@revealui/auth 0.4.10 → 0.5.1

package/dist/server/platform-roles.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Platform role plane (users.role + _json.roles) — durable bounds.
+ *
+ * Orthogonal to billing:
+ * - account_memberships.role (owner|admin|member) — workspace seat
+ * - account_entitlements.tier — paid features
+ *
+ * Super-admin is platform operator only (lives in _json.roles, never as
+ * the sole meaning of "first user of a customer account").
+ *
+ * Account membership owner of a hosted workspace gets CMS shell access
+ * via users.role = admin so proxy isAdminRole + /settings (API keys) work.
+ * That is NOT super-admin.
+ */
+import type { Database } from '@revealui/db/client';
+/** DB column values that already pass isAdminRole / shell admin cookie gate. */
+export declare const PLATFORM_SHELL_ADMIN_ROLES: ReadonlySet<string>;
+/**
+ * Cookie/proxy admin set (isAdminRole). Includes super-admin for cookie
+ * compatibility; super-admin must not be written to users.role (CHECK forbids it).
+ */
+export declare const PLATFORM_SHELL_ADMIN_COOKIE_ROLES: ReadonlySet<string>;
+/**
+ * When a user becomes (or is) billing account owner, ensure they can use
+ * workspace admin surfaces. Promote non-admin DB roles to `admin`.
+ * Never demote owner/admin. Never assign super-admin.
+ */
+export declare function platformRoleForAccountOwner(currentRole: string): string;
+export declare function isPlatformShellAdminRole(role: string | null | undefined): boolean;
+/**
+ * Promote users.role to admin when the user is (or becomes) an account
+ * membership owner and currently lacks shell admin. Idempotent; never demotes.
+ *
+ * Call sites: personal-account provision at signup, Stripe ensureHostedAccount,
+ * grant-entitlement --create-account, OAuth hosted provision.
+ */
+export declare function ensureAccountOwnerPlatformAdmin(db: Database, userId: string): Promise<{
+    previousRole: string;
+    nextRole: string;
+    updated: boolean;
+} | null>;
+//# sourceMappingURL=platform-roles.d.ts.map

package/dist/server/platform-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-roles.d.ts","sourceRoot":"","sources":["../../src/server/platform-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAIhE,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmB9E"}

package/dist/server/platform-roles.js

@@ -0,0 +1,65 @@
+/**
+ * Platform role plane (users.role + _json.roles) — durable bounds.
+ *
+ * Orthogonal to billing:
+ * - account_memberships.role (owner|admin|member) — workspace seat
+ * - account_entitlements.tier — paid features
+ *
+ * Super-admin is platform operator only (lives in _json.roles, never as
+ * the sole meaning of "first user of a customer account").
+ *
+ * Account membership owner of a hosted workspace gets CMS shell access
+ * via users.role = admin so proxy isAdminRole + /settings (API keys) work.
+ * That is NOT super-admin.
+ */
+import { users } from '@revealui/db/schema';
+import { eq } from 'drizzle-orm';
+/** DB column values that already pass isAdminRole / shell admin cookie gate. */
+export const PLATFORM_SHELL_ADMIN_ROLES = new Set(['owner', 'admin']);
+/**
+ * Cookie/proxy admin set (isAdminRole). Includes super-admin for cookie
+ * compatibility; super-admin must not be written to users.role (CHECK forbids it).
+ */
+export const PLATFORM_SHELL_ADMIN_COOKIE_ROLES = new Set([
+    'owner',
+    'admin',
+    'super-admin',
+]);
+/**
+ * When a user becomes (or is) billing account owner, ensure they can use
+ * workspace admin surfaces. Promote non-admin DB roles to `admin`.
+ * Never demote owner/admin. Never assign super-admin.
+ */
+export function platformRoleForAccountOwner(currentRole) {
+    if (PLATFORM_SHELL_ADMIN_ROLES.has(currentRole)) {
+        return currentRole;
+    }
+    return 'admin';
+}
+export function isPlatformShellAdminRole(role) {
+    return role != null && PLATFORM_SHELL_ADMIN_COOKIE_ROLES.has(role);
+}
+/**
+ * Promote users.role to admin when the user is (or becomes) an account
+ * membership owner and currently lacks shell admin. Idempotent; never demotes.
+ *
+ * Call sites: personal-account provision at signup, Stripe ensureHostedAccount,
+ * grant-entitlement --create-account, OAuth hosted provision.
+ */
+export async function ensureAccountOwnerPlatformAdmin(db, userId) {
+    const [row] = await db
+        .select({ id: users.id, role: users.role })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+    if (!row) {
+        return null;
+    }
+    const previousRole = row.role;
+    const nextRole = platformRoleForAccountOwner(previousRole);
+    if (nextRole === previousRole) {
+        return { previousRole, nextRole, updated: false };
+    }
+    await db.update(users).set({ role: nextRole }).where(eq(users.id, userId));
+    return { previousRole, nextRole, updated: true };
+}

package/dist/server/session.js

@@ -129,7 +129,7 @@ export async function getSession(headers, requestContext) {
         if (requestContext) {
             const bindingError = validateSessionBinding(session, requestContext);
             if (bindingError) {
-                logger.warn('Session binding violation  -  invalidating session', {
+                logger.error('Session binding violation  -  invalidating session', {
                     sessionId: session.id,
                     reason: bindingError,
                 });

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Minimal mock OIDC IdP for GAP-464 integration tests.
+ * Real RSA keys + jose-signed id_tokens; discovery/token/jwks via fetchImpl.
+ */
+import { type KeyLike } from 'jose';
+export interface MockOidcIdpOptions {
+    issuer?: string;
+    clientId?: string;
+    clientSecret?: string;
+}
+export interface MockOidcIdp {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    discoveryUrl: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    /** Local KeyLike for direct validateOidcIdToken tests */
+    publicKey: KeyLike;
+    signIdToken: (claims?: Record<string, unknown>, overrides?: {
+        issuer?: string;
+        audience?: string;
+        expSeconds?: number;
+        privateKey?: KeyLike;
+    }) => Promise<string>;
+    /** fetchImpl that routes discovery, jwks, and token endpoints */
+    fetchImpl: typeof fetch;
+}
+export declare function createMockOidcIdp(options?: MockOidcIdpOptions): Promise<MockOidcIdp>;
+//# sourceMappingURL=mock-oidc-idp.d.ts.map

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-oidc-idp.d.ts","sourceRoot":"","sources":["../../../../../src/server/sso/__tests__/helpers/mock-oidc-idp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAA2C,KAAK,OAAO,EAAW,MAAM,MAAM,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,CACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iEAAiE;IACjE,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwI9F"}

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.js

@@ -0,0 +1,115 @@
+/**
+ * Minimal mock OIDC IdP for GAP-464 integration tests.
+ * Real RSA keys + jose-signed id_tokens; discovery/token/jwks via fetchImpl.
+ */
+import { generateKeyPairSync } from 'node:crypto';
+import { exportJWK, importPKCS8, SignJWT } from 'jose';
+export async function createMockOidcIdp(options = {}) {
+    const issuer = options.issuer ?? 'https://mock-idp.example.com';
+    const clientId = options.clientId ?? 'revealui-sso-client';
+    const clientSecret = options.clientSecret ?? 'mock-client-secret';
+    const { publicKey: pubPem, privateKey: privPem } = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    const privateKey = await importPKCS8(privPem, 'RS256');
+    const { createPublicKey } = await import('node:crypto');
+    const pub = createPublicKey(pubPem);
+    const jwk = await exportJWK(pub);
+    jwk.alg = 'RS256';
+    jwk.use = 'sig';
+    jwk.kid = 'mock-idp-1';
+    const publicKey = (await (await import('jose')).importJWK({ ...jwk, alg: 'RS256' }, 'RS256'));
+    const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+    const authorizationEndpoint = `${issuer}/authorize`;
+    const tokenEndpoint = `${issuer}/token`;
+    const jwksUri = `${issuer}/jwks`;
+    async function signIdToken(claims = {}, overrides) {
+        const now = Math.floor(Date.now() / 1000);
+        const exp = overrides?.expSeconds ?? now + 3600;
+        const sub = typeof claims.sub === 'string' ? claims.sub : 'user-sub-1';
+        const payload = { ...claims, sub };
+        return new SignJWT(payload)
+            .setProtectedHeader({ alg: 'RS256', kid: 'mock-idp-1' })
+            .setIssuer(overrides?.issuer ?? issuer)
+            .setAudience(overrides?.audience ?? clientId)
+            .setIssuedAt(now)
+            .setExpirationTime(exp)
+            .setSubject(sub)
+            .sign(overrides?.privateKey ?? privateKey);
+    }
+    const discoveryDoc = {
+        issuer,
+        authorization_endpoint: authorizationEndpoint,
+        token_endpoint: tokenEndpoint,
+        jwks_uri: jwksUri,
+        response_types_supported: ['code'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: ['openid', 'email', 'profile'],
+    };
+    const jwksDoc = { keys: [jwk] };
+    const fetchImpl = (async (input, init) => {
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+        if (url === discoveryUrl || url.startsWith(`${discoveryUrl}?`)) {
+            return new Response(JSON.stringify(discoveryDoc), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (url === jwksUri || url.startsWith(`${jwksUri}?`)) {
+            return new Response(JSON.stringify(jwksDoc), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (url === tokenEndpoint || url.startsWith(`${tokenEndpoint}?`)) {
+            if ((init?.method ?? 'GET').toUpperCase() !== 'POST') {
+                return new Response('method not allowed', { status: 405 });
+            }
+            // undici may pass URLSearchParams; avoid cross-realm instanceof
+            const rawBody = init?.body;
+            const bodyText = rawBody == null
+                ? ''
+                : typeof rawBody === 'string'
+                    ? rawBody
+                    : typeof rawBody.toString === 'function'
+                        ? rawBody.toString()
+                        : '';
+            const params = new URLSearchParams(bodyText);
+            // Accept any non-empty code; mock IdP does not track issued codes
+            if (!params.get('code') || params.get('grant_type') !== 'authorization_code') {
+                return new Response(JSON.stringify({ error: 'invalid_request', body: bodyText }), {
+                    status: 400,
+                });
+            }
+            if (params.get('client_id') !== clientId || params.get('client_secret') !== clientSecret) {
+                return new Response(JSON.stringify({ error: 'invalid_client' }), { status: 401 });
+            }
+            const idToken = await signIdToken({
+                email: 'alice@example.com',
+                email_verified: true,
+                name: 'Alice Example',
+                groups: ['Engineering', 'Staff'],
+            });
+            return new Response(JSON.stringify({
+                id_token: idToken,
+                access_token: 'mock-access',
+                token_type: 'Bearer',
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        }
+        return new Response(`not found: ${url}`, { status: 404 });
+    });
+    return {
+        issuer,
+        clientId,
+        clientSecret,
+        discoveryUrl,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksUri,
+        publicKey,
+        signIdToken,
+        fetchImpl,
+    };
+}

package/dist/server/sso/__tests__/helpers/mock-saml-idp.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Minimal mock SAML IdP for GAP-464 integration tests.
+ * Self-signed X509 + xml-crypto enveloped signatures on Response + Assertion.
+ */
+export interface MockSamlIdp {
+    entityId: string;
+    ssoUrl: string;
+    certPem: string;
+    privateKeyPem: string;
+    /** Build IdP metadata XML consumed by parseIdpMetadataXml */
+    metadataXml: string;
+    /**
+     * Build a base64 SAMLResponse (HTTP-POST) signed by this IdP.
+     * When sign is false, returns an unsigned Response for reject tests.
+     */
+    buildPostResponse: (input: {
+        spEntityId: string;
+        acsUrl: string;
+        nameId: string;
+        groups?: string[];
+        sign?: boolean;
+        notOnOrAfterOffsetMs?: number;
+    }) => string;
+}
+export declare function createMockSamlIdp(options?: {
+    entityId?: string;
+}): MockSamlIdp;
+//# sourceMappingURL=mock-saml-idp.d.ts.map

package/dist/server/sso/__tests__/helpers/mock-saml-idp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-saml-idp.d.ts","sourceRoot":"","sources":["../../../../../src/server/sso/__tests__/helpers/mock-saml-idp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,KAAK,MAAM,CAAC;CACd;AAsBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CA2J9E"}

package/dist/server/sso/__tests__/helpers/mock-saml-idp.js

@@ -0,0 +1,150 @@
+/**
+ * Minimal mock SAML IdP for GAP-464 integration tests.
+ * Self-signed X509 + xml-crypto enveloped signatures on Response + Assertion.
+ */
+import { randomBytes } from 'node:crypto';
+import selfsigned from 'selfsigned';
+import { SignedXml } from 'xml-crypto';
+function stripPemHeaders(pem) {
+    const lines = pem.split('\n');
+    const body = [];
+    for (const line of lines) {
+        const t = line.trim();
+        if (!t || t.startsWith('-----'))
+            continue;
+        body.push(t);
+    }
+    return body.join('');
+}
+function escapeXml(value) {
+    return value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&apos;');
+}
+export function createMockSamlIdp(options) {
+    const entityId = options?.entityId ?? 'https://saml-idp.example.com';
+    const ssoUrl = `${entityId}/sso`;
+    const attrs = [{ name: 'commonName', value: 'mock-saml-idp' }];
+    const pems = selfsigned.generate(attrs, {
+        keySize: 2048,
+        days: 1,
+        algorithm: 'sha256',
+    });
+    const idpPrivateKeyPem = pems.private;
+    const certPem = pems.cert;
+    const certBody = stripPemHeaders(certPem);
+    const metadataXml = `<?xml version="1.0"?>
+<EntityDescriptor entityID="${escapeXml(entityId)}" xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+  <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>${certBody}</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <SingleSignOnService
+      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+      Location="${escapeXml(ssoUrl)}" />
+  </IDPSSODescriptor>
+</EntityDescriptor>`;
+    function buildUnsignedAssertion(input) {
+        const groupAttrs = input.groups
+            .map((g) => `<saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">${escapeXml(g)}</saml:AttributeValue>`)
+            .join('');
+        return `<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="${input.assertionId}" IssueInstant="${input.issueInstant}">
+  <saml:Issuer>${escapeXml(entityId)}</saml:Issuer>
+  <saml:Subject>
+    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">${escapeXml(input.nameId)}</saml:NameID>
+    <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
+      <saml:SubjectConfirmationData NotOnOrAfter="${input.notOnOrAfter}" Recipient="${escapeXml(input.acsUrl)}" />
+    </saml:SubjectConfirmation>
+  </saml:Subject>
+  <saml:Conditions NotBefore="${input.issueInstant}" NotOnOrAfter="${input.notOnOrAfter}">
+    <saml:AudienceRestriction>
+      <saml:Audience>${escapeXml(input.spEntityId)}</saml:Audience>
+    </saml:AudienceRestriction>
+  </saml:Conditions>
+  <saml:AuthnStatement AuthnInstant="${input.issueInstant}" SessionIndex="_session1">
+    <saml:AuthnContext>
+      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
+    </saml:AuthnContext>
+  </saml:AuthnStatement>
+  <saml:AttributeStatement>
+    <saml:Attribute Name="email">
+      <saml:AttributeValue>${escapeXml(input.nameId)}</saml:AttributeValue>
+    </saml:Attribute>
+    <saml:Attribute Name="groups">${groupAttrs}</saml:Attribute>
+  </saml:AttributeStatement>
+</saml:Assertion>`;
+    }
+    function signXmlEnveloped(xml, idAttr) {
+        // Place Signature immediately after Issuer (valid for both Assertion and Response)
+        const issuerPath = "/*[local-name()='Assertion' or local-name()='Response']/*[local-name()='Issuer']";
+        const refPath = `//*[@ID='${idAttr}']`;
+        const sig = new SignedXml({
+            privateKey: idpPrivateKeyPem,
+            publicCert: certPem,
+        });
+        sig.addReference({
+            xpath: refPath,
+            transforms: [
+                'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
+                'http://www.w3.org/2001/10/xml-exc-c14n#',
+            ],
+            digestAlgorithm: 'http://www.w3.org/2001/04/xmlenc#sha256',
+        });
+        sig.signatureAlgorithm = 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256';
+        sig.canonicalizationAlgorithm = 'http://www.w3.org/2001/10/xml-exc-c14n#';
+        sig.computeSignature(xml, {
+            location: { reference: issuerPath, action: 'after' },
+            prefix: 'ds',
+        });
+        return sig.getSignedXml();
+    }
+    function buildPostResponse(input) {
+        const shouldSign = input.sign !== false;
+        const now = new Date();
+        const issueInstant = now.toISOString().replace(/\.\d{3}Z$/, 'Z');
+        const notOnOrAfter = new Date(now.getTime() + (input.notOnOrAfterOffsetMs ?? 5 * 60 * 1000))
+            .toISOString()
+            .replace(/\.\d{3}Z$/, 'Z');
+        const responseId = `_resp_${randomBytes(8).toString('hex')}`;
+        const assertionId = `_assert_${randomBytes(8).toString('hex')}`;
+        const groups = input.groups ?? ['Engineering'];
+        let assertion = buildUnsignedAssertion({
+            spEntityId: input.spEntityId,
+            acsUrl: input.acsUrl,
+            nameId: input.nameId,
+            groups,
+            issueInstant,
+            notOnOrAfter,
+            assertionId,
+        });
+        if (shouldSign) {
+            assertion = signXmlEnveloped(assertion, assertionId);
+        }
+        let response = `<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="${responseId}" IssueInstant="${issueInstant}" Destination="${escapeXml(input.acsUrl)}">
+  <saml:Issuer>${escapeXml(entityId)}</saml:Issuer>
+  <samlp:Status>
+    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
+  </samlp:Status>
+  ${assertion}
+</samlp:Response>`;
+        if (shouldSign) {
+            response = signXmlEnveloped(response, responseId);
+        }
+        return Buffer.from(response, 'utf8').toString('base64');
+    }
+    return {
+        entityId,
+        ssoUrl,
+        certPem,
+        privateKeyPem: idpPrivateKeyPem,
+        metadataXml,
+        buildPostResponse,
+    };
+}

package/dist/server/sso/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Enterprise SSO pure layer (GAP-464).
+ *
+ * OIDC discovery + id_token validation, code exchange, SAML SP helpers,
+ * signed SSO state, group→role mapping, JIT user upsert. HTTP routes +
+ * account entitlement gate live in apps/server.
+ */
+export { normalizeSsoUserRole, type UpsertSsoUserInput, upsertSsoUser, } from './jit.js';
+export { type BuildOidcAuthorizationUrlInput, buildOidcAuthorizationUrl, createOidcRemoteJwkSet, type ExchangeOidcCodeFailureReason, type ExchangeOidcCodeInput, type ExchangeOidcCodeResult, type ExchangeOidcCodeSuccess, exchangeOidcCode, type FetchOidcDiscoveryOptions, type FetchOidcDiscoveryResult, fetchOidcDiscovery, type JWTPayload, type JWTVerifyGetKey, type KeyLike, type OidcDiscoveryDocument, type OidcDiscoveryFailureReason, type ValidatedIdTokenClaims, type ValidateIdTokenFailureReason, type ValidateIdTokenResult, type ValidateOidcIdTokenOptions, validateOidcIdToken, } from './oidc.js';
+export { extractGroupsFromClaim, type MapSsoGroupsFailureReason, type MapSsoGroupsInput, type MapSsoGroupsResult, mapSsoGroupsToRole, } from './roles.js';
+export { type BuildSamlAuthorizeUrlFailureReason, type BuildSamlAuthorizeUrlResult, buildSamlAuthorizeUrl, buildSamlSpMetadata, fetchIdpMetadata, normalizeIdpCertPem, type ParseIdpMetadataFailureReason, type ParseIdpMetadataResult, parseIdpMetadataXml, type SamlSpConfig, type ValidatedSamlAssertion, type ValidateSamlResponseFailureReason, type ValidateSamlResponseResult, validateSamlPostResponse, } from './saml.js';
+export { type GenerateSsoStateInput, type GenerateSsoStateResult, generateSsoState, type SsoStatePayload, type VerifiedSsoState, verifySsoState, } from './state.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/server/sso/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/sso/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,KAAK,8BAA8B,EACnC,yBAAyB,EACzB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,wBAAwB,GACzB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,cAAc,GACf,MAAM,YAAY,CAAC"}

package/dist/server/sso/index.js

@@ -0,0 +1,12 @@
+/**
+ * Enterprise SSO pure layer (GAP-464).
+ *
+ * OIDC discovery + id_token validation, code exchange, SAML SP helpers,
+ * signed SSO state, group→role mapping, JIT user upsert. HTTP routes +
+ * account entitlement gate live in apps/server.
+ */
+export { normalizeSsoUserRole, upsertSsoUser, } from './jit.js';
+export { buildOidcAuthorizationUrl, createOidcRemoteJwkSet, exchangeOidcCode, fetchOidcDiscovery, validateOidcIdToken, } from './oidc.js';
+export { extractGroupsFromClaim, mapSsoGroupsToRole, } from './roles.js';
+export { buildSamlAuthorizeUrl, buildSamlSpMetadata, fetchIdpMetadata, normalizeIdpCertPem, parseIdpMetadataXml, validateSamlPostResponse, } from './saml.js';
+export { generateSsoState, verifySsoState, } from './state.js';

package/dist/server/sso/jit.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Enterprise SSO JIT user upsert (GAP-464).
+ *
+ * Flow:
+ * 1. Lookup sso_identities by (providerId, subject) → existing user
+ * 2. Else if verified email: find users by email → link identity
+ *    (enterprise SSO intentionally links by verified email from id_token;
+ *    email is used only when emailVerified === true)
+ * 3. Else create user with password null and a sanitized role
+ * 4. Insert sso_identities; ensure account_memberships row as 'member'
+ *
+ * Never defaults new users to admin. Membership role is always 'member'
+ * (account ACL); mapped SSO role is stored on users.role after allowlist.
+ */
+import type { User } from '../../types.js';
+export interface UpsertSsoUserInput {
+    providerId: string;
+    /** Provider's account_id — membership is attached here */
+    accountId: string;
+    /** IdP subject (`sub`) */
+    subject: string;
+    email?: string;
+    /** Only link/create with email when IdP asserts email_verified */
+    emailVerified?: boolean;
+    name?: string;
+    /** Role from mapSsoGroupsToRole (already forbid unmapped admin) */
+    role: string;
+}
+/**
+ * Map SSO/group roles onto the users table allowlist.
+ * `member` (membership vocabulary) → `viewer` on the user row.
+ * Unknown roles fail closed to `viewer` (never admin).
+ */
+export declare function normalizeSsoUserRole(role: string): string;
+/**
+ * Upsert a user from a validated SSO identity and ensure account membership.
+ */
+export declare function upsertSsoUser(input: UpsertSsoUserInput): Promise<User>;
+//# sourceMappingURL=jit.d.ts.map

package/dist/server/sso/jit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jit.d.ts","sourceRoot":"","sources":["../../../src/server/sso/jit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAK3C,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIzD;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsG5E"}