@oneuptime/common 12.0.13 → 12.0.15

package/build/dist/Server/Services/GlobalOidcProjectService.js

@@ -12,10 +12,82 @@ import Model from "../../Models/DatabaseModels/GlobalOidcProject";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, { resolveAttachmentProjectId, } from "../Utils/ValidateGlobalProviderProjectTeams";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, doAttachmentsGovernProject, globalProviderCacheKey, globalSsoAttachmentsCache, loadAttachmentsOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * Whether this provider's attachments cover `projectId`.
+     *
+     * Only consulted when the provider has `restrictToAttachedProjects` on -
+     * attachments are the PROVISIONING allow-list by default, not an access
+     * boundary, and reading them as one without the admin asking would lock
+     * existing users out of projects they legitimately reach.
+     *
+     * "No attachment rows at all" means instance-wide, matching the login
+     * router's default-all mode. "Rows exist but none are enabled" is a
+     * different answer and denies - otherwise an admin disabling the last
+     * attachment would WIDEN the provider to every project.
+     *
+     * Cached for 60s, with concurrent misses sharing one query.
+     */
+    async doesProviderGovernProject(data) {
+        const key = globalProviderCacheKey("oidc", data.globalOidcId);
+        const cached = globalSsoAttachmentsCache.get(key);
+        if (cached !== undefined) {
+            return doAttachmentsGovernProject(cached, data.projectId);
+        }
+        const attachments = await loadAttachmentsOnce(key, async () => {
+            /*
+             * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+             * as "this provider has attachments"; the enabled ones are selected
+             * out below.
+             */
+            const rows = await this.findBy({
+                query: { globalOidcId: data.globalOidcId },
+                select: { _id: true, projectId: true, isEnabled: true },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const loaded = {
+                hasAnyAttachmentRows: rows.length > 0,
+                enabledProjectIds: rows
+                    .filter((row) => {
+                    return Boolean(row.isEnabled) && Boolean(row.projectId);
+                })
+                    .map((row) => {
+                    return row.projectId.toString();
+                }),
+            };
+            globalSsoAttachmentsCache.set(key, loaded, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return loaded;
+        });
+        return doAttachmentsGovernProject(attachments, data.projectId);
+    }
+    async onBeforeDelete(deleteBy) {
+        // Detaching a project has to take effect now, not in 60s, on this node.
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    /*
+     * Cleared again AFTER the write commits. A clear that runs before the row
+     * lands can be immediately re-filled with the pre-change answer by a
+     * concurrent request, handing the old attachment set another full TTL.
+     */
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
     async onBeforeCreate(createBy) {
         /*
          * The attach form submits the project via the `project` relation, so the
@@ -30,6 +102,8 @@ export class Service extends DatabaseService {
             teams: createBy.data.teams,
             projectId,
         });
+        // A new attachment narrows (or widens) which projects the provider governs.
+        clearGlobalSsoAuthorizationCaches();
         return { createBy, carryForward: null };
     }
     async onBeforeUpdate(updateBy) {
@@ -61,9 +135,40 @@ export class Service extends DatabaseService {
                 }
             }
         }
+        clearGlobalSsoAuthorizationCaches();
         return { updateBy, carryForward: null };
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "doesProviderGovernProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/GlobalOidcProjectService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalOidcProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,+CAA+C,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAErD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AA/D0B;IADxB,WAAW,EAAE;;;;6CAuBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalOidcProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,+CAA+C,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAGzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CAAC,IAGtC;QACC,MAAM,GAAG,GAAW,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAEtE,MAAM,MAAM,GACV,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAA8B,MAAM,mBAAmB,CACtE,GAAG,EACH,KAAK,IAAwC,EAAE;YAC7C;;;;eAIG;YACH,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;gBAC1C,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAA8B;gBACxC,oBAAoB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;gBACrC,iBAAiB,EAAE,IAAI;qBACpB,MAAM,CAAC,CAAC,GAAU,EAAE,EAAE;oBACrB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1D,CAAC,CAAC;qBACD,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;oBAClB,OAAO,GAAG,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;gBACnC,CAAC,CAAC;aACL,CAAC;YAEF,yBAAyB,CAAC,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,qCAAqC,CACtC,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,OAAO,0BAA0B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,wEAAwE;QACxE,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEsB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,4EAA4E;QAC5E,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnKc;IADZ,WAAW,EAAE;;;;wDAoDb;AAGwB;IADxB,WAAW,EAAE;;;;6CAOb;AAQwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CA0Bb;AAGwB;IADxB,WAAW,EAAE;;;;6CAwCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/GlobalOidcService.js

@@ -1,9 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalOidc";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, globalProviderCacheKey, globalSsoProviderTrustCache, loadTrustOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * What the SSO-enforcement middleware needs to know about this provider:
+     * whether it is still usable at all, and whether the admin opted it into
+     * attachment-scoped access.
+     *
+     * Called on every authenticated request against an SSO-enforced project, so
+     * the answer is cached for 60s and concurrent misses share one query.
+     * Without this lookup, turning a provider off leaves every token it ever
+     * issued working until each one expires - up to thirty days.
+     */
+    async getProviderTrust(providerId) {
+        const key = globalProviderCacheKey("oidc", providerId);
+        const cached = globalSsoProviderTrustCache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        return loadTrustOnce(key, async () => {
+            const provider = await this.findOneBy({
+                query: { _id: providerId.toString() },
+                select: {
+                    _id: true,
+                    isEnabled: true,
+                    restrictToAttachedProjects: true,
+                },
+                props: { isRoot: true },
+            });
+            /*
+             * A deleted provider and a disabled one are the same answer: no. Both
+             * are cached, so a revoked provider does not cost a query per request.
+             */
+            const trust = {
+                isUsable: Boolean(provider && provider.isEnabled),
+                restrictToAttachedProjects: Boolean(provider && provider.restrictToAttachedProjects),
+            };
+            globalSsoProviderTrustCache.set(key, trust, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return trust;
+        });
+    }
+    /*
+     * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+     * clear that happens before the row is written can be immediately re-filled
+     * with the pre-change answer by a concurrent request, which would hand a
+     * disabled provider another full TTL of life on the very node that served
+     * the disable. Clearing in both is deliberate - the before-hook narrows the
+     * window, the success hook closes it.
+     *
+     * These caches are per-process, so the hooks make a change immediate on the
+     * node that served it and the TTL bounds every other node.
+     */
+    async onBeforeUpdate(updateBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { updateBy, carryForward: null };
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
+    async onBeforeDelete(deleteBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onBeforeCreate(createBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { createBy, carryForward: null };
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getProviderTrust", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
 export default new Service();
 //# sourceMappingURL=GlobalOidcService.js.map

package/build/dist/Server/Services/GlobalOidcService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalOidcService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,wCAAwC,CAAC;AAE3D,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalOidcService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,wCAAwC,CAAC;AAC3D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAKzD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,GACd,MAAM,iCAAiC,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAC3B,UAAoB;QAEpB,MAAM,GAAG,GAAW,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAE/D,MAAM,MAAM,GACV,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,IAAkC,EAAE;YACjE,MAAM,QAAQ,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE;gBACrC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,0BAA0B,EAAE,IAAI;iBACjC;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH;;;eAGG;YACH,MAAM,KAAK,GAAwB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;gBACjD,0BAA0B,EAAE,OAAO,CACjC,QAAQ,IAAI,QAAQ,CAAC,0BAA0B,CAChD;aACF,CAAC;YAEF,2BAA2B,CAAC,GAAG,CAC7B,GAAG,EACH,KAAK,EACL,qCAAqC,CACtC,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAGsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA1Gc;IADZ,WAAW,EAAE;;qCAEA,QAAQ;;+CAyCrB;AAewB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/GlobalSsoProjectService.js

@@ -12,10 +12,82 @@ import Model from "../../Models/DatabaseModels/GlobalSsoProject";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, { resolveAttachmentProjectId, } from "../Utils/ValidateGlobalProviderProjectTeams";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, doAttachmentsGovernProject, globalProviderCacheKey, globalSsoAttachmentsCache, loadAttachmentsOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * Whether this provider's attachments cover `projectId`.
+     *
+     * Only consulted when the provider has `restrictToAttachedProjects` on -
+     * attachments are the PROVISIONING allow-list by default, not an access
+     * boundary, and reading them as one without the admin asking would lock
+     * existing users out of projects they legitimately reach.
+     *
+     * "No attachment rows at all" means instance-wide, matching the login
+     * router's default-all mode. "Rows exist but none are enabled" is a
+     * different answer and denies - otherwise an admin disabling the last
+     * attachment would WIDEN the provider to every project.
+     *
+     * Cached for 60s, with concurrent misses sharing one query.
+     */
+    async doesProviderGovernProject(data) {
+        const key = globalProviderCacheKey("sso", data.globalSsoId);
+        const cached = globalSsoAttachmentsCache.get(key);
+        if (cached !== undefined) {
+            return doAttachmentsGovernProject(cached, data.projectId);
+        }
+        const attachments = await loadAttachmentsOnce(key, async () => {
+            /*
+             * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+             * as "this provider has attachments"; the enabled ones are selected
+             * out below.
+             */
+            const rows = await this.findBy({
+                query: { globalSsoId: data.globalSsoId },
+                select: { _id: true, projectId: true, isEnabled: true },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const loaded = {
+                hasAnyAttachmentRows: rows.length > 0,
+                enabledProjectIds: rows
+                    .filter((row) => {
+                    return Boolean(row.isEnabled) && Boolean(row.projectId);
+                })
+                    .map((row) => {
+                    return row.projectId.toString();
+                }),
+            };
+            globalSsoAttachmentsCache.set(key, loaded, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return loaded;
+        });
+        return doAttachmentsGovernProject(attachments, data.projectId);
+    }
+    async onBeforeDelete(deleteBy) {
+        // Detaching a project has to take effect now, not in 60s, on this node.
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    /*
+     * Cleared again AFTER the write commits. A clear that runs before the row
+     * lands can be immediately re-filled with the pre-change answer by a
+     * concurrent request, handing the old attachment set another full TTL.
+     */
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
     async onBeforeCreate(createBy) {
         /*
          * The attach form submits the project via the `project` relation, so the
@@ -30,6 +102,8 @@ export class Service extends DatabaseService {
             teams: createBy.data.teams,
             projectId,
         });
+        // A new attachment narrows (or widens) which projects the provider governs.
+        clearGlobalSsoAuthorizationCaches();
         return { createBy, carryForward: null };
     }
     async onBeforeUpdate(updateBy) {
@@ -61,9 +135,40 @@ export class Service extends DatabaseService {
                 }
             }
         }
+        clearGlobalSsoAuthorizationCaches();
         return { updateBy, carryForward: null };
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "doesProviderGovernProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/GlobalSsoProjectService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalSsoProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAErD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AA/D0B;IADxB,WAAW,EAAE;;;;6CAuBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalSsoProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAGzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CAAC,IAGtC;QACC,MAAM,GAAG,GAAW,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEpE,MAAM,MAAM,GACV,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAA8B,MAAM,mBAAmB,CACtE,GAAG,EACH,KAAK,IAAwC,EAAE;YAC7C;;;;eAIG;YACH,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAA8B;gBACxC,oBAAoB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;gBACrC,iBAAiB,EAAE,IAAI;qBACpB,MAAM,CAAC,CAAC,GAAU,EAAE,EAAE;oBACrB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1D,CAAC,CAAC;qBACD,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;oBAClB,OAAO,GAAG,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;gBACnC,CAAC,CAAC;aACL,CAAC;YAEF,yBAAyB,CAAC,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,qCAAqC,CACtC,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,OAAO,0BAA0B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,wEAAwE;QACxE,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEsB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,4EAA4E;QAC5E,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnKc;IADZ,WAAW,EAAE;;;;wDAoDb;AAGwB;IADxB,WAAW,EAAE;;;;6CAOb;AAQwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CA0Bb;AAGwB;IADxB,WAAW,EAAE;;;;6CAwCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/GlobalSsoService.js

@@ -1,9 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalSso";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, globalProviderCacheKey, globalSsoProviderTrustCache, loadTrustOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * What the SSO-enforcement middleware needs to know about this provider:
+     * whether it is still usable at all, and whether the admin opted it into
+     * attachment-scoped access.
+     *
+     * Called on every authenticated request against an SSO-enforced project, so
+     * the answer is cached for 60s and concurrent misses share one query.
+     * Without this lookup, turning a provider off leaves every token it ever
+     * issued working until each one expires - up to thirty days.
+     */
+    async getProviderTrust(providerId) {
+        const key = globalProviderCacheKey("sso", providerId);
+        const cached = globalSsoProviderTrustCache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        return loadTrustOnce(key, async () => {
+            const provider = await this.findOneBy({
+                query: { _id: providerId.toString() },
+                select: {
+                    _id: true,
+                    isEnabled: true,
+                    restrictToAttachedProjects: true,
+                },
+                props: { isRoot: true },
+            });
+            /*
+             * A deleted provider and a disabled one are the same answer: no. Both
+             * are cached, so a revoked provider does not cost a query per request.
+             */
+            const trust = {
+                isUsable: Boolean(provider && provider.isEnabled),
+                restrictToAttachedProjects: Boolean(provider && provider.restrictToAttachedProjects),
+            };
+            globalSsoProviderTrustCache.set(key, trust, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return trust;
+        });
+    }
+    /*
+     * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+     * clear that happens before the row is written can be immediately re-filled
+     * with the pre-change answer by a concurrent request, which would hand a
+     * disabled provider another full TTL of life on the very node that served
+     * the disable. Clearing in both is deliberate - the before-hook narrows the
+     * window, the success hook closes it.
+     *
+     * These caches are per-process, so the hooks make a change immediate on the
+     * node that served it and the TTL bounds every other node.
+     */
+    async onBeforeUpdate(updateBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { updateBy, carryForward: null };
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
+    async onBeforeDelete(deleteBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onBeforeCreate(createBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { createBy, carryForward: null };
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getProviderTrust", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
 export default new Service();
 //# sourceMappingURL=GlobalSsoService.js.map

package/build/dist/Server/Services/GlobalSsoService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalSsoService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,uCAAuC,CAAC;AAE1D,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalSsoService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,uCAAuC,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAKzD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,GACd,MAAM,iCAAiC,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAC3B,UAAoB;QAEpB,MAAM,GAAG,GAAW,sBAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,MAAM,GACV,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,IAAkC,EAAE;YACjE,MAAM,QAAQ,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE;gBACrC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,0BAA0B,EAAE,IAAI;iBACjC;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH;;;eAGG;YACH,MAAM,KAAK,GAAwB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;gBACjD,0BAA0B,EAAE,OAAO,CACjC,QAAQ,IAAI,QAAQ,CAAC,0BAA0B,CAChD;aACF,CAAC;YAEF,2BAA2B,CAAC,GAAG,CAC7B,GAAG,EACH,KAAK,EACL,qCAAqC,CACtC,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAGsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA1Gc;IADZ,WAAW,EAAE;;qCAEA,QAAQ;;+CAyCrB;AAewB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/LogAggregationService.js

@@ -104,6 +104,7 @@ export class LogAggregationService {
         statement.append(getQuerySettings({
             maxExecutionTimeInSeconds: 45,
             timeoutOverflowMode: "break",
+            boundScanMemory: true,
             additionalSettings: { optimize_use_projections: 1 },
         }));
         return statement;
@@ -185,6 +186,7 @@ export class LogAggregationService {
         statement.append(getQuerySettings({
             maxExecutionTimeInSeconds: 45,
             timeoutOverflowMode: "break",
+            boundScanMemory: true,
         }));
         return statement;
     }
@@ -344,6 +346,7 @@ export class LogAggregationService {
         statement.append(getQuerySettings({
             maxExecutionTimeInSeconds: 45,
             timeoutOverflowMode: "break",
+            boundScanMemory: true,
         }));
         return statement;
     }
@@ -395,6 +398,7 @@ export class LogAggregationService {
         statement.append(getQuerySettings({
             maxExecutionTimeInSeconds: 45,
             timeoutOverflowMode: "break",
+            boundScanMemory: true,
         }));
         return statement;
     }
@@ -442,6 +446,7 @@ export class LogAggregationService {
         statement.append(getQuerySettings({
             maxExecutionTimeInSeconds: 45,
             timeoutOverflowMode: "break",
+            boundScanMemory: true,
         }));
         return statement;
     }