: 50 }
     },
@@ -372,6 +402,51 @@ var SysUser = data.ObjectSchema.create({
       group: "Admin",
       description: "When set, the ban auto-clears at this time."
     }),
+    // ── Anti-brute-force (ADR-0069 D2) — owned by objectql, better-auth is
+    //    oblivious. The auth manager's sign-in hooks maintain these: failures
+    //    increment the counter; crossing `lockout_threshold` stamps
+    //    `locked_until`; a successful sign-in resets both. Admins can clear
+    //    them early via the Unlock action.
+    failed_login_count: data.Field.number({
+      label: "Failed Login Count",
+      required: false,
+      defaultValue: 0,
+      readonly: true,
+      group: "Admin",
+      description: "Consecutive failed sign-in attempts; reset to 0 on success. Maintained by the auth manager."
+    }),
+    locked_until: data.Field.datetime({
+      label: "Locked Until",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
+    }),
+    // ADR-0069 D1 — last password change; drives password-expiry enforcement.
+    // Stamped on sign-up / change-password / reset-password. Null = never
+    // expires (until the user next changes their password).
+    password_changed_at: data.Field.datetime({
+      label: "Password Changed At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+    }),
+    // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
+    // grace clock. Stamped lazily at session validation; system-managed.
+    mfa_required_at: data.Field.datetime({
+      label: "MFA Required At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+    }),
+    ai_access: data.Field.boolean({
+      label: "AI Access",
+      defaultValue: false,
+      group: "Admin",
+      description: "Whether this user holds an AI seat \u2014 grants access to the in-UI AI agents (build / ask). The framework synthesizes the `ai_seat` capability from this flag (plugin-hono-server resolveCtx). Assignment is capped by the licensed / purchased seat count (enforced by @objectstack/security-enterprise AiSeatPlugin). Owned by objectql (better-auth is oblivious to this column)."
+    }),
     // ── Profile ──────────────────────────────────────────────────
     image: data.Field.url({
       label: "Profile Image",
@@ -392,6 +467,28 @@ var SysUser = data.ObjectSchema.create({
       description: "The user's primary business unit \u2014 a denormalised projection of sys_business_unit_member.is_primary, maintained by plugin-sharing (ADR-0057 addendum D12). Lets a user-lookup filter candidates by business unit without traversing the membership junction. Do not edit directly; set it via business-unit membership."
     }),
     // ── System (auto-managed, hidden from create/edit forms) ─────
+    // Identity provenance (ADR-0024 D4). `idp_provisioned` users were
+    // JIT-created on first federated login (a `sys_account` exists for an
+    // external/OIDC provider — e.g. the cloud-as-IdP `objectstack-cloud`
+    // provider, or a customer's own IdP); `env_native` users registered
+    // locally (email/password) or are app end-users. Stamped automatically by
+    // the AuthManager `account.create.after` hook — never edited by hand.
+    // Drives the managed-vs-native user-mgmt UI gating (the password /
+    // identity-edit actions hide for managed users, who hold no local
+    // credential) and is the marker SCIM lifecycle keys off. Owned by objectql
+    // (better-auth is oblivious to this column — like `ai_access`).
+    source: data.Field.select({
+      label: "Identity Source",
+      required: false,
+      readonly: true,
+      group: "System",
+      defaultValue: "env_native",
+      options: [
+        { label: "IdP-Provisioned", value: "idp_provisioned" },
+        { label: "Env-Native", value: "env_native" }
+      ],
+      description: "How this identity was created \u2014 idp_provisioned (federated SSO JIT) or env_native (local signup / app end-user). System-managed; do not edit."
+    }),
     id: data.Field.text({
       label: "User ID",
       required: true,
@@ -516,6 +613,29 @@ var SysSession = data.ObjectSchema.create({
       required: true,
       group: "Session"
     }),
+    // ── ADR-0069 D4 — session controls (idle / absolute / revoke) ──
+    last_activity_at: data.Field.datetime({
+      label: "Last Activity At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+    }),
+    revoked_at: data.Field.datetime({
+      label: "Revoked At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+    }),
+    revoke_reason: data.Field.text({
+      label: "Revoke Reason",
+      required: false,
+      maxLength: 64,
+      readonly: true,
+      group: "Session",
+      description: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+    }),
     // ── Active context (multi-org/team) ──────────────────────────
     active_organization_id: data.Field.lookup("sys_organization", {
       label: "Active Organization",
@@ -757,6 +877,16 @@ var SysAccount = data.ObjectSchema.create({
       label: "Password Hash",
       required: false,
       description: "Hashed password for email/password provider"
+    }),
+    // ADR-0069 D1 — bounded ring of previous password hashes (JSON array of
+    // strings), used to reject password reuse on change/reset. Maintained by
+    // the auth manager; never exposed in UI.
+    previous_password_hashes: data.Field.textarea({
+      label: "Previous Password Hashes",
+      required: false,
+      readonly: true,
+      hidden: true,
+      description: "JSON array of prior password hashes (bounded by password_history_count); reuse-prevention only. System-managed."
     })
   },
   indexes: [
@@ -822,7 +952,13 @@ var SysVerification = data.ObjectSchema.create({
     })
   },
   indexes: [
-    { fields: ["value"], unique: true },
+    // `value` must NOT be unique. better-auth's oauth-provider stores OIDC
+    // authorization codes in this table with `value` = a JSON blob keyed by
+    // user+client+state, which can legitimately repeat. A UNIQUE constraint
+    // makes `/api/v1/auth/oauth2/authorize` fail (`UNIQUE constraint failed:
+    // sys_verification.value`) → 503, breaking cloud-as-IdP SSO entirely.
+    // better-auth keys verification lookups on `identifier`, not `value`.
+    { fields: ["value"], unique: false },
     { fields: ["identifier"], unique: false },
     { fields: ["expires_at"], unique: false }
   ],
@@ -890,6 +1026,10 @@ var SysOrganization = data.ObjectSchema.create({
       recordIdParam: "organizationId",
       // better-auth `organization/update` nests editable fields under `data`.
       bodyShape: { wrap: "data" },
+      // Org-admin actions are multi-org-only; hide them in single-org for
+      // consistency with `create_organization` (the org list is empty there,
+      // but this also guards direct record-URL access).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Organization updated",
       refreshAfter: true,
       params: [
@@ -908,6 +1048,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/delete",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this organization? All members will lose access immediately. This cannot be undone.",
       successMessage: "Organization deleted",
       refreshAfter: true
@@ -926,6 +1067,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/set-active",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Active organization switched",
       refreshAfter: true
     },
@@ -942,6 +1084,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/leave",
       recordIdParam: "organizationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Leave this organization? You will lose access to all of its resources.",
       successMessage: "You have left the organization",
       refreshAfter: true
@@ -963,6 +1106,7 @@ var SysOrganization = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/cloud/organizations/{id}/change-slug",
       method: "POST",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Renaming the slug rewrites every platform subdomain for this org and parks the old slug for 90 days. Continue?",
       successMessage: "Organization slug changed",
       refreshAfter: true,
@@ -1012,6 +1156,17 @@ var SysOrganization = data.ObjectSchema.create({
       description: "JSON-serialized organization metadata",
       group: "Configuration"
     }),
+    // ADR-0069 D3 — per-org MFA tightening above the global floor. When true,
+    // members of this org must enrol TOTP to access data (enforced at the
+    // session-validation gate). An org can only tighten, never loosen, the
+    // global `mfa_required` setting.
+    require_mfa: data.Field.boolean({
+      label: "Require Multi-Factor Auth",
+      required: false,
+      defaultValue: false,
+      group: "Configuration",
+      description: "When true, every member of this organization must enroll an authenticator app to access data."
+    }),
     // ── System ───────────────────────────────────────────────────
     id: data.Field.text({
       label: "Organization ID",
@@ -1061,7 +1216,10 @@ var SysMember = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization membership records",
-  titleFormat: "{user_id} in {organization_id}",
+  // Org-independent title: organization_id is null in single-org mode, so a
+  // '{user_id} in {organization_id}' format renders "… in null". User + role
+  // identifies the membership in both single- and multi-org deployments.
+  titleFormat: "{user_id} ({role})",
   compactLayout: ["user_id", "organization_id", "role"],
   // Row-level actions: better-auth `organization/update-member-role` and
   // `organization/remove-member`. Generic CRUD is suppressed on better-auth
@@ -1082,6 +1240,11 @@ var SysMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-member",
+      // Org-membership mutations are multi-org-only: the better-auth
+      // endpoints resolve an active org that does not exist in single-org
+      // mode, so these actions would fail at the API. Gate every one on
+      // the multi-org flag (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member added",
       refreshAfter: true,
       params: [
@@ -1099,6 +1262,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Member role updated",
       refreshAfter: true,
       params: [
@@ -1115,6 +1279,7 @@ var SysMember = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-member",
       recordIdParam: "memberIdOrEmail",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this member from the organization? They will lose access to all org resources.",
       successMessage: "Member removed",
       refreshAfter: true
@@ -1136,7 +1301,7 @@ var SysMember = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-member-role",
       recordIdParam: "memberId",
       bodyExtra: { role: "owner" },
-      visible: "record.role != 'owner'",
+      visible: "record.role != 'owner' && features.multiOrgEnabled != false",
       confirmText: "Transfer ownership of this organization to the selected member? You will be demoted to admin and lose owner-only privileges.",
       successMessage: "Ownership transferred",
       refreshAfter: true
@@ -1221,7 +1386,10 @@ var SysInvitation = data.ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "Organization invitations for user onboarding",
-  titleFormat: "Invitation to {organization_id}",
+  // Title by invitee email rather than organization_id: the latter is null in
+  // single-org mode (renders "Invitation to null"), and the recipient email is
+  // the more useful identifier in both modes anyway.
+  titleFormat: "Invitation for {email}",
   compactLayout: ["email", "organization_id", "status"],
   // Custom actions — generic CRUD is suppressed (better-auth-managed).
   // Mirror the `invite_user` toolbar action from sys_user here so admins
@@ -1235,6 +1403,13 @@ var SysInvitation = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
+      // Inviting/managing invitations is a multi-org-only flow (the
+      // endpoint resolves an active org absent in single-org mode). Gate
+      // the admin-side actions on the multi-org flag (mirrors
+      // sys_organization.create_organization). The recipient-side
+      // accept/reject actions below stay record-gated — they are
+      // unreachable in single-org anyway (no invitation rows exist).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation sent",
       refreshAfter: true,
       params: [
@@ -1252,6 +1427,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/cancel-invitation",
       recordIdParam: "invitationId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Cancel this invitation? The recipient will no longer be able to accept it.",
       successMessage: "Invitation canceled",
       refreshAfter: true
@@ -1265,6 +1441,7 @@ var SysInvitation = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/invite-member",
       bodyExtra: { resend: true },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Invitation resent",
       refreshAfter: true,
       params: [
@@ -1449,6 +1626,10 @@ var SysTeam = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/create-team",
+      // Teams are nested inside organizations — a multi-org-only concept.
+      // Gate every team mutation on the multi-org flag so the affordances
+      // disappear in single-org (mirrors sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team created",
       refreshAfter: true,
       params: [
@@ -1469,6 +1650,7 @@ var SysTeam = data.ObjectSchema.create({
       target: "/api/v1/auth/organization/update-team",
       recordIdParam: "teamId",
       bodyShape: { wrap: "data" },
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team updated",
       refreshAfter: true,
       params: [
@@ -1487,6 +1669,7 @@ var SysTeam = data.ObjectSchema.create({
       type: "api",
       target: "/api/v1/auth/organization/remove-team",
       recordIdParam: "teamId",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Delete this team? Members will lose any team-scoped access. This cannot be undone.",
       successMessage: "Team deleted",
       refreshAfter: true
@@ -1597,6 +1780,10 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       target: "/api/v1/auth/organization/add-team-member",
+      // Team membership lives under organizations — multi-org-only. Gate
+      // both mutations so they vanish in single-org (mirrors
+      // sys_organization.create_organization).
+      visible: "features.multiOrgEnabled != false",
       successMessage: "Team member added",
       refreshAfter: true,
       params: [
@@ -1617,6 +1804,7 @@ var SysTeamMember = data.ObjectSchema.create({
       locations: ["list_item"],
       type: "api",
       target: "/api/v1/auth/organization/remove-team-member",
+      visible: "features.multiOrgEnabled != false",
       confirmText: "Remove this user from the team? They will lose any team-scoped access.",
       successMessage: "Team member removed",
       refreshAfter: true,
@@ -3156,6 +3344,342 @@ var SysJwks = data.ObjectSchema.create({
     mru: false
   }
 });
+var SysSsoProvider = data.ObjectSchema.create({
+  name: "sys_sso_provider",
+  label: "SSO Provider",
+  pluralLabel: "SSO Providers",
+  icon: "shield-check",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0024 — env-global, ADMIN-ONLY identity config. Two orthogonal controls:
+  //   • `tenancy.enabled: false` — the env IS the tenant; providers are env-wide,
+  //     not org-partitioned. Opting out of multi-tenancy lets a platform admin's
+  //     `viewAllRecords` superuser bypass see every provider (without it, the
+  //     `member_default` wildcard `tenant_isolation` RLS denies every row, since
+  //     better-auth writes via its adapter with no tenantId → `organization_id`
+  //     is never stamped).
+  //   • `requiredPermissions: ['manage_platform_settings']` — object-level
+  //     capability gate (ADR-0066 D3) so ordinary members are denied entirely
+  //     (without it, tenancy-disabled + `member_default`'s `'*': allowRead` would
+  //     leak providers to every authenticated user).
+  // Together: admins see all env providers; non-admins get 403. better-auth's
+  // own endpoints already read via a system context. (Env-only object — no
+  // control-plane cross-tenant risk.)
+  tenancy: { enabled: false, strategy: "shared" },
+  requiredPermissions: ["manage_platform_settings"],
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/sso) \u2014 see ADR-0024.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "issuer", "domain"],
+  // All mutations go through @better-auth/sso's endpoints under
+  // /api/v1/auth/sso/* (register / delete-provider) rather than the generic
+  // data layer, so server-side config validation + secret handling run.
+  actions: [
+    {
+      name: "register_sso_provider",
+      label: "Register SSO Provider",
+      icon: "plus-circle",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      // Routed through the env-side bridge (plugin-auth `auth-plugin.ts`), which
+      // reshapes these FLAT form fields into the nested `oidcConfig` body that
+      // `@better-auth/sso`'s /sso/register requires, then re-dispatches to it
+      // (so the admin gate + discovery hydration run). Posting straight to
+      // /sso/register would drop clientId/clientSecret (top-level → Zod-stripped)
+      // and persist an unusable `oidc_config = null` provider.
+      target: "/api/v1/auth/admin/sso/register",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "okta" or "acme-entra".' },
+        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer, e.g. https://acme.okta.com. Discovery is fetched from here unless an explicit URL is given below." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "clientId", label: "Client ID", type: "text", required: true, helpText: "OAuth client ID issued by the IdP for this environment." },
+        { name: "clientSecret", label: "Client Secret", type: "text", required: true, helpText: "OAuth client secret (stored encrypted by better-auth)." },
+        { name: "discoveryEndpoint", label: "Discovery URL", type: "text", required: false, helpText: "Optional. OIDC discovery document URL. Leave blank to derive `<issuer>/.well-known/openid-configuration`." },
+        { name: "scopes", label: "Scopes", type: "text", required: false, placeholder: "openid email profile", helpText: 'Optional. Space- or comma-separated OAuth scopes. Defaults to "openid email profile".' },
+        { name: "mapId", label: "Map: User ID claim", type: "text", required: false, placeholder: "sub", helpText: 'Optional. ID-token claim mapped to the user ID. Defaults to "sub".' },
+        { name: "mapEmail", label: "Map: Email claim", type: "text", required: false, placeholder: "email", helpText: 'Optional. Claim mapped to email. Defaults to "email".' },
+        { name: "mapName", label: "Map: Name claim", type: "text", required: false, placeholder: "name", helpText: 'Optional. Claim mapped to display name. Defaults to "name".' }
+      ]
+    },
+    {
+      name: "register_saml_provider",
+      label: "Register SAML Provider",
+      icon: "shield",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      // SAML 2.0 via @better-auth/sso (samlify-backed). Routed through the
+      // env-side bridge (plugin-auth `auth-plugin.ts` → register-saml), which
+      // reshapes these FLAT IdP fields into the nested `samlConfig` body that
+      // @better-auth/sso's /sso/register requires (entryPoint/cert/callbackUrl/
+      // spMetadata/identifierFormat), derives the per-provider ACS URL, and
+      // re-dispatches to /sso/register (admin gate runs). The response returns
+      // the SP ACS + metadata URLs to configure on the IdP.
+      target: "/api/v1/auth/admin/sso/register-saml",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "acme-saml".' },
+        { name: "issuer", label: "IdP Entity ID", type: "text", required: true, helpText: "The IdP\u2019s SAML EntityID (issuer), e.g. https://saml.acme.com/entityid." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "entryPoint", label: "IdP SSO URL", type: "text", required: true, helpText: "The IdP\u2019s SAML single sign-on (redirect) endpoint that receives the SAMLRequest." },
+        { name: "cert", label: "IdP Signing Certificate", type: "textarea", required: true, helpText: "The IdP\u2019s X.509 signing certificate (PEM body). Used to verify assertion signatures." },
+        { name: "identifierFormat", label: "NameID Format", type: "text", required: false, placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", helpText: "Optional. Requested SAML NameID format. Defaults to the IdP\u2019s configured format." }
+      ]
+    },
+    {
+      name: "request_domain_verification",
+      label: "Request Domain Verification",
+      icon: "globe",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ② (opt-in OS_SSO_DOMAIN_VERIFICATION). Asks @better-auth/sso
+      // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
+      // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
+      // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
+      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
+      // the dialog reads. When the feature is OFF the bridge returns a clear
+      // "not enabled for this environment" error instead of a bare 404.
+      target: "/api/v1/auth/admin/sso/request-domain-verification",
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
+        { name: "domain", field: "domain", defaultFromRow: true, required: false }
+      ],
+      resultDialog: {
+        title: "Verify your domain",
+        description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
+        acknowledge: "Done",
+        fields: [
+          { path: "data.dnsRecordType", label: "Record type", format: "text" },
+          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+        ]
+      }
+    },
+    {
+      name: "verify_domain",
+      label: "Verify Domain",
+      icon: "shield-check",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ②. Re-checks the DNS-TXT record and flips `domain_verified`
+      // on success. Routed through the env bridge, which maps @better-auth/sso's
+      // empty 204 / 502 into a clear success/error toast.
+      target: "/api/v1/auth/admin/sso/verify-domain",
+      successMessage: "Domain ownership verified",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
+      ]
+    },
+    {
+      name: "delete_sso_provider",
+      label: "Delete SSO Provider",
+      icon: "trash-2",
+      variant: "danger",
+      mode: "delete",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      target: "/api/v1/auth/sso/delete-provider",
+      confirmText: "Delete this SSO provider? Users from its domain will no longer be able to sign in through it.",
+      successMessage: "SSO provider deleted",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
+      ]
+    }
+  ],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_sso_provider" },
+      columns: ["provider_id", "issuer", "domain", "domain_verified", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 },
+      // Per-object empty state — the shared identity-object copy ("created
+      // automatically … cannot be added here") is wrong for this object, which
+      // HAS a "Register SSO Provider" action. Point admins at it instead.
+      emptyState: {
+        title: "No SSO providers yet",
+        message: "Register your organization\u2019s external IdP \u2014 OIDC (Okta, Entra, Auth0, \u2026) with \u201CRegister SSO Provider\u201D, or SAML 2.0 with \u201CRegister SAML Provider\u201D. Members whose email domain matches can then sign in through it.",
+        icon: "log-in"
+      }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: "Stable provider identifier (unique within the environment)",
+      group: "Identity"
+    }),
+    issuer: data.Field.text({
+      label: "Issuer",
+      required: true,
+      maxLength: 2048,
+      description: "IdP issuer URL",
+      group: "Identity"
+    }),
+    domain: data.Field.text({
+      label: "Email Domain",
+      required: true,
+      maxLength: 255,
+      description: "Email domain routed to this IdP (e.g. acme.com)",
+      group: "Identity"
+    }),
+    domain_verified: data.Field.boolean({
+      label: "Domain Verified",
+      defaultValue: false,
+      readonly: true,
+      description: "Whether DNS ownership of the email domain has been proven (ADR-0024 \u2461). Set by \u201CVerify Domain\u201D after the DNS TXT record resolves. Managed by better-auth \u2014 not directly editable. Only enforced when domain verification is enabled for the environment.",
+      group: "Identity"
+    }),
+    oidc_config: data.Field.textarea({
+      label: "OIDC Config",
+      required: false,
+      description: "JSON: clientId, clientSecret, endpoints, scopes, mapping, pkce (managed by better-auth)",
+      group: "Protocol"
+    }),
+    saml_config: data.Field.textarea({
+      label: "SAML Config",
+      required: false,
+      description: "JSON: entryPoint, cert, identifierFormat, mapping (managed by better-auth)",
+      group: "Protocol"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Registered By",
+      required: false,
+      description: "User who registered this provider",
+      group: "System"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope (when org-scoped SSO is used)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["domain"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    // Mutations go through /api/v1/auth/sso/* (register / delete-provider);
+    // the generic data layer is read-only so sysadmins cannot bypass
+    // server-side validation / secret handling.
+    apiMethods: ["get", "list"],
+    trash: false,
+    mru: false
+  }
+});
+var SysScimProvider = data.ObjectSchema.create({
+  name: "sys_scim_provider",
+  label: "SCIM Provider",
+  pluralLabel: "SCIM Providers",
+  icon: "users",
+  isSystem: true,
+  managedBy: "better-auth",
+  // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
+  protection: {
+    lock: "full",
+    reason: "Identity table managed by better-auth (@better-auth/scim) \u2014 see ADR-0071.",
+    docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
+  },
+  description: "SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment's users",
+  displayNameField: "provider_id",
+  titleFormat: "{provider_id}",
+  compactLayout: ["provider_id", "organization_id"],
+  listViews: {
+    all: {
+      type: "grid",
+      name: "all",
+      label: "All",
+      data: { provider: "object", object: "sys_scim_provider" },
+      // scim_token is intentionally excluded — never surface the credential.
+      columns: ["provider_id", "organization_id", "created_at"],
+      sort: [{ field: "provider_id", order: "asc" }],
+      pagination: { pageSize: 50 }
+    }
+  },
+  fields: {
+    id: data.Field.text({ label: "ID", required: true, readonly: true, group: "System" }),
+    provider_id: data.Field.text({
+      label: "Provider ID",
+      required: true,
+      searchable: true,
+      maxLength: 255,
+      description: 'Stable SCIM provider identifier (e.g. "okta-scim")',
+      group: "Identity"
+    }),
+    scim_token: data.Field.text({
+      label: "SCIM Token (hash)",
+      required: false,
+      readonly: true,
+      maxLength: 1024,
+      description: "Hashed bearer credential for this SCIM connection \u2014 the plaintext is shown once at generate-token. Sensitive; do not expose.",
+      group: "Secret"
+    }),
+    organization_id: data.Field.text({
+      label: "Organization",
+      required: false,
+      maxLength: 255,
+      description: "Organization scope of this token (org-scoped tokens restrict provisioning to that org)",
+      group: "System"
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "Owned By",
+      required: false,
+      description: "User who generated this token (when provider-ownership is enabled)",
+      group: "System"
+    }),
+    created_at: data.Field.datetime({ label: "Created At", defaultValue: "NOW()", readonly: true, group: "System" }),
+    updated_at: data.Field.datetime({ label: "Updated At", defaultValue: "NOW()", readonly: true, group: "System" })
+  },
+  indexes: [
+    { fields: ["provider_id"], unique: true },
+    { fields: ["organization_id"] },
+    { fields: ["user_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: false,
+    apiEnabled: true,
+    // Mutations + token issuance go through @better-auth/scim's endpoints
+    // under /api/v1/auth/scim/*; the generic data layer is read-only so the
+    // credential cannot be written/bypassed through it.
+    apiMethods: ["list"],
+    trash: false,
+    mru: false
+  }
+});
 
 exports.SysAccount = SysAccount;
 exports.SysApiKey = SysApiKey;
@@ -3170,7 +3694,9 @@ exports.SysOauthApplication = SysOauthApplication;
 exports.SysOauthConsent = SysOauthConsent;
 exports.SysOauthRefreshToken = SysOauthRefreshToken;
 exports.SysOrganization = SysOrganization;
+exports.SysScimProvider = SysScimProvider;
 exports.SysSession = SysSession;
+exports.SysSsoProvider = SysSsoProvider;
 exports.SysTeam = SysTeam;
 exports.SysTeamMember = SysTeamMember;
 exports.SysTwoFactor = SysTwoFactor;