@revealui/auth 0.5.0 → 0.5.2

package/dist/react/useSignIn.d.ts

@@ -19,7 +19,7 @@ export interface UseSignInResult {
     } | {
         success: false;
         requiresMfa: true;
-        mfaUserId: string;
+        mfaUserId?: string;
     }>;
     isLoading: boolean;
     error: Error | null;

package/dist/react/useSignIn.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAuCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CACN,KAAK,EAAE,WAAW,KACf,OAAO,CACR;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAC3D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CA2E3C"}
+{"version":3,"file":"useSignIn.d.ts","sourceRoot":"","sources":["../../src/react/useSignIn.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAuCxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CACnC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,GAC7B;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAGhD;QAAE,OAAO,EAAE,KAAK,CAAC;QAAC,WAAW,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAC5D,CAAC;IACF,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,SAAS,IAAI,eAAe,CA+E3C"}

package/dist/react/useSignIn.js

@@ -94,13 +94,17 @@ export function useSignIn() {
                     code: errorData.code,
                 };
             }
-            // Check for MFA challenge before parsing as full success
+            // MFA challenge is HTTP 200 with { requiresMfa: true } and no `user`.
+            // The server may omit mfaUserId from the body (identity lives in the
+            // httpOnly mfa-pending cookie). Requiring mfaUserId here forced the
+            // success schema parse, which threw "expected object, received undefined"
+            // on `user` and locked MFA-enabled accounts out of the login UI.
             const jsonObj = json;
-            if (jsonObj.requiresMfa === true && typeof jsonObj.mfaUserId === 'string') {
+            if (jsonObj.requiresMfa === true) {
                 return {
                     success: false,
                     requiresMfa: true,
-                    mfaUserId: jsonObj.mfaUserId,
+                    ...(typeof jsonObj.mfaUserId === 'string' ? { mfaUserId: jsonObj.mfaUserId } : {}),
                 };
             }
             const successData = SignInSuccessResponseSchema.parse(json);

package/dist/server/audit-storage.d.ts

@@ -30,7 +30,7 @@
  * to one `audit_log`) safe: rows are independent, each signed at its own door
  * with the same env-derived key. Ruled for GAP-338 — see the gap file.
  */
-import type { AuditRowSignerFn, DrizzleAuditStore as DrizzleAuditStoreType } from '@revealui/db';
+import type { AuditRowSignerFn, DrizzleAuditStoreOptions, DrizzleAuditStore as DrizzleAuditStoreType } from '@revealui/db';
 import type { Database } from '@revealui/db/client';
 import type { AuditEvent, AuditQuery, AuditSeverity, AuditStorage, AuditSystem } from '@revealui/security/server';
 /**
@@ -45,8 +45,11 @@ export declare function getAuditRowSigner(): AuditRowSignerFn | undefined;
  * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
  * writer builds its store through this helper so a row written through the one
  * door on a signing deployment always carries a signature.
+ *
+ * @param options Optional store options (GAP-417 residual): pass `targetEnv`
+ *   from CLI writers that resolve a deployment target independent of NODE_ENV.
  */
-export declare function createAuditStore(db: Database): DrizzleAuditStoreType;
+export declare function createAuditStore(db: Database, options?: DrizzleAuditStoreOptions): DrizzleAuditStoreType;
 /** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
 export declare function __resetAuditSignerForTest(): void;
 /** DB-side severity vocabulary — matches the `audit_log_severity_check` constraint. */

package/dist/server/audit-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-storage.d.ts","sourceRoot":"","sources":["../../src/server/audit-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,IAAI,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAgBhE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,qBAAqB,CAEpE;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uFAAuF;AACvF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAe/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAEnE;AASD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,YAAY;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAElC,EAAE,EAAE,QAAQ;IAOlB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4B/C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAMhD;AAgCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CA0ChF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,GAAE,WAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1F"}
+{"version":3,"file":"audit-storage.d.ts","sourceRoot":"","sources":["../../src/server/audit-storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,IAAI,qBAAqB,EAC3C,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACZ,MAAM,2BAA2B,CAAC;AAWnC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,gBAAgB,GAAG,SAAS,CAgBhE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,QAAQ,EACZ,OAAO,CAAC,EAAE,wBAAwB,GACjC,qBAAqB,CAEvB;AAED,uFAAuF;AACvF,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD;AAED,uFAAuF;AACvF,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAe/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAEnE;AASD;;;;;GAKG;AACH,qBAAa,yBAA0B,YAAW,YAAY;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;gBAElC,EAAE,EAAE,QAAQ;IAOlB,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4B/C,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;CAMhD;AAgCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CA0ChF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,GAAE,WAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1F"}

package/dist/server/audit-storage.js

@@ -63,9 +63,12 @@ export function getAuditRowSigner() {
  * Construct a `DrizzleAuditStore` wired to the process-wide signer. Every audit
  * writer builds its store through this helper so a row written through the one
  * door on a signing deployment always carries a signature.
+ *
+ * @param options Optional store options (GAP-417 residual): pass `targetEnv`
+ *   from CLI writers that resolve a deployment target independent of NODE_ENV.
  */
-export function createAuditStore(db) {
-    return new DrizzleAuditStore(db, getAuditRowSigner());
+export function createAuditStore(db, options) {
+    return new DrizzleAuditStore(db, getAuditRowSigner(), options);
 }
 /** Test-only reset of the cached signer (re-reads env on next `getAuditRowSigner`). */
 export function __resetAuditSignerForTest() {

package/dist/server/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAUpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CAyLvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAqOvB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/server/auth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAQ,MAAM,aAAa,CAAC;AAWpE;;;;;;;GAOG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GACA,OAAO,CAAC,YAAY,CAAC,CA0PvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBtD;AAED;;;;;;;;GAQG;AACH,wBAAsB,MAAM,CAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,IAAI,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,YAAY,CAAC,CAyOvB"}

package/dist/server/auth.js

@@ -12,6 +12,7 @@ import { and, eq, isNull } from 'drizzle-orm';
 import { auditLoginFailure, auditLoginSuccess } from './audit-bridge.js';
 import { clearFailedAttempts, isAccountLocked, recordFailedAttempt } from './brute-force.js';
 import { validatePasswordStrength } from './password-validation.js';
+import { ensureAccountOwnerPlatformAdmin } from './platform-roles.js';
 import { checkRateLimit } from './rate-limit.js';
 import { createSession, rotateSession } from './session.js';
 /** Grace period after signup during which unverified users can still sign in (24 hours) */
@@ -26,9 +27,27 @@ const EMAIL_VERIFICATION_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
  */
 export async function signIn(email, password, options) {
     try {
-        // Rate limiting by IP address
+        // Rate limiting by IP address. The storage backend (DatabaseStorage in
+        // production) can throw for reasons unrelated to the credential check
+        // itself (pool exhaustion, a transaction-pooling quirk, a storage
+        // misconfiguration) — guard it like every other DB-touching step below so
+        // a throw here fails closed with a diagnosable reason instead of falling
+        // through to the generic outer catch.
         const ipKey = options?.ipAddress || 'unknown';
-        const rateLimit = await checkRateLimit(`signin:${ipKey}`);
+        let rateLimit;
+        try {
+            rateLimit = await checkRateLimit(`signin:${ipKey}`);
+        }
+        catch (rateLimitError) {
+            logger.error('Error checking rate limit', rateLimitError instanceof Error ? rateLimitError : undefined, {
+                message: rateLimitError instanceof Error ? rateLimitError.message : String(rateLimitError),
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database error',
+            };
+        }
         if (!rateLimit.allowed) {
             return {
                 success: false,
@@ -36,8 +55,23 @@ export async function signIn(email, password, options) {
                 error: 'Too many login attempts. Please try again later.',
             };
         }
-        // Brute force protection by email
-        const bruteForceCheck = await isAccountLocked(email);
+        // Brute force protection by email. Same rationale as the rate-limit
+        // guard above — the storage backend can throw independently of whether
+        // the account is actually locked.
+        let bruteForceCheck;
+        try {
+            bruteForceCheck = await isAccountLocked(email);
+        }
+        catch (lockCheckError) {
+            logger.error('Error checking account lock status', lockCheckError instanceof Error ? lockCheckError : undefined, {
+                message: lockCheckError instanceof Error ? lockCheckError.message : String(lockCheckError),
+            });
+            return {
+                success: false,
+                reason: 'database_error',
+                error: 'Database error',
+            };
+        }
         if (bruteForceCheck.locked) {
             const lockMinutes = bruteForceCheck.lockUntil
                 ? Math.ceil((bruteForceCheck.lockUntil - Date.now()) / (60 * 1000))
@@ -118,11 +152,27 @@ export async function signIn(email, password, options) {
         if (!isValid) {
             return failInvalidCredentials();
         }
-        // Successful login - clear failed attempts
-        await clearFailedAttempts(email);
-        // Check email verification (with grace period for new accounts)
+        // Successful login - clear failed attempts. Best-effort: this is
+        // bookkeeping on an already-successful credential check, not a gate, so a
+        // storage hiccup here must not fail an otherwise-valid login (it can only
+        // make a future lockout trigger slightly sooner, never bypass one).
+        try {
+            await clearFailedAttempts(email);
+        }
+        catch (clearAttemptsError) {
+            logger.error('Error clearing failed attempts after successful login', clearAttemptsError instanceof Error ? clearAttemptsError : undefined, {
+                message: clearAttemptsError instanceof Error
+                    ? clearAttemptsError.message
+                    : String(clearAttemptsError),
+            });
+        }
+        // Check email verification (with grace period for new accounts).
+        // Coerce createdAt: the Postgres storage path returns timestamps as strings
+        // (not Date objects), so calling .getTime() directly threw a TypeError that
+        // fell through to the outer catch and turned a valid login into a generic
+        // "unexpected error" on real deploys. new Date() accepts a Date or a string.
         if (!user.emailVerified) {
-            const accountAge = Date.now() - user.createdAt.getTime();
+            const accountAge = Date.now() - new Date(user.createdAt).getTime();
             if (accountAge > EMAIL_VERIFICATION_GRACE_PERIOD_MS) {
                 return {
                     success: false,
@@ -177,8 +227,12 @@ export async function signIn(email, password, options) {
             sessionToken: token,
         };
     }
-    catch {
-        logger.error('Unexpected error in signIn');
+    catch (err) {
+        logger.error('Unexpected error in signIn', err instanceof Error ? err : undefined, {
+            message: err instanceof Error ? err.message : String(err),
+            name: err instanceof Error ? err.name : 'unknown',
+            stack: err instanceof Error ? err.stack : undefined,
+        });
         return {
             success: false,
             reason: 'unexpected_error',
@@ -422,6 +476,10 @@ export async function signUp(email, password, name, options) {
                     createdAt: now,
                     updatedAt: now,
                 });
+                // First membership owner of a hosted account gets platform shell
+                // admin (users.role), not super-admin. Unlocks /settings + API keys
+                // without granting fleet control-plane power.
+                await ensureAccountOwnerPlatformAdmin(db, user.id);
             }
             catch {
                 logger.error('Failed to provision personal account at signup (billing webhook will backfill)', undefined, { userId: user.id });

package/dist/server/index.d.ts

@@ -21,10 +21,12 @@ export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenti
 export type { ChangePasswordResult, PasswordResetResult, PasswordResetToken, } from './password-reset.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
+export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export type { RequestContext, SessionBindingConfig, SessionData } from './session.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';
 export { signCookiePayload, verifyCookiePayload } from './signed-cookie.js';
+export { type BuildOidcAuthorizationUrlInput, type BuildSamlAuthorizeUrlFailureReason, type BuildSamlAuthorizeUrlResult, buildOidcAuthorizationUrl, buildSamlAuthorizeUrl, buildSamlSpMetadata, createOidcRemoteJwkSet, type ExchangeOidcCodeFailureReason, type ExchangeOidcCodeInput, type ExchangeOidcCodeResult, type ExchangeOidcCodeSuccess, exchangeOidcCode, extractGroupsFromClaim, type FetchOidcDiscoveryOptions, type FetchOidcDiscoveryResult, fetchIdpMetadata, fetchOidcDiscovery, type GenerateSsoStateInput, type GenerateSsoStateResult, generateSsoState, type JWTPayload, type JWTVerifyGetKey, type KeyLike, type MapSsoGroupsFailureReason, type MapSsoGroupsInput, type MapSsoGroupsResult, mapSsoGroupsToRole, normalizeIdpCertPem, normalizeSsoUserRole, type OidcDiscoveryDocument, type OidcDiscoveryFailureReason, type ParseIdpMetadataFailureReason, type ParseIdpMetadataResult, parseIdpMetadataXml, type SamlSpConfig, type SsoStatePayload, type UpsertSsoUserInput, upsertSsoUser, type ValidatedIdTokenClaims, type ValidatedSamlAssertion, type ValidateIdTokenFailureReason, type ValidateIdTokenResult, type ValidateOidcIdTokenOptions, type ValidateSamlResponseFailureReason, type ValidateSamlResponseResult, type VerifiedSsoState, validateOidcIdToken, validateSamlPostResponse, verifySsoState, } from './sso/index.js';
 export type { Storage } from './storage/index.js';
 export { createStorage, DatabaseStorage, getStorage, InMemoryStorage, resetStorage, } from './storage/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE9D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAO3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,YAAY,EACZ,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,oBAAoB,EACpB,eAAe,GAChB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,GACf,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,+BAA+B,EAC/B,6BAA6B,EAC7B,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,gCAAgC,EAChC,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EACL,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,iBAAiB,EACjB,yBAAyB,EACzB,aAAa,EACb,sBAAsB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,OAAO,EACL,KAAK,8BAA8B,EACnC,KAAK,kCAAkC,EACvC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,EAC5B,gBAAgB,EAChB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACvB,aAAa,EACb,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,0BAA0B,EAC/B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,aAAa,EACb,eAAe,EACf,UAAU,EACV,eAAe,EACf,YAAY,GACb,MAAM,oBAAoB,CAAC"}

package/dist/server/index.js

@@ -22,8 +22,11 @@ export { buildAuthUrl, exchangeCode, fetchProviderUser, generateOAuthState, getL
 export { configurePasskey, countUserCredentials, deletePasskey, generateAuthenticationChallenge, generateRegistrationChallenge, listPasskeys, renamePasskey, resetPasskeyConfig, storePasskey, verifyAuthentication, verifyRegistration, } from './passkey.js';
 export { changePassword, generatePasswordResetToken, invalidatePasswordResetToken, resetPasswordWithToken, validatePasswordResetToken, } from './password-reset.js';
 export { meetsMinimumPasswordRequirements, validatePasswordStrength, } from './password-validation.js';
+export { ensureAccountOwnerPlatformAdmin, isPlatformShellAdminRole, PLATFORM_SHELL_ADMIN_COOKIE_ROLES, PLATFORM_SHELL_ADMIN_ROLES, platformRoleForAccountOwner, } from './platform-roles.js';
 export { checkRateLimit, configureRateLimit, getRateLimitStatus, resetRateLimit, resetRateLimitConfig, } from './rate-limit.js';
 export { configureSessionBinding, createSession, deleteAllUserSessions, deleteOtherUserSessions, deleteSession, getSession, isRecoverySession, resetSessionBindingConfig, rotateSession, validateSessionBinding, } from './session.js';
 // Signed Cookie
 export { signCookiePayload, verifyCookiePayload } from './signed-cookie.js';
+// Enterprise SSO pure layer (GAP-464) — OIDC + SAML SP helpers
+export { buildOidcAuthorizationUrl, buildSamlAuthorizeUrl, buildSamlSpMetadata, createOidcRemoteJwkSet, exchangeOidcCode, extractGroupsFromClaim, fetchIdpMetadata, fetchOidcDiscovery, generateSsoState, mapSsoGroupsToRole, normalizeIdpCertPem, normalizeSsoUserRole, parseIdpMetadataXml, upsertSsoUser, validateOidcIdToken, validateSamlPostResponse, verifySsoState, } from './sso/index.js';
 export { createStorage, DatabaseStorage, getStorage, InMemoryStorage, resetStorage, } from './storage/index.js';

package/dist/server/platform-roles.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Platform role plane (users.role + _json.roles) — durable bounds.
+ *
+ * Orthogonal to billing:
+ * - account_memberships.role (owner|admin|member) — workspace seat
+ * - account_entitlements.tier — paid features
+ *
+ * Super-admin is platform operator only (lives in _json.roles, never as
+ * the sole meaning of "first user of a customer account").
+ *
+ * Account membership owner of a hosted workspace gets CMS shell access
+ * via users.role = admin so proxy isAdminRole + /settings (API keys) work.
+ * That is NOT super-admin.
+ */
+import type { Database } from '@revealui/db/client';
+/** DB column values that already pass isAdminRole / shell admin cookie gate. */
+export declare const PLATFORM_SHELL_ADMIN_ROLES: ReadonlySet<string>;
+/**
+ * Cookie/proxy admin set (isAdminRole). Includes super-admin for cookie
+ * compatibility; super-admin must not be written to users.role (CHECK forbids it).
+ */
+export declare const PLATFORM_SHELL_ADMIN_COOKIE_ROLES: ReadonlySet<string>;
+/**
+ * When a user becomes (or is) billing account owner, ensure they can use
+ * workspace admin surfaces. Promote non-admin DB roles to `admin`.
+ * Never demote owner/admin. Never assign super-admin.
+ */
+export declare function platformRoleForAccountOwner(currentRole: string): string;
+export declare function isPlatformShellAdminRole(role: string | null | undefined): boolean;
+/**
+ * Promote users.role to admin when the user is (or becomes) an account
+ * membership owner and currently lacks shell admin. Idempotent; never demotes.
+ *
+ * Call sites: personal-account provision at signup, Stripe ensureHostedAccount,
+ * grant-entitlement --create-account, OAuth hosted provision.
+ */
+export declare function ensureAccountOwnerPlatformAdmin(db: Database, userId: string): Promise<{
+    previousRole: string;
+    nextRole: string;
+    updated: boolean;
+} | null>;
+//# sourceMappingURL=platform-roles.d.ts.map

package/dist/server/platform-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-roles.d.ts","sourceRoot":"","sources":["../../src/server/platform-roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAE3F;;;GAGG;AACH,eAAO,MAAM,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAIhE,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEjF;AAED;;;;;;GAMG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAAC,CAmB9E"}

package/dist/server/platform-roles.js

@@ -0,0 +1,65 @@
+/**
+ * Platform role plane (users.role + _json.roles) — durable bounds.
+ *
+ * Orthogonal to billing:
+ * - account_memberships.role (owner|admin|member) — workspace seat
+ * - account_entitlements.tier — paid features
+ *
+ * Super-admin is platform operator only (lives in _json.roles, never as
+ * the sole meaning of "first user of a customer account").
+ *
+ * Account membership owner of a hosted workspace gets CMS shell access
+ * via users.role = admin so proxy isAdminRole + /settings (API keys) work.
+ * That is NOT super-admin.
+ */
+import { users } from '@revealui/db/schema';
+import { eq } from 'drizzle-orm';
+/** DB column values that already pass isAdminRole / shell admin cookie gate. */
+export const PLATFORM_SHELL_ADMIN_ROLES = new Set(['owner', 'admin']);
+/**
+ * Cookie/proxy admin set (isAdminRole). Includes super-admin for cookie
+ * compatibility; super-admin must not be written to users.role (CHECK forbids it).
+ */
+export const PLATFORM_SHELL_ADMIN_COOKIE_ROLES = new Set([
+    'owner',
+    'admin',
+    'super-admin',
+]);
+/**
+ * When a user becomes (or is) billing account owner, ensure they can use
+ * workspace admin surfaces. Promote non-admin DB roles to `admin`.
+ * Never demote owner/admin. Never assign super-admin.
+ */
+export function platformRoleForAccountOwner(currentRole) {
+    if (PLATFORM_SHELL_ADMIN_ROLES.has(currentRole)) {
+        return currentRole;
+    }
+    return 'admin';
+}
+export function isPlatformShellAdminRole(role) {
+    return role != null && PLATFORM_SHELL_ADMIN_COOKIE_ROLES.has(role);
+}
+/**
+ * Promote users.role to admin when the user is (or becomes) an account
+ * membership owner and currently lacks shell admin. Idempotent; never demotes.
+ *
+ * Call sites: personal-account provision at signup, Stripe ensureHostedAccount,
+ * grant-entitlement --create-account, OAuth hosted provision.
+ */
+export async function ensureAccountOwnerPlatformAdmin(db, userId) {
+    const [row] = await db
+        .select({ id: users.id, role: users.role })
+        .from(users)
+        .where(eq(users.id, userId))
+        .limit(1);
+    if (!row) {
+        return null;
+    }
+    const previousRole = row.role;
+    const nextRole = platformRoleForAccountOwner(previousRole);
+    if (nextRole === previousRole) {
+        return { previousRole, nextRole, updated: false };
+    }
+    await db.update(users).set({ role: nextRole }).where(eq(users.id, userId));
+    return { previousRole, nextRole, updated: true };
+}

package/dist/server/session.js

@@ -129,7 +129,7 @@ export async function getSession(headers, requestContext) {
         if (requestContext) {
             const bindingError = validateSessionBinding(session, requestContext);
             if (bindingError) {
-                logger.warn('Session binding violation  -  invalidating session', {
+                logger.error('Session binding violation  -  invalidating session', {
                     sessionId: session.id,
                     reason: bindingError,
                 });

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Minimal mock OIDC IdP for GAP-464 integration tests.
+ * Real RSA keys + jose-signed id_tokens; discovery/token/jwks via fetchImpl.
+ */
+import { type KeyLike } from 'jose';
+export interface MockOidcIdpOptions {
+    issuer?: string;
+    clientId?: string;
+    clientSecret?: string;
+}
+export interface MockOidcIdp {
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    discoveryUrl: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    /** Local KeyLike for direct validateOidcIdToken tests */
+    publicKey: KeyLike;
+    signIdToken: (claims?: Record<string, unknown>, overrides?: {
+        issuer?: string;
+        audience?: string;
+        expSeconds?: number;
+        privateKey?: KeyLike;
+    }) => Promise<string>;
+    /** fetchImpl that routes discovery, jwks, and token endpoints */
+    fetchImpl: typeof fetch;
+}
+export declare function createMockOidcIdp(options?: MockOidcIdpOptions): Promise<MockOidcIdp>;
+//# sourceMappingURL=mock-oidc-idp.d.ts.map

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-oidc-idp.d.ts","sourceRoot":"","sources":["../../../../../src/server/sso/__tests__/helpers/mock-oidc-idp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAA2C,KAAK,OAAO,EAAW,MAAM,MAAM,CAAC;AAEtF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,CACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,SAAS,CAAC,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrB,iEAAiE;IACjE,SAAS,EAAE,OAAO,KAAK,CAAC;CACzB;AAED,wBAAsB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwI9F"}

package/dist/server/sso/__tests__/helpers/mock-oidc-idp.js

@@ -0,0 +1,115 @@
+/**
+ * Minimal mock OIDC IdP for GAP-464 integration tests.
+ * Real RSA keys + jose-signed id_tokens; discovery/token/jwks via fetchImpl.
+ */
+import { generateKeyPairSync } from 'node:crypto';
+import { exportJWK, importPKCS8, SignJWT } from 'jose';
+export async function createMockOidcIdp(options = {}) {
+    const issuer = options.issuer ?? 'https://mock-idp.example.com';
+    const clientId = options.clientId ?? 'revealui-sso-client';
+    const clientSecret = options.clientSecret ?? 'mock-client-secret';
+    const { publicKey: pubPem, privateKey: privPem } = generateKeyPairSync('rsa', {
+        modulusLength: 2048,
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    const privateKey = await importPKCS8(privPem, 'RS256');
+    const { createPublicKey } = await import('node:crypto');
+    const pub = createPublicKey(pubPem);
+    const jwk = await exportJWK(pub);
+    jwk.alg = 'RS256';
+    jwk.use = 'sig';
+    jwk.kid = 'mock-idp-1';
+    const publicKey = (await (await import('jose')).importJWK({ ...jwk, alg: 'RS256' }, 'RS256'));
+    const discoveryUrl = `${issuer}/.well-known/openid-configuration`;
+    const authorizationEndpoint = `${issuer}/authorize`;
+    const tokenEndpoint = `${issuer}/token`;
+    const jwksUri = `${issuer}/jwks`;
+    async function signIdToken(claims = {}, overrides) {
+        const now = Math.floor(Date.now() / 1000);
+        const exp = overrides?.expSeconds ?? now + 3600;
+        const sub = typeof claims.sub === 'string' ? claims.sub : 'user-sub-1';
+        const payload = { ...claims, sub };
+        return new SignJWT(payload)
+            .setProtectedHeader({ alg: 'RS256', kid: 'mock-idp-1' })
+            .setIssuer(overrides?.issuer ?? issuer)
+            .setAudience(overrides?.audience ?? clientId)
+            .setIssuedAt(now)
+            .setExpirationTime(exp)
+            .setSubject(sub)
+            .sign(overrides?.privateKey ?? privateKey);
+    }
+    const discoveryDoc = {
+        issuer,
+        authorization_endpoint: authorizationEndpoint,
+        token_endpoint: tokenEndpoint,
+        jwks_uri: jwksUri,
+        response_types_supported: ['code'],
+        code_challenge_methods_supported: ['S256'],
+        scopes_supported: ['openid', 'email', 'profile'],
+    };
+    const jwksDoc = { keys: [jwk] };
+    const fetchImpl = (async (input, init) => {
+        const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
+        if (url === discoveryUrl || url.startsWith(`${discoveryUrl}?`)) {
+            return new Response(JSON.stringify(discoveryDoc), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (url === jwksUri || url.startsWith(`${jwksUri}?`)) {
+            return new Response(JSON.stringify(jwksDoc), {
+                status: 200,
+                headers: { 'Content-Type': 'application/json' },
+            });
+        }
+        if (url === tokenEndpoint || url.startsWith(`${tokenEndpoint}?`)) {
+            if ((init?.method ?? 'GET').toUpperCase() !== 'POST') {
+                return new Response('method not allowed', { status: 405 });
+            }
+            // undici may pass URLSearchParams; avoid cross-realm instanceof
+            const rawBody = init?.body;
+            const bodyText = rawBody == null
+                ? ''
+                : typeof rawBody === 'string'
+                    ? rawBody
+                    : typeof rawBody.toString === 'function'
+                        ? rawBody.toString()
+                        : '';
+            const params = new URLSearchParams(bodyText);
+            // Accept any non-empty code; mock IdP does not track issued codes
+            if (!params.get('code') || params.get('grant_type') !== 'authorization_code') {
+                return new Response(JSON.stringify({ error: 'invalid_request', body: bodyText }), {
+                    status: 400,
+                });
+            }
+            if (params.get('client_id') !== clientId || params.get('client_secret') !== clientSecret) {
+                return new Response(JSON.stringify({ error: 'invalid_client' }), { status: 401 });
+            }
+            const idToken = await signIdToken({
+                email: 'alice@example.com',
+                email_verified: true,
+                name: 'Alice Example',
+                groups: ['Engineering', 'Staff'],
+            });
+            return new Response(JSON.stringify({
+                id_token: idToken,
+                access_token: 'mock-access',
+                token_type: 'Bearer',
+            }), { status: 200, headers: { 'Content-Type': 'application/json' } });
+        }
+        return new Response(`not found: ${url}`, { status: 404 });
+    });
+    return {
+        issuer,
+        clientId,
+        clientSecret,
+        discoveryUrl,
+        authorizationEndpoint,
+        tokenEndpoint,
+        jwksUri,
+        publicKey,
+        signIdToken,
+        fetchImpl,
+    };
+}

package/dist/server/sso/__tests__/helpers/mock-saml-idp.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Minimal mock SAML IdP for GAP-464 integration tests.
+ * Self-signed X509 + xml-crypto enveloped signatures on Response + Assertion.
+ */
+export interface MockSamlIdp {
+    entityId: string;
+    ssoUrl: string;
+    certPem: string;
+    privateKeyPem: string;
+    /** Build IdP metadata XML consumed by parseIdpMetadataXml */
+    metadataXml: string;
+    /**
+     * Build a base64 SAMLResponse (HTTP-POST) signed by this IdP.
+     * When sign is false, returns an unsigned Response for reject tests.
+     */
+    buildPostResponse: (input: {
+        spEntityId: string;
+        acsUrl: string;
+        nameId: string;
+        groups?: string[];
+        sign?: boolean;
+        notOnOrAfterOffsetMs?: number;
+    }) => string;
+}
+export declare function createMockSamlIdp(options?: {
+    entityId?: string;
+}): MockSamlIdp;
+//# sourceMappingURL=mock-saml-idp.d.ts.map

package/dist/server/sso/__tests__/helpers/mock-saml-idp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock-saml-idp.d.ts","sourceRoot":"","sources":["../../../../../src/server/sso/__tests__/helpers/mock-saml-idp.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,KAAK,MAAM,CAAC;CACd;AAsBD,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CA2J9E"}