@objectstack/platform-objects 11.0.0 → 11.1.0

package/dist/identity/index.mjs

@@ -420,6 +420,25 @@ var SysUser = ObjectSchema.create({
       group: "Admin",
       description: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
     }),
+    // ADR-0069 D1 — last password change; drives password-expiry enforcement.
+    // Stamped on sign-up / change-password / reset-password. Null = never
+    // expires (until the user next changes their password).
+    password_changed_at: Field.datetime({
+      label: "Password Changed At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+    }),
+    // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
+    // grace clock. Stamped lazily at session validation; system-managed.
+    mfa_required_at: Field.datetime({
+      label: "MFA Required At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+    }),
     ai_access: Field.boolean({
       label: "AI Access",
       defaultValue: false,
@@ -592,6 +611,29 @@ var SysSession = ObjectSchema.create({
       required: true,
       group: "Session"
     }),
+    // ── ADR-0069 D4 — session controls (idle / absolute / revoke) ──
+    last_activity_at: Field.datetime({
+      label: "Last Activity At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+    }),
+    revoked_at: Field.datetime({
+      label: "Revoked At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+    }),
+    revoke_reason: Field.text({
+      label: "Revoke Reason",
+      required: false,
+      maxLength: 64,
+      readonly: true,
+      group: "Session",
+      description: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+    }),
     // ── Active context (multi-org/team) ──────────────────────────
     active_organization_id: Field.lookup("sys_organization", {
       label: "Active Organization",
@@ -1112,6 +1154,17 @@ var SysOrganization = ObjectSchema.create({
       description: "JSON-serialized organization metadata",
       group: "Configuration"
     }),
+    // ADR-0069 D3 — per-org MFA tightening above the global floor. When true,
+    // members of this org must enrol TOTP to access data (enforced at the
+    // session-validation gate). An org can only tighten, never loosen, the
+    // global `mfa_required` setting.
+    require_mfa: Field.boolean({
+      label: "Require Multi-Factor Auth",
+      required: false,
+      defaultValue: false,
+      group: "Configuration",
+      description: "When true, every member of this organization must enroll an authenticator app to access data."
+    }),
     // ── System ───────────────────────────────────────────────────
     id: Field.text({
       label: "Organization ID",
@@ -3296,6 +3349,22 @@ var SysSsoProvider = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0024 — env-global, ADMIN-ONLY identity config. Two orthogonal controls:
+  //   • `tenancy.enabled: false` — the env IS the tenant; providers are env-wide,
+  //     not org-partitioned. Opting out of multi-tenancy lets a platform admin's
+  //     `viewAllRecords` superuser bypass see every provider (without it, the
+  //     `member_default` wildcard `tenant_isolation` RLS denies every row, since
+  //     better-auth writes via its adapter with no tenantId → `organization_id`
+  //     is never stamped).
+  //   • `requiredPermissions: ['manage_platform_settings']` — object-level
+  //     capability gate (ADR-0066 D3) so ordinary members are denied entirely
+  //     (without it, tenancy-disabled + `member_default`'s `'*': allowRead` would
+  //     leak providers to every authenticated user).
+  // Together: admins see all env providers; non-admins get 403. better-auth's
+  // own endpoints already read via a system context. (Env-only object — no
+  // control-plane cross-tenant risk.)
+  tenancy: { enabled: false, strategy: "shared" },
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",
@@ -3319,14 +3388,101 @@ var SysSsoProvider = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       method: "POST",
-      target: "/api/v1/auth/sso/register",
+      // Routed through the env-side bridge (plugin-auth `auth-plugin.ts`), which
+      // reshapes these FLAT form fields into the nested `oidcConfig` body that
+      // `@better-auth/sso`'s /sso/register requires, then re-dispatches to it
+      // (so the admin gate + discovery hydration run). Posting straight to
+      // /sso/register would drop clientId/clientSecret (top-level → Zod-stripped)
+      // and persist an unusable `oidc_config = null` provider.
+      target: "/api/v1/auth/admin/sso/register",
       refreshAfter: true,
       params: [
         { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "okta" or "acme-entra".' },
-        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer / discovery base, e.g. https://acme.okta.com." },
-        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP." },
-        { name: "clientId", label: "Client ID", type: "text", required: true },
-        { name: "clientSecret", label: "Client Secret", type: "text", required: true }
+        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer, e.g. https://acme.okta.com. Discovery is fetched from here unless an explicit URL is given below." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "clientId", label: "Client ID", type: "text", required: true, helpText: "OAuth client ID issued by the IdP for this environment." },
+        { name: "clientSecret", label: "Client Secret", type: "text", required: true, helpText: "OAuth client secret (stored encrypted by better-auth)." },
+        { name: "discoveryEndpoint", label: "Discovery URL", type: "text", required: false, helpText: "Optional. OIDC discovery document URL. Leave blank to derive `<issuer>/.well-known/openid-configuration`." },
+        { name: "scopes", label: "Scopes", type: "text", required: false, placeholder: "openid email profile", helpText: 'Optional. Space- or comma-separated OAuth scopes. Defaults to "openid email profile".' },
+        { name: "mapId", label: "Map: User ID claim", type: "text", required: false, placeholder: "sub", helpText: 'Optional. ID-token claim mapped to the user ID. Defaults to "sub".' },
+        { name: "mapEmail", label: "Map: Email claim", type: "text", required: false, placeholder: "email", helpText: 'Optional. Claim mapped to email. Defaults to "email".' },
+        { name: "mapName", label: "Map: Name claim", type: "text", required: false, placeholder: "name", helpText: 'Optional. Claim mapped to display name. Defaults to "name".' }
+      ]
+    },
+    {
+      name: "register_saml_provider",
+      label: "Register SAML Provider",
+      icon: "shield",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      // SAML 2.0 via @better-auth/sso (samlify-backed). Routed through the
+      // env-side bridge (plugin-auth `auth-plugin.ts` → register-saml), which
+      // reshapes these FLAT IdP fields into the nested `samlConfig` body that
+      // @better-auth/sso's /sso/register requires (entryPoint/cert/callbackUrl/
+      // spMetadata/identifierFormat), derives the per-provider ACS URL, and
+      // re-dispatches to /sso/register (admin gate runs). The response returns
+      // the SP ACS + metadata URLs to configure on the IdP.
+      target: "/api/v1/auth/admin/sso/register-saml",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "acme-saml".' },
+        { name: "issuer", label: "IdP Entity ID", type: "text", required: true, helpText: "The IdP\u2019s SAML EntityID (issuer), e.g. https://saml.acme.com/entityid." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "entryPoint", label: "IdP SSO URL", type: "text", required: true, helpText: "The IdP\u2019s SAML single sign-on (redirect) endpoint that receives the SAMLRequest." },
+        { name: "cert", label: "IdP Signing Certificate", type: "textarea", required: true, helpText: "The IdP\u2019s X.509 signing certificate (PEM body). Used to verify assertion signatures." },
+        { name: "identifierFormat", label: "NameID Format", type: "text", required: false, placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", helpText: "Optional. Requested SAML NameID format. Defaults to the IdP\u2019s configured format." }
+      ]
+    },
+    {
+      name: "request_domain_verification",
+      label: "Request Domain Verification",
+      icon: "globe",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ② (opt-in OS_SSO_DOMAIN_VERIFICATION). Asks @better-auth/sso
+      // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
+      // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
+      // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
+      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
+      // the dialog reads. When the feature is OFF the bridge returns a clear
+      // "not enabled for this environment" error instead of a bare 404.
+      target: "/api/v1/auth/admin/sso/request-domain-verification",
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
+        { name: "domain", field: "domain", defaultFromRow: true, required: false }
+      ],
+      resultDialog: {
+        title: "Verify your domain",
+        description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
+        acknowledge: "Done",
+        fields: [
+          { path: "data.dnsRecordType", label: "Record type", format: "text" },
+          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+        ]
+      }
+    },
+    {
+      name: "verify_domain",
+      label: "Verify Domain",
+      icon: "shield-check",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ②. Re-checks the DNS-TXT record and flips `domain_verified`
+      // on success. Routed through the env bridge, which maps @better-auth/sso's
+      // empty 204 / 502 into a clear success/error toast.
+      target: "/api/v1/auth/admin/sso/verify-domain",
+      successMessage: "Domain ownership verified",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
       ]
     },
     {
@@ -3353,9 +3509,17 @@ var SysSsoProvider = ObjectSchema.create({
       name: "all",
       label: "All",
       data: { provider: "object", object: "sys_sso_provider" },
-      columns: ["provider_id", "issuer", "domain", "created_at"],
+      columns: ["provider_id", "issuer", "domain", "domain_verified", "created_at"],
       sort: [{ field: "provider_id", order: "asc" }],
-      pagination: { pageSize: 50 }
+      pagination: { pageSize: 50 },
+      // Per-object empty state — the shared identity-object copy ("created
+      // automatically … cannot be added here") is wrong for this object, which
+      // HAS a "Register SSO Provider" action. Point admins at it instead.
+      emptyState: {
+        title: "No SSO providers yet",
+        message: "Register your organization\u2019s external IdP \u2014 OIDC (Okta, Entra, Auth0, \u2026) with \u201CRegister SSO Provider\u201D, or SAML 2.0 with \u201CRegister SAML Provider\u201D. Members whose email domain matches can then sign in through it.",
+        icon: "log-in"
+      }
     }
   },
   fields: {
@@ -3382,6 +3546,13 @@ var SysSsoProvider = ObjectSchema.create({
       description: "Email domain routed to this IdP (e.g. acme.com)",
       group: "Identity"
     }),
+    domain_verified: Field.boolean({
+      label: "Domain Verified",
+      defaultValue: false,
+      readonly: true,
+      description: "Whether DNS ownership of the email domain has been proven (ADR-0024 \u2461). Set by \u201CVerify Domain\u201D after the DNS TXT record resolves. Managed by better-auth \u2014 not directly editable. Only enforced when domain verification is enabled for the environment.",
+      group: "Identity"
+    }),
     oidc_config: Field.textarea({
       label: "OIDC Config",
       required: false,