@objectstack/platform-objects 11.0.0 → 11.2.0

package/dist/identity/index.mjs

@@ -16,6 +16,8 @@ var SysUser = ObjectSchema.create({
   },
   description: "User accounts for authentication",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "email", "email_verified"],
   // Custom actions — generic CRUD is suppressed because user accounts are
@@ -420,6 +422,25 @@ var SysUser = ObjectSchema.create({
       group: "Admin",
       description: "When set and in the future, sign-in is rejected (brute-force lockout). Auto-clears past this time; an admin can clear it early via Unlock."
     }),
+    // ADR-0069 D1 — last password change; drives password-expiry enforcement.
+    // Stamped on sign-up / change-password / reset-password. Null = never
+    // expires (until the user next changes their password).
+    password_changed_at: Field.datetime({
+      label: "Password Changed At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "Timestamp of the last password change. Backs password_expiry_days; system-managed."
+    }),
+    // ADR-0069 D3 — when enforced MFA first applied to this user; starts the
+    // grace clock. Stamped lazily at session validation; system-managed.
+    mfa_required_at: Field.datetime({
+      label: "MFA Required At",
+      required: false,
+      readonly: true,
+      group: "Admin",
+      description: "When enforced MFA first applied to this user (grace-period clock). Backs mfa_required; system-managed."
+    }),
     ai_access: Field.boolean({
       label: "AI Access",
       defaultValue: false,
@@ -521,6 +542,8 @@ var SysSession = ObjectSchema.create({
   },
   description: "Active user sessions",
   displayNameField: "user_id",
+  nameField: "user_id",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "Session \u2014 {user_id}",
   compactLayout: ["user_id", "ip_address", "expires_at"],
   // Custom actions — sessions are managed by better-auth (generic CRUD
@@ -592,6 +615,29 @@ var SysSession = ObjectSchema.create({
       required: true,
       group: "Session"
     }),
+    // ── ADR-0069 D4 — session controls (idle / absolute / revoke) ──
+    last_activity_at: Field.datetime({
+      label: "Last Activity At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "Timestamp of the last request on this session; drives idle-timeout. System-managed."
+    }),
+    revoked_at: Field.datetime({
+      label: "Revoked At",
+      required: false,
+      readonly: true,
+      group: "Session",
+      description: "When set, this session was revoked (idle / absolute-max / concurrent-cap / admin). System-managed."
+    }),
+    revoke_reason: Field.text({
+      label: "Revoke Reason",
+      required: false,
+      maxLength: 64,
+      readonly: true,
+      group: "Session",
+      description: "Why the session was revoked (idle_timeout, absolute_max, concurrent_cap, \u2026)."
+    }),
     // ── Active context (multi-org/team) ──────────────────────────
     active_organization_id: Field.lookup("sys_organization", {
       label: "Active Organization",
@@ -944,6 +990,8 @@ var SysOrganization = ObjectSchema.create({
   },
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "slug"],
   // Custom actions — generic CRUD is suppressed (better-auth-managed),
@@ -1112,6 +1160,17 @@ var SysOrganization = ObjectSchema.create({
       description: "JSON-serialized organization metadata",
       group: "Configuration"
     }),
+    // ADR-0069 D3 — per-org MFA tightening above the global floor. When true,
+    // members of this org must enrol TOTP to access data (enforced at the
+    // session-validation gate). An org can only tighten, never loosen, the
+    // global `mfa_required` setting.
+    require_mfa: Field.boolean({
+      label: "Require Multi-Factor Auth",
+      required: false,
+      defaultValue: false,
+      group: "Configuration",
+      description: "When true, every member of this organization must enroll an authenticator app to access data."
+    }),
     // ── System ───────────────────────────────────────────────────
     id: Field.text({
       label: "Organization ID",
@@ -1555,6 +1614,8 @@ var SysTeam = ObjectSchema.create({
   },
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "organization_id"],
   // Custom actions calling better-auth's team endpoints. Generic CRUD is
@@ -1801,6 +1862,8 @@ var SysBusinessUnit = ObjectSchema.create({
   managedBy: "platform",
   description: "Canonical Business Unit tree \u2014 hierarchical org/data-partition node (company / division / department / region / office). ADR-0057 D2.",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "kind", "parent_business_unit_id", "manager_user_id"],
   listViews: {
@@ -2074,6 +2137,8 @@ var SysApiKey = ObjectSchema.create({
   },
   description: "API keys for programmatic access",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "prefix", "user_id", "expires_at", "revoked"],
   // Custom actions — sys_api_key is managed-by 'better-auth' but the
@@ -2417,6 +2482,8 @@ var SysDeviceCode = ObjectSchema.create({
     docsUrl: "https://docs.objectstack.ai/adr/0010-metadata-protection"
   },
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
+  nameField: "user_code",
+  // [ADR-0079] canonical primary-title pointer (single-field titleFormat)
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
   fields: {
@@ -2510,6 +2577,8 @@ var SysUserPreference = ObjectSchema.create({
   // surface in Setup is a support/diagnostic view only.
   managedBy: "system",
   description: "Per-user key-value preferences (theme, locale, etc.)",
+  nameField: "key",
+  // [ADR-0079] canonical primary-title pointer (single-field titleFormat)
   titleFormat: "{key}",
   compactLayout: ["user_id", "key"],
   listViews: {
@@ -2605,6 +2674,8 @@ var SysOauthApplication = ObjectSchema.create({
   },
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
+  nameField: "name",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{name}",
   compactLayout: ["name", "client_id", "type", "disabled"],
   // Custom actions — all OAuth-application mutations are routed through
@@ -3296,6 +3367,22 @@ var SysSsoProvider = ObjectSchema.create({
   icon: "shield-check",
   isSystem: true,
   managedBy: "better-auth",
+  // ADR-0024 — env-global, ADMIN-ONLY identity config. Two orthogonal controls:
+  //   • `tenancy.enabled: false` — the env IS the tenant; providers are env-wide,
+  //     not org-partitioned. Opting out of multi-tenancy lets a platform admin's
+  //     `viewAllRecords` superuser bypass see every provider (without it, the
+  //     `member_default` wildcard `tenant_isolation` RLS denies every row, since
+  //     better-auth writes via its adapter with no tenantId → `organization_id`
+  //     is never stamped).
+  //   • `requiredPermissions: ['manage_platform_settings']` — object-level
+  //     capability gate (ADR-0066 D3) so ordinary members are denied entirely
+  //     (without it, tenancy-disabled + `member_default`'s `'*': allowRead` would
+  //     leak providers to every authenticated user).
+  // Together: admins see all env providers; non-admins get 403. better-auth's
+  // own endpoints already read via a system context. (Env-only object — no
+  // control-plane cross-tenant risk.)
+  tenancy: { enabled: false, strategy: "shared" },
+  requiredPermissions: ["manage_platform_settings"],
   // ADR-0010 §3.7 — managed by better-auth; tenants may not edit schema.
   protection: {
     lock: "full",
@@ -3304,6 +3391,8 @@ var SysSsoProvider = ObjectSchema.create({
   },
   description: "External SSO identity providers (OIDC / SAML) this environment federates login to",
   displayNameField: "provider_id",
+  nameField: "provider_id",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{provider_id}",
   compactLayout: ["provider_id", "issuer", "domain"],
   // All mutations go through @better-auth/sso's endpoints under
@@ -3319,14 +3408,101 @@ var SysSsoProvider = ObjectSchema.create({
       locations: ["list_toolbar"],
       type: "api",
       method: "POST",
-      target: "/api/v1/auth/sso/register",
+      // Routed through the env-side bridge (plugin-auth `auth-plugin.ts`), which
+      // reshapes these FLAT form fields into the nested `oidcConfig` body that
+      // `@better-auth/sso`'s /sso/register requires, then re-dispatches to it
+      // (so the admin gate + discovery hydration run). Posting straight to
+      // /sso/register would drop clientId/clientSecret (top-level → Zod-stripped)
+      // and persist an unusable `oidc_config = null` provider.
+      target: "/api/v1/auth/admin/sso/register",
       refreshAfter: true,
       params: [
         { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "okta" or "acme-entra".' },
-        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer / discovery base, e.g. https://acme.okta.com." },
-        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP." },
-        { name: "clientId", label: "Client ID", type: "text", required: true },
-        { name: "clientSecret", label: "Client Secret", type: "text", required: true }
+        { name: "issuer", label: "Issuer URL", type: "text", required: true, helpText: "IdP issuer, e.g. https://acme.okta.com. Discovery is fetched from here unless an explicit URL is given below." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "clientId", label: "Client ID", type: "text", required: true, helpText: "OAuth client ID issued by the IdP for this environment." },
+        { name: "clientSecret", label: "Client Secret", type: "text", required: true, helpText: "OAuth client secret (stored encrypted by better-auth)." },
+        { name: "discoveryEndpoint", label: "Discovery URL", type: "text", required: false, helpText: "Optional. OIDC discovery document URL. Leave blank to derive `<issuer>/.well-known/openid-configuration`." },
+        { name: "scopes", label: "Scopes", type: "text", required: false, placeholder: "openid email profile", helpText: 'Optional. Space- or comma-separated OAuth scopes. Defaults to "openid email profile".' },
+        { name: "mapId", label: "Map: User ID claim", type: "text", required: false, placeholder: "sub", helpText: 'Optional. ID-token claim mapped to the user ID. Defaults to "sub".' },
+        { name: "mapEmail", label: "Map: Email claim", type: "text", required: false, placeholder: "email", helpText: 'Optional. Claim mapped to email. Defaults to "email".' },
+        { name: "mapName", label: "Map: Name claim", type: "text", required: false, placeholder: "name", helpText: 'Optional. Claim mapped to display name. Defaults to "name".' }
+      ]
+    },
+    {
+      name: "register_saml_provider",
+      label: "Register SAML Provider",
+      icon: "shield",
+      variant: "primary",
+      mode: "create",
+      locations: ["list_toolbar"],
+      type: "api",
+      method: "POST",
+      // SAML 2.0 via @better-auth/sso (samlify-backed). Routed through the
+      // env-side bridge (plugin-auth `auth-plugin.ts` → register-saml), which
+      // reshapes these FLAT IdP fields into the nested `samlConfig` body that
+      // @better-auth/sso's /sso/register requires (entryPoint/cert/callbackUrl/
+      // spMetadata/identifierFormat), derives the per-provider ACS URL, and
+      // re-dispatches to /sso/register (admin gate runs). The response returns
+      // the SP ACS + metadata URLs to configure on the IdP.
+      target: "/api/v1/auth/admin/sso/register-saml",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", label: "Provider ID", type: "text", required: true, helpText: 'Stable identifier, e.g. "acme-saml".' },
+        { name: "issuer", label: "IdP Entity ID", type: "text", required: true, helpText: "The IdP\u2019s SAML EntityID (issuer), e.g. https://saml.acme.com/entityid." },
+        { name: "domain", label: "Email Domain", type: "text", required: true, helpText: "Users with this email domain are routed to this IdP, e.g. acme.com." },
+        { name: "entryPoint", label: "IdP SSO URL", type: "text", required: true, helpText: "The IdP\u2019s SAML single sign-on (redirect) endpoint that receives the SAMLRequest." },
+        { name: "cert", label: "IdP Signing Certificate", type: "textarea", required: true, helpText: "The IdP\u2019s X.509 signing certificate (PEM body). Used to verify assertion signatures." },
+        { name: "identifierFormat", label: "NameID Format", type: "text", required: false, placeholder: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", helpText: "Optional. Requested SAML NameID format. Defaults to the IdP\u2019s configured format." }
+      ]
+    },
+    {
+      name: "request_domain_verification",
+      label: "Request Domain Verification",
+      icon: "globe",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ② (opt-in OS_SSO_DOMAIN_VERIFICATION). Asks @better-auth/sso
+      // for a one-time DNS-TXT challenge and reveals the ready-to-paste record
+      // ONCE via `resultDialog`. Routed through the env bridge (plugin-auth /
+      // cloud AuthProxyPlugin) which reshapes the `{domainVerificationToken}`
+      // response into the `{ data: { dnsRecordName, dnsRecordValue } }` envelope
+      // the dialog reads. When the feature is OFF the bridge returns a clear
+      // "not enabled for this environment" error instead of a bare 404.
+      target: "/api/v1/auth/admin/sso/request-domain-verification",
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true },
+        { name: "domain", field: "domain", defaultFromRow: true, required: false }
+      ],
+      resultDialog: {
+        title: "Verify your domain",
+        description: "Add the DNS TXT record below at your domain\u2019s DNS provider, then run \u201CVerify Domain\u201D. The token is shown once.",
+        acknowledge: "Done",
+        fields: [
+          { path: "data.dnsRecordType", label: "Record type", format: "text" },
+          { path: "data.dnsRecordName", label: "Name / Host", format: "secret" },
+          { path: "data.dnsRecordValue", label: "Value", format: "secret" }
+        ]
+      }
+    },
+    {
+      name: "verify_domain",
+      label: "Verify Domain",
+      icon: "shield-check",
+      variant: "secondary",
+      locations: ["list_item", "record_header"],
+      type: "api",
+      method: "POST",
+      // ADR-0024 ②. Re-checks the DNS-TXT record and flips `domain_verified`
+      // on success. Routed through the env bridge, which maps @better-auth/sso's
+      // empty 204 / 502 into a clear success/error toast.
+      target: "/api/v1/auth/admin/sso/verify-domain",
+      successMessage: "Domain ownership verified",
+      refreshAfter: true,
+      params: [
+        { name: "providerId", field: "provider_id", defaultFromRow: true, required: true }
       ]
     },
     {
@@ -3353,9 +3529,17 @@ var SysSsoProvider = ObjectSchema.create({
       name: "all",
       label: "All",
       data: { provider: "object", object: "sys_sso_provider" },
-      columns: ["provider_id", "issuer", "domain", "created_at"],
+      columns: ["provider_id", "issuer", "domain", "domain_verified", "created_at"],
       sort: [{ field: "provider_id", order: "asc" }],
-      pagination: { pageSize: 50 }
+      pagination: { pageSize: 50 },
+      // Per-object empty state — the shared identity-object copy ("created
+      // automatically … cannot be added here") is wrong for this object, which
+      // HAS a "Register SSO Provider" action. Point admins at it instead.
+      emptyState: {
+        title: "No SSO providers yet",
+        message: "Register your organization\u2019s external IdP \u2014 OIDC (Okta, Entra, Auth0, \u2026) with \u201CRegister SSO Provider\u201D, or SAML 2.0 with \u201CRegister SAML Provider\u201D. Members whose email domain matches can then sign in through it.",
+        icon: "log-in"
+      }
     }
   },
   fields: {
@@ -3382,6 +3566,13 @@ var SysSsoProvider = ObjectSchema.create({
       description: "Email domain routed to this IdP (e.g. acme.com)",
       group: "Identity"
     }),
+    domain_verified: Field.boolean({
+      label: "Domain Verified",
+      defaultValue: false,
+      readonly: true,
+      description: "Whether DNS ownership of the email domain has been proven (ADR-0024 \u2461). Set by \u201CVerify Domain\u201D after the DNS TXT record resolves. Managed by better-auth \u2014 not directly editable. Only enforced when domain verification is enabled for the environment.",
+      group: "Identity"
+    }),
     oidc_config: Field.textarea({
       label: "OIDC Config",
       required: false,
@@ -3442,6 +3633,8 @@ var SysScimProvider = ObjectSchema.create({
   },
   description: "SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment's users",
   displayNameField: "provider_id",
+  nameField: "provider_id",
+  // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
   titleFormat: "{provider_id}",
   compactLayout: ["provider_id", "organization_id"],
   listViews: {