@oneuptime/common 12.0.14 → 12.0.15

package/build/dist/Server/Services/GlobalOidcService.js

@@ -1,9 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalOidc";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, globalProviderCacheKey, globalSsoProviderTrustCache, loadTrustOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * What the SSO-enforcement middleware needs to know about this provider:
+     * whether it is still usable at all, and whether the admin opted it into
+     * attachment-scoped access.
+     *
+     * Called on every authenticated request against an SSO-enforced project, so
+     * the answer is cached for 60s and concurrent misses share one query.
+     * Without this lookup, turning a provider off leaves every token it ever
+     * issued working until each one expires - up to thirty days.
+     */
+    async getProviderTrust(providerId) {
+        const key = globalProviderCacheKey("oidc", providerId);
+        const cached = globalSsoProviderTrustCache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        return loadTrustOnce(key, async () => {
+            const provider = await this.findOneBy({
+                query: { _id: providerId.toString() },
+                select: {
+                    _id: true,
+                    isEnabled: true,
+                    restrictToAttachedProjects: true,
+                },
+                props: { isRoot: true },
+            });
+            /*
+             * A deleted provider and a disabled one are the same answer: no. Both
+             * are cached, so a revoked provider does not cost a query per request.
+             */
+            const trust = {
+                isUsable: Boolean(provider && provider.isEnabled),
+                restrictToAttachedProjects: Boolean(provider && provider.restrictToAttachedProjects),
+            };
+            globalSsoProviderTrustCache.set(key, trust, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return trust;
+        });
+    }
+    /*
+     * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+     * clear that happens before the row is written can be immediately re-filled
+     * with the pre-change answer by a concurrent request, which would hand a
+     * disabled provider another full TTL of life on the very node that served
+     * the disable. Clearing in both is deliberate - the before-hook narrows the
+     * window, the success hook closes it.
+     *
+     * These caches are per-process, so the hooks make a change immediate on the
+     * node that served it and the TTL bounds every other node.
+     */
+    async onBeforeUpdate(updateBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { updateBy, carryForward: null };
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
+    async onBeforeDelete(deleteBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onBeforeCreate(createBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { createBy, carryForward: null };
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getProviderTrust", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
 export default new Service();
 //# sourceMappingURL=GlobalOidcService.js.map

package/build/dist/Server/Services/GlobalOidcService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalOidcService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,wCAAwC,CAAC;AAE3D,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalOidcService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalOidcService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,wCAAwC,CAAC;AAC3D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAKzD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,GACd,MAAM,iCAAiC,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAC3B,UAAoB;QAEpB,MAAM,GAAG,GAAW,sBAAsB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAE/D,MAAM,MAAM,GACV,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,IAAkC,EAAE;YACjE,MAAM,QAAQ,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE;gBACrC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,0BAA0B,EAAE,IAAI;iBACjC;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH;;;eAGG;YACH,MAAM,KAAK,GAAwB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;gBACjD,0BAA0B,EAAE,OAAO,CACjC,QAAQ,IAAI,QAAQ,CAAC,0BAA0B,CAChD;aACF,CAAC;YAEF,2BAA2B,CAAC,GAAG,CAC7B,GAAG,EACH,KAAK,EACL,qCAAqC,CACtC,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAGsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA1Gc;IADZ,WAAW,EAAE;;qCAEA,QAAQ;;+CAyCrB;AAewB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/GlobalSsoProjectService.js

@@ -12,10 +12,82 @@ import Model from "../../Models/DatabaseModels/GlobalSsoProject";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, { resolveAttachmentProjectId, } from "../Utils/ValidateGlobalProviderProjectTeams";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, doAttachmentsGovernProject, globalProviderCacheKey, globalSsoAttachmentsCache, loadAttachmentsOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * Whether this provider's attachments cover `projectId`.
+     *
+     * Only consulted when the provider has `restrictToAttachedProjects` on -
+     * attachments are the PROVISIONING allow-list by default, not an access
+     * boundary, and reading them as one without the admin asking would lock
+     * existing users out of projects they legitimately reach.
+     *
+     * "No attachment rows at all" means instance-wide, matching the login
+     * router's default-all mode. "Rows exist but none are enabled" is a
+     * different answer and denies - otherwise an admin disabling the last
+     * attachment would WIDEN the provider to every project.
+     *
+     * Cached for 60s, with concurrent misses sharing one query.
+     */
+    async doesProviderGovernProject(data) {
+        const key = globalProviderCacheKey("sso", data.globalSsoId);
+        const cached = globalSsoAttachmentsCache.get(key);
+        if (cached !== undefined) {
+            return doAttachmentsGovernProject(cached, data.projectId);
+        }
+        const attachments = await loadAttachmentsOnce(key, async () => {
+            /*
+             * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+             * as "this provider has attachments"; the enabled ones are selected
+             * out below.
+             */
+            const rows = await this.findBy({
+                query: { globalSsoId: data.globalSsoId },
+                select: { _id: true, projectId: true, isEnabled: true },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: { isRoot: true },
+            });
+            const loaded = {
+                hasAnyAttachmentRows: rows.length > 0,
+                enabledProjectIds: rows
+                    .filter((row) => {
+                    return Boolean(row.isEnabled) && Boolean(row.projectId);
+                })
+                    .map((row) => {
+                    return row.projectId.toString();
+                }),
+            };
+            globalSsoAttachmentsCache.set(key, loaded, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return loaded;
+        });
+        return doAttachmentsGovernProject(attachments, data.projectId);
+    }
+    async onBeforeDelete(deleteBy) {
+        // Detaching a project has to take effect now, not in 60s, on this node.
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    /*
+     * Cleared again AFTER the write commits. A clear that runs before the row
+     * lands can be immediately re-filled with the pre-change answer by a
+     * concurrent request, handing the old attachment set another full TTL.
+     */
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
     async onBeforeCreate(createBy) {
         /*
          * The attach form submits the project via the `project` relation, so the
@@ -30,6 +102,8 @@ export class Service extends DatabaseService {
             teams: createBy.data.teams,
             projectId,
         });
+        // A new attachment narrows (or widens) which projects the provider governs.
+        clearGlobalSsoAuthorizationCaches();
         return { createBy, carryForward: null };
     }
     async onBeforeUpdate(updateBy) {
@@ -61,9 +135,40 @@ export class Service extends DatabaseService {
                 }
             }
         }
+        clearGlobalSsoAuthorizationCaches();
         return { updateBy, carryForward: null };
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "doesProviderGovernProject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/GlobalSsoProjectService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalSsoProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AAErD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AA/D0B;IADxB,WAAW,EAAE;;;;6CAuBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalSsoProjectService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoProjectService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,8CAA8C,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAKlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,kCAAkC,EAAE,EACzC,0BAA0B,GAC3B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AAGzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;;OAcG;IAEU,AAAN,KAAK,CAAC,yBAAyB,CAAC,IAGtC;QACC,MAAM,GAAG,GAAW,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAEpE,MAAM,MAAM,GACV,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAA8B,MAAM,mBAAmB,CACtE,GAAG,EACH,KAAK,IAAwC,EAAE;YAC7C;;;;eAIG;YACH,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,KAAK,EAAE,iBAAiB;gBACxB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,MAAM,GAA8B;gBACxC,oBAAoB,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;gBACrC,iBAAiB,EAAE,IAAI;qBACpB,MAAM,CAAC,CAAC,GAAU,EAAE,EAAE;oBACrB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC1D,CAAC,CAAC;qBACD,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;oBAClB,OAAO,GAAG,CAAC,SAAU,CAAC,QAAQ,EAAE,CAAC;gBACnC,CAAC,CAAC;aACL,CAAC;YAEF,yBAAyB,CAAC,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,qCAAqC,CACtC,CAAC;YAEF,OAAO,MAAM,CAAC;QAChB,CAAC,CACF,CAAC;QAEF,OAAO,0BAA0B,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,wEAAwE;QACxE,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEsB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB;;;;WAIG;QACH,MAAM,SAAS,GAAyB,0BAA0B,CAChE,QAAQ,CAAC,IAAI,CACd,CAAC;QAEF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACtC,CAAC;QAED,MAAM,kCAAkC,CAAC;YACvC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK;YAC1B,SAAS;SACV,CAAC,CAAC;QAEH,4EAA4E;QAC5E,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,0EAA0E;QAC1E,MAAM,KAAK,GAA4B,QAAQ,CAAC,IAAI,CAAC,KAExC,CAAC;QAEd,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,iBAAiB,GAAyB,QAAQ,CAAC,IAAI;iBAC1D,SAA4C,CAAC;YAEhD,IAAI,iBAAiB,EAAE,CAAC;gBACtB,MAAM,kCAAkC,CAAC;oBACvC,KAAK;oBACL,SAAS,EAAE,iBAAiB;iBAC7B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,yEAAyE;gBACzE,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC3C,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBACtC,KAAK,EAAE,iBAAiB;oBACxB,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;gBAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,kCAAkC,CAAC;wBACvC,KAAK;wBACL,SAAS,EAAE,GAAG,CAAC,SAAS;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,iCAAiC,EAAE,CAAC;QAEpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;CACF;AAnKc;IADZ,WAAW,EAAE;;;;wDAoDb;AAGwB;IADxB,WAAW,EAAE;;;;6CAOb;AAQwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CA0Bb;AAGwB;IADxB,WAAW,EAAE;;;;6CAwCb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/GlobalSsoService.js

@@ -1,9 +1,136 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalSso";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS, clearGlobalSsoAuthorizationCaches, globalProviderCacheKey, globalSsoProviderTrustCache, loadTrustOnce, } from "../Utils/GlobalSsoAuthorization";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /**
+     * What the SSO-enforcement middleware needs to know about this provider:
+     * whether it is still usable at all, and whether the admin opted it into
+     * attachment-scoped access.
+     *
+     * Called on every authenticated request against an SSO-enforced project, so
+     * the answer is cached for 60s and concurrent misses share one query.
+     * Without this lookup, turning a provider off leaves every token it ever
+     * issued working until each one expires - up to thirty days.
+     */
+    async getProviderTrust(providerId) {
+        const key = globalProviderCacheKey("sso", providerId);
+        const cached = globalSsoProviderTrustCache.get(key);
+        if (cached !== undefined) {
+            return cached;
+        }
+        return loadTrustOnce(key, async () => {
+            const provider = await this.findOneBy({
+                query: { _id: providerId.toString() },
+                select: {
+                    _id: true,
+                    isEnabled: true,
+                    restrictToAttachedProjects: true,
+                },
+                props: { isRoot: true },
+            });
+            /*
+             * A deleted provider and a disabled one are the same answer: no. Both
+             * are cached, so a revoked provider does not cost a query per request.
+             */
+            const trust = {
+                isUsable: Boolean(provider && provider.isEnabled),
+                restrictToAttachedProjects: Boolean(provider && provider.restrictToAttachedProjects),
+            };
+            globalSsoProviderTrustCache.set(key, trust, GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS);
+            return trust;
+        });
+    }
+    /*
+     * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+     * clear that happens before the row is written can be immediately re-filled
+     * with the pre-change answer by a concurrent request, which would hand a
+     * disabled provider another full TTL of life on the very node that served
+     * the disable. Clearing in both is deliberate - the before-hook narrows the
+     * window, the success hook closes it.
+     *
+     * These caches are per-process, so the hooks make a change immediate on the
+     * node that served it and the TTL bounds every other node.
+     */
+    async onBeforeUpdate(updateBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { updateBy, carryForward: null };
+    }
+    async onUpdateSuccess(onUpdate, _updatedItemIds) {
+        clearGlobalSsoAuthorizationCaches();
+        return onUpdate;
+    }
+    async onBeforeDelete(deleteBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { deleteBy, carryForward: null };
+    }
+    async onDeleteSuccess(onDelete, _itemIdsBeforeDelete) {
+        clearGlobalSsoAuthorizationCaches();
+        return onDelete;
+    }
+    async onBeforeCreate(createBy) {
+        clearGlobalSsoAuthorizationCaches();
+        return { createBy, carryForward: null };
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        clearGlobalSsoAuthorizationCaches();
+        return createdItem;
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getProviderTrust", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeDelete", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onDeleteSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
 export default new Service();
 //# sourceMappingURL=GlobalSsoService.js.map

package/build/dist/Server/Services/GlobalSsoService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalSsoService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,uCAAuC,CAAC;AAE1D,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalSsoService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalSsoService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,uCAAuC,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAKzD,OAAO,EACL,qCAAqC,EAErC,iCAAiC,EACjC,sBAAsB,EACtB,2BAA2B,EAC3B,aAAa,GACd,MAAM,iCAAiC,CAAC;AAEzC,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;OASG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAC3B,UAAoB;QAEpB,MAAM,GAAG,GAAW,sBAAsB,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,MAAM,GACV,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,OAAO,aAAa,CAAC,GAAG,EAAE,KAAK,IAAkC,EAAE;YACjE,MAAM,QAAQ,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;gBAClD,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE;gBACrC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,0BAA0B,EAAE,IAAI;iBACjC;gBACD,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH;;;eAGG;YACH,MAAM,KAAK,GAAwB;gBACjC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC;gBACjD,0BAA0B,EAAE,OAAO,CACjC,QAAQ,IAAI,QAAQ,CAAC,0BAA0B,CAChD;aACF,CAAC;YAEF,2BAA2B,CAAC,GAAG,CAC7B,GAAG,EACH,KAAK,EACL,qCAAqC,CACtC,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IAGsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,oBAAqC;QAErC,iCAAiC,EAAE,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,iCAAiC,EAAE,CAAC;QACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,iCAAiC,EAAE,CAAC;QACpC,OAAO,WAAW,CAAC;IACrB,CAAC;CACF;AA1Gc;IADZ,WAAW,EAAE;;qCAEA,QAAQ;;+CAyCrB;AAewB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAIvB;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGU,KAAK;;8CAI5B;AAGwB;IADxB,WAAW,EAAE;;;;6CAMb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CAInB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/UserEmailService.js

@@ -96,10 +96,10 @@ export class Service extends DatabaseService {
              * create response for it to confirm the address the way a user would.
              *
              * It is gated on an environment variable that is unset in every shipped
-             * config and set true ONLY in the CI e2e job (docker-compose passes it
-             * through, .github/workflows/test-release.yaml sets it for the SaaS run).
-             * In production the flag is absent, this branch never runs, and the code
-             * never leaves the mail path.
+             * config and set true ONLY in the CI e2e jobs (docker-compose passes it
+             * through; both SaaS e2e jobs set it — test-release.yaml for master and
+             * release.yml for the release branch). In production the flag is absent,
+             * this branch never runs, and the code never leaves the mail path.
              */
             if (process.env["EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E"] ===
                 "true") {

package/build/dist/Server/Utils/CronTab.js

@@ -23,6 +23,66 @@ export default class CronTab {
             throw new BadDataException(`Invalid cron expression: ${crontab}`);
         }
     }
+    /**
+     * Longest gap (in seconds) between two consecutive runs of this cron.
+     *
+     * Used to reason about how much data an evaluation window can possibly
+     * contain: a monitor polled once every five minutes produces at most one
+     * sample per five minutes, so "all values over the last 5 minutes" can
+     * never be backed by more than one sample. Callers use this to decide
+     * whether a window is actually covered by data or is merely still
+     * filling up.
+     *
+     * The *longest* gap is deliberate. Irregular expressions (say
+     * `0,1,30 * * * *`) have both very short and very long gaps; taking the
+     * shortest would make callers demand data at a cadence the cron does not
+     * actually deliver, and they would wait forever.
+     *
+     * Returns null when the expression is missing or unparseable so callers
+     * can fall back to inferring the cadence from the data itself.
+     */
+    static getIntervalInSeconds(crontab, referenceDate) {
+        if (!crontab) {
+            return null;
+        }
+        try {
+            const interval = CronParser.parseExpression(crontab, {
+                currentDate: referenceDate || new Date(),
+            });
+            /*
+             * Six executions -> five gaps. Enough to cover a full hour-wrap for
+             * every interval offered in the UI without walking the schedule far
+             * into the future.
+             */
+            const executionTimes = [];
+            for (let i = 0; i < 6; i++) {
+                executionTimes.push(interval.next().toDate());
+            }
+            let longestGapInSeconds = 0;
+            for (let i = 1; i < executionTimes.length; i++) {
+                const gapInSeconds = (executionTimes[i].getTime() - executionTimes[i - 1].getTime()) /
+                    1000;
+                if (gapInSeconds > longestGapInSeconds) {
+                    longestGapInSeconds = gapInSeconds;
+                }
+            }
+            if (longestGapInSeconds <= 0) {
+                return null;
+            }
+            return longestGapInSeconds;
+        }
+        catch (error) {
+            /*
+             * Debug rather than error: this runs on the criteria-evaluation hot
+             * path, and monitors created before the interval was a cron (or
+             * through a Terraform example using the "Every 5 minutes" label) would
+             * otherwise log on every single check. Callers treat null as "cadence
+             * unknown" and fall back to inferring it from the data.
+             */
+            logger.debug(error);
+            return null;
+        }
+    }
 }
 __decorate([
     CaptureSpan(),
@@ -30,4 +90,10 @@ __decorate([
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Date)
 ], CronTab, "getNextExecutionTime", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Object)
+], CronTab, "getIntervalInSeconds", null);
 //# sourceMappingURL=CronTab.js.map

package/build/dist/Server/Utils/CronTab.js.map

@@ -1 +1 @@
-{"version":3,"file":"CronTab.js","sourceRoot":"","sources":["../../../../Server/Utils/CronTab.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,UAA8B,MAAM,aAAa,CAAC;AACzD,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,OAAO;IAEZ,AAAP,MAAM,CAAC,oBAAoB,CAAC,OAAe;QAChD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAmB,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,iBAAiB,GAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;CACF;AAVe;IADb,WAAW,EAAE;;;oCACuC,IAAI;yCASxD"}
+{"version":3,"file":"CronTab.js","sourceRoot":"","sources":["../../../../Server/Utils/CronTab.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,UAA8B,MAAM,aAAa,CAAC;AACzD,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD,MAAM,CAAC,OAAO,OAAO,OAAO;IAEZ,AAAP,MAAM,CAAC,oBAAoB,CAAC,OAAe;QAChD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAmB,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,iBAAiB,GAAS,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;YACzD,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAEW,AAAP,MAAM,CAAC,oBAAoB,CAChC,OAAkC,EAClC,aAAgC;QAEhC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAmB,UAAU,CAAC,eAAe,CAAC,OAAO,EAAE;gBACnE,WAAW,EAAE,aAAa,IAAI,IAAI,IAAI,EAAE;aACzC,CAAC,CAAC;YAEH;;;;eAIG;YACH,MAAM,cAAc,GAAgB,EAAE,CAAC;YAEvC,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBACnC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,mBAAmB,GAAW,CAAC,CAAC;YAEpC,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvD,MAAM,YAAY,GAChB,CAAC,cAAc,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC;oBACjE,IAAI,CAAC;gBAEP,IAAI,YAAY,GAAG,mBAAmB,EAAE,CAAC;oBACvC,mBAAmB,GAAG,YAAY,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,IAAI,mBAAmB,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf;;;;;;eAMG;YACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAnFe;IADb,WAAW,EAAE;;;oCACuC,IAAI;yCASxD;AAqBa;IADb,WAAW,EAAE;;;;yCAqDb"}

package/build/dist/Server/Utils/GlobalSsoAuthorization.js

@@ -0,0 +1,112 @@
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+/*
+ * The stateful half of Global SSO enforcement.
+ *
+ * A Global SSO/OIDC token is a 30-day, self-contained JWT with no project
+ * binding, so on its own it answers only "this person authenticated against
+ * SOME instance-wide identity provider at some point in the last month". Two
+ * questions it cannot answer:
+ *
+ *   1. IS THE PROVIDER STILL TRUSTED? Turning a provider off, or deleting it,
+ *      has to actually cut off access. Without a check at request time the
+ *      "Enabled" toggle does nothing to anyone already signed in, for up to
+ *      thirty days. This check is UNCONDITIONAL - "disabled" has only one
+ *      possible meaning.
+ *
+ *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Deliberately OPT-IN, per
+ *      provider, via `restrictToAttachedProjects`. The attachment rows
+ *      (GlobalSsoProject / GlobalOidcProject) were introduced as the
+ *      PROVISIONING allow-list - "a SAML assertion can only ever provision a
+ *      user into projects that a master admin has explicitly attached here",
+ *      per the model's own docstring - and the login routers gate a session on
+ *      membership of ANY project, not of an attached one. Reading attachments
+ *      as an access boundary by default would therefore lock existing users
+ *      out of projects they legitimately reach today, immediately on upgrade,
+ *      with no way to recover from inside the product. So it stays off unless
+ *      an admin asks for it.
+ *
+ * Both answers come from Postgres and run on every authenticated request
+ * against an SSO-enforced project, so both are cached in-process for 60
+ * seconds, and concurrent misses share one query.
+ */
+export const GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS = 60000;
+/*
+ * Absence of an entry means "not yet looked up", which is why these are read
+ * with an explicit `undefined` check rather than a truthiness test: a cached
+ * "this provider is disabled" must not be mistaken for a cache miss and
+ * re-queried on every single request.
+ */
+export const globalSsoProviderTrustCache = new InMemoryTTLCache(10000);
+export const globalSsoAttachmentsCache = new InMemoryTTLCache(10000);
+/*
+ * Namespaced by kind. A Global SSO provider and a Global OIDC provider are
+ * different rows in different tables and could in principle share an id;
+ * collapsing the keys would let one vouch for the other.
+ */
+export function globalProviderCacheKey(providerKind, providerId) {
+    return `${providerKind}:${providerId.toString()}`;
+}
+/**
+ * Decides whether a provider's attachments cover `projectId`, for a provider
+ * that has opted into attachment-scoped access.
+ *
+ * A provider with no attachment rows at all is instance-wide, matching the
+ * "default-all" reading the login routers use. A provider that HAS attachment
+ * rows governs exactly the enabled ones - so disabling them all denies rather
+ * than widens.
+ */
+export function doAttachmentsGovernProject(attachments, projectId) {
+    if (!attachments.hasAnyAttachmentRows) {
+        return true;
+    }
+    return attachments.enabledProjectIds.includes(projectId.toString());
+}
+/** Drops every cached answer. Used by the write hooks and by tests. */
+export function clearGlobalSsoAuthorizationCaches() {
+    globalSsoProviderTrustCache.clear();
+    globalSsoAttachmentsCache.clear();
+    inFlightTrustLookups.clear();
+    inFlightAttachmentLookups.clear();
+}
+/*
+ * In-flight de-duplication.
+ *
+ * The multi-tenant permission path fans out over every project the user
+ * belongs to CONCURRENTLY. Without this, a cold cache means N simultaneous
+ * copies of the same two queries - for a user in fifty projects, a hundred
+ * queries where two would do. Worse, failures are never cached, so a database
+ * that is already struggling gets the full fan-out again on every request.
+ *
+ * Sharing the promise collapses all of that to one query per provider, and a
+ * rejection is shared too rather than being retried N times in the same tick.
+ */
+const inFlightTrustLookups = new Map();
+const inFlightAttachmentLookups = new Map();
+async function loadOnce(inFlight, key, load) {
+    const existing = inFlight.get(key);
+    if (existing) {
+        return existing;
+    }
+    const pending = load().finally(() => {
+        /*
+         * Only clear the slot if it is still OURS. A cache clear between the two
+         * (every write to a Global SSO/OIDC service does exactly that, twice) lets
+         * a NEWER lookup take the key while this one is still on the wire; a blind
+         * delete would evict that newer entry when this one settles, and the fan-
+         * out that follows would stop de-duplicating - the one situation this
+         * exists for.
+         */
+        if (inFlight.get(key) === pending) {
+            inFlight.delete(key);
+        }
+    });
+    inFlight.set(key, pending);
+    return pending;
+}
+export function loadTrustOnce(key, load) {
+    return loadOnce(inFlightTrustLookups, key, load);
+}
+export function loadAttachmentsOnce(key, load) {
+    return loadOnce(inFlightAttachmentLookups, key, load);
+}
+//# sourceMappingURL=GlobalSsoAuthorization.js.map

package/build/dist/Server/Utils/GlobalSsoAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GlobalSsoAuthorization.js","sourceRoot":"","sources":["../../../../Server/Utils/GlobalSsoAuthorization.ts"],"names":[],"mappings":"AACA,OAAO,gBAAgB,MAAM,oCAAoC,CAAC;AAElE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,CAAC,MAAM,qCAAqC,GAAW,KAAM,CAAC;AAUpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GACtC,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;AAe/B,MAAM,CAAC,MAAM,yBAAyB,GACpC,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;AAI/B;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,YAAgC,EAChC,UAAoB;IAEpB,OAAO,GAAG,YAAY,IAAI,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAAsC,EACtC,SAAmB;IAEnB,IAAI,CAAC,WAAW,CAAC,oBAAoB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,WAAW,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,iCAAiC;IAC/C,2BAA2B,CAAC,KAAK,EAAE,CAAC;IACpC,yBAAyB,CAAC,KAAK,EAAE,CAAC;IAClC,oBAAoB,CAAC,KAAK,EAAE,CAAC;IAC7B,yBAAyB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,oBAAoB,GAGtB,IAAI,GAAG,EAAE,CAAC;AACd,MAAM,yBAAyB,GAG3B,IAAI,GAAG,EAAE,CAAC;AAEd,KAAK,UAAU,QAAQ,CACrB,QAAiC,EACjC,GAAW,EACX,IAAsB;IAEtB,MAAM,QAAQ,GAA2B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE3D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAe,IAAI,EAAE,CAAC,OAAO,CAAC,GAAS,EAAE;QACpD;;;;;;;WAOG;QACH,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC;YAClC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAE3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,IAAwC;IAExC,OAAO,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,IAA8C;IAE9C,OAAO,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC"}