@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public/enterprise/domains.js

@@ -0,0 +1,271 @@
+import { mutation, query } from "../../functions.js";
+import { vEnterpriseDomainDoc, vEnterpriseDomainVerificationDoc } from "../../model.js";
+import { ConvexError, v } from "convex/values";
+
+//#region src/component/public/enterprise/domains.ts
+/**
+* Link a domain to an enterprise record, or update an existing link.
+*
+* If the domain is already attached to a different enterprise, an
+* `ENTERPRISE_DOMAIN_TAKEN` error is thrown. If the domain already exists for
+* this enterprise, it is updated in place (e.g. toggling `isPrimary`). When
+* `isPrimary` is `true`, any previously primary domain on the same enterprise
+* is demoted. The first domain added to an enterprise becomes primary by default.
+*
+* @param args.enterpriseId - The ID of the enterprise to attach the domain to.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.domain - The domain name to link (e.g. `"acme.com"`).
+* @param args.isPrimary - Whether this domain should be set as the primary domain for the enterprise. Defaults to `true` for the first domain.
+* @returns The ID of the created or updated `EnterpriseDomain` document.
+*
+* @example
+* ```ts
+* const domainId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseDomainAdd,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     domain: "acme.com",
+*     isPrimary: true,
+*   },
+* );
+* ```
+*/
+const enterpriseDomainAdd = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		domain: v.string(),
+		isPrimary: v.optional(v.boolean())
+	},
+	returns: v.id("EnterpriseDomain"),
+	handler: async (ctx, args) => {
+		const existingByDomain = await ctx.db.query("EnterpriseDomain").withIndex("domain", (idx) => idx.eq("domain", args.domain)).first();
+		if (existingByDomain && existingByDomain.enterpriseId !== args.enterpriseId) throw new ConvexError({
+			code: "ENTERPRISE_DOMAIN_TAKEN",
+			message: "That domain is already attached to another enterprise."
+		});
+		const existingForEnterprise = await ctx.db.query("EnterpriseDomain").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", args.enterpriseId)).collect();
+		for (const row of existingForEnterprise) if (row.domain === args.domain) {
+			await ctx.db.patch(row._id, { isPrimary: args.isPrimary ?? row.isPrimary });
+			return row._id;
+		}
+		if (args.isPrimary === true) {
+			for (const row of existingForEnterprise) if (row.isPrimary) await ctx.db.patch(row._id, { isPrimary: false });
+		}
+		return await ctx.db.insert("EnterpriseDomain", {
+			...args,
+			isPrimary: args.isPrimary ?? existingForEnterprise.length === 0
+		});
+	}
+});
+/**
+* List all domains linked to a specific enterprise.
+*
+* Returns all `EnterpriseDomain` documents associated with the given enterprise,
+* queried via the `enterprise_id` index. The result includes both verified and
+* unverified domains.
+*
+* @param args.enterpriseId - The ID of the enterprise whose domains to list.
+* @returns An array of enterprise domain documents.
+*
+* @example
+* ```ts
+* const domains = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseDomainList,
+*   { enterpriseId },
+* );
+* for (const d of domains) {
+*   console.log(d.domain, d.isPrimary, d.verifiedAt);
+* }
+* ```
+*/
+const enterpriseDomainList = query({
+	args: { enterpriseId: v.id("Enterprise") },
+	returns: v.array(vEnterpriseDomainDoc),
+	handler: async (ctx, { enterpriseId }) => {
+		return await ctx.db.query("EnterpriseDomain").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", enterpriseId)).collect();
+	}
+});
+/**
+* Remove a linked enterprise domain and its associated verification record.
+*
+* Deletes the `EnterpriseDomain` document and, if one exists, the related
+* `EnterpriseDomainVerification` record. This is a permanent deletion.
+*
+* @param args.domainId - The document ID of the enterprise domain to remove.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.enterprise.enterpriseDomainDelete,
+*   { domainId },
+* );
+* ```
+*/
+const enterpriseDomainDelete = mutation({
+	args: { domainId: v.id("EnterpriseDomain") },
+	returns: v.null(),
+	handler: async (ctx, { domainId }) => {
+		const verification = await ctx.db.query("EnterpriseDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", domainId)).first();
+		if (verification) await ctx.db.delete(verification._id);
+		await ctx.db.delete(domainId);
+		return null;
+	}
+});
+/**
+* Retrieve the pending domain verification record for a given enterprise domain.
+*
+* Returns the `EnterpriseDomainVerification` document associated with the
+* specified domain, or `null` if no verification has been initiated.
+*
+* @param args.domainId - The document ID of the enterprise domain whose verification to retrieve.
+* @returns The domain verification document, or `null` if none exists.
+*
+* @example
+* ```ts
+* const verification = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseDomainVerificationGet,
+*   { domainId },
+* );
+* if (verification) {
+*   console.log(verification.recordName, verification.expiresAt);
+* }
+* ```
+*/
+const enterpriseDomainVerificationGet = query({
+	args: { domainId: v.id("EnterpriseDomain") },
+	returns: v.union(vEnterpriseDomainVerificationDoc, v.null()),
+	handler: async (ctx, { domainId }) => {
+		return await ctx.db.query("EnterpriseDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", domainId)).first();
+	}
+});
+/**
+* Create or update a domain verification challenge for an enterprise domain.
+*
+* If a verification record already exists for the domain, all fields are
+* updated in place (e.g. to rotate the token). Otherwise a new record is
+* created. The caller is responsible for generating the DNS record name,
+* token, and token hash.
+*
+* @param args.enterpriseId - The ID of the enterprise that owns the domain.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.domainId - The document ID of the enterprise domain to verify.
+* @param args.domain - The domain name string (e.g. `"acme.com"`).
+* @param args.recordName - The DNS TXT record name to be published (e.g. `"_convex-verify.acme.com"`).
+* @param args.token - The plaintext verification token value.
+* @param args.tokenHash - A hash of the verification token for secure storage.
+* @param args.requestedAt - Epoch timestamp (ms) when the verification was requested.
+* @param args.expiresAt - Epoch timestamp (ms) after which the challenge expires.
+* @returns The ID of the created or updated `EnterpriseDomainVerification` document.
+*
+* @example
+* ```ts
+* const verificationId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseDomainVerificationUpsert,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     domainId,
+*     domain: "acme.com",
+*     recordName: "_convex-verify.acme.com",
+*     token: "abc123",
+*     tokenHash: "sha256:...",
+*     requestedAt: Date.now(),
+*     expiresAt: Date.now() + 7 * 24 * 60 * 60 * 1000,
+*   },
+* );
+* ```
+*/
+const enterpriseDomainVerificationUpsert = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		domainId: v.id("EnterpriseDomain"),
+		domain: v.string(),
+		recordName: v.string(),
+		token: v.string(),
+		tokenHash: v.string(),
+		requestedAt: v.number(),
+		expiresAt: v.number()
+	},
+	returns: v.id("EnterpriseDomainVerification"),
+	handler: async (ctx, args) => {
+		const existing = await ctx.db.query("EnterpriseDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", args.domainId)).first();
+		if (existing) {
+			await ctx.db.patch(existing._id, args);
+			return existing._id;
+		}
+		return await ctx.db.insert("EnterpriseDomainVerification", args);
+	}
+});
+/**
+* Delete the pending domain verification record for an enterprise domain.
+*
+* Removes the `EnterpriseDomainVerification` document associated with the
+* given domain, effectively cancelling the verification challenge. If no
+* verification record exists, this is a no-op.
+*
+* @param args.domainId - The document ID of the enterprise domain whose verification to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.enterprise.enterpriseDomainVerificationDelete,
+*   { domainId },
+* );
+* ```
+*/
+const enterpriseDomainVerificationDelete = mutation({
+	args: { domainId: v.id("EnterpriseDomain") },
+	returns: v.null(),
+	handler: async (ctx, { domainId }) => {
+		const existing = await ctx.db.query("EnterpriseDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", domainId)).first();
+		if (existing) await ctx.db.delete(existing._id);
+		return null;
+	}
+});
+/**
+* Mark an enterprise domain as verified and clean up the verification record.
+*
+* Sets the `verifiedAt` timestamp on the domain document and deletes the
+* associated `EnterpriseDomainVerification` record (if any). Throws an
+* `INVALID_PARAMETERS` error if the domain document does not exist.
+*
+* @param args.domainId - The document ID of the enterprise domain to mark as verified.
+* @param args.verifiedAt - Epoch timestamp (ms) at which the domain was verified.
+* @returns The updated enterprise domain document with the `verifiedAt` field set.
+*
+* @example
+* ```ts
+* const verifiedDomain = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseDomainVerify,
+*   { domainId, verifiedAt: Date.now() },
+* );
+* console.log("Domain verified:", verifiedDomain.domain);
+* ```
+*/
+const enterpriseDomainVerify = mutation({
+	args: {
+		domainId: v.id("EnterpriseDomain"),
+		verifiedAt: v.number()
+	},
+	returns: vEnterpriseDomainDoc,
+	handler: async (ctx, { domainId, verifiedAt }) => {
+		await ctx.db.patch(domainId, { verifiedAt });
+		const domain = await ctx.db.get("EnterpriseDomain", domainId);
+		if (!domain) throw new ConvexError({
+			code: "INVALID_PARAMETERS",
+			message: "Enterprise domain not found."
+		});
+		const verification = await ctx.db.query("EnterpriseDomainVerification").withIndex("domain_id", (idx) => idx.eq("domainId", domainId)).first();
+		if (verification) await ctx.db.delete(verification._id);
+		return domain;
+	}
+});
+
+//#endregion
+export { enterpriseDomainAdd, enterpriseDomainDelete, enterpriseDomainList, enterpriseDomainVerificationDelete, enterpriseDomainVerificationGet, enterpriseDomainVerificationUpsert, enterpriseDomainVerify };
+//# sourceMappingURL=domains.js.map

package/dist/component/public/enterprise/domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.js","names":[],"sources":["../../../../src/component/public/enterprise/domains.ts"],"sourcesContent":["import { ConvexError, v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vEnterpriseDomainDoc, vEnterpriseDomainVerificationDoc } from \"../../model\";\n\n/**\n * Link a domain to an enterprise record, or update an existing link.\n *\n * If the domain is already attached to a different enterprise, an\n * `ENTERPRISE_DOMAIN_TAKEN` error is thrown. If the domain already exists for\n * this enterprise, it is updated in place (e.g. toggling `isPrimary`). When\n * `isPrimary` is `true`, any previously primary domain on the same enterprise\n * is demoted. The first domain added to an enterprise becomes primary by default.\n *\n * @param args.enterpriseId - The ID of the enterprise to attach the domain to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.domain - The domain name to link (e.g. `\"acme.com\"`).\n * @param args.isPrimary - Whether this domain should be set as the primary domain for the enterprise. Defaults to `true` for the first domain.\n * @returns The ID of the created or updated `EnterpriseDomain` document.\n *\n * @example\n * ```ts\n * const domainId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseDomainAdd,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     domain: \"acme.com\",\n *     isPrimary: true,\n *   },\n * );\n * ```\n */\nexport const enterpriseDomainAdd = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    domain: v.string(),\n    isPrimary: v.optional(v.boolean()),\n  },\n  returns: v.id(\"EnterpriseDomain\"),\n  handler: async (ctx, args) => {\n    const existingByDomain = await ctx.db\n      .query(\"EnterpriseDomain\")\n      .withIndex(\"domain\", (idx) => idx.eq(\"domain\", args.domain))\n      .first();\n    if (\n      existingByDomain &&\n      existingByDomain.enterpriseId !== args.enterpriseId\n    ) {\n      throw new ConvexError({\n        code: \"ENTERPRISE_DOMAIN_TAKEN\",\n        message: \"That domain is already attached to another enterprise.\",\n      });\n    }\n\n    const existingForEnterprise = await ctx.db\n      .query(\"EnterpriseDomain\")\n      .withIndex(\"enterprise_id\", (idx) =>\n        idx.eq(\"enterpriseId\", args.enterpriseId),\n      )\n      .collect();\n\n    for (const row of existingForEnterprise) {\n      if (row.domain === args.domain) {\n        await ctx.db.patch(row._id, {\n          isPrimary: args.isPrimary ?? row.isPrimary,\n        });\n        return row._id;\n      }\n    }\n\n    if (args.isPrimary === true) {\n      for (const row of existingForEnterprise) {\n        if (row.isPrimary) {\n          await ctx.db.patch(row._id, { isPrimary: false });\n        }\n      }\n    }\n\n    return await ctx.db.insert(\"EnterpriseDomain\", {\n      ...args,\n      isPrimary: args.isPrimary ?? existingForEnterprise.length === 0,\n    });\n  },\n});\n\n/**\n * List all domains linked to a specific enterprise.\n *\n * Returns all `EnterpriseDomain` documents associated with the given enterprise,\n * queried via the `enterprise_id` index. The result includes both verified and\n * unverified domains.\n *\n * @param args.enterpriseId - The ID of the enterprise whose domains to list.\n * @returns An array of enterprise domain documents.\n *\n * @example\n * ```ts\n * const domains = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseDomainList,\n *   { enterpriseId },\n * );\n * for (const d of domains) {\n *   console.log(d.domain, d.isPrimary, d.verifiedAt);\n * }\n * ```\n */\nexport const enterpriseDomainList = query({\n  args: { enterpriseId: v.id(\"Enterprise\") },\n  returns: v.array(vEnterpriseDomainDoc),\n  handler: async (ctx, { enterpriseId }) => {\n    return await ctx.db\n      .query(\"EnterpriseDomain\")\n      .withIndex(\"enterprise_id\", (idx) => idx.eq(\"enterpriseId\", enterpriseId))\n      .collect();\n  },\n});\n\n/**\n * Remove a linked enterprise domain and its associated verification record.\n *\n * Deletes the `EnterpriseDomain` document and, if one exists, the related\n * `EnterpriseDomainVerification` record. This is a permanent deletion.\n *\n * @param args.domainId - The document ID of the enterprise domain to remove.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseDomainDelete,\n *   { domainId },\n * );\n * ```\n */\nexport const enterpriseDomainDelete = mutation({\n  args: { domainId: v.id(\"EnterpriseDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { domainId }) => {\n    const verification = await ctx.db\n      .query(\"EnterpriseDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(verification._id);\n    }\n    await ctx.db.delete(domainId);\n    return null;\n  },\n});\n\n/**\n * Retrieve the pending domain verification record for a given enterprise domain.\n *\n * Returns the `EnterpriseDomainVerification` document associated with the\n * specified domain, or `null` if no verification has been initiated.\n *\n * @param args.domainId - The document ID of the enterprise domain whose verification to retrieve.\n * @returns The domain verification document, or `null` if none exists.\n *\n * @example\n * ```ts\n * const verification = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseDomainVerificationGet,\n *   { domainId },\n * );\n * if (verification) {\n *   console.log(verification.recordName, verification.expiresAt);\n * }\n * ```\n */\nexport const enterpriseDomainVerificationGet = query({\n  args: { domainId: v.id(\"EnterpriseDomain\") },\n  returns: v.union(vEnterpriseDomainVerificationDoc, v.null()),\n  handler: async (ctx, { domainId }) => {\n    return await ctx.db\n      .query(\"EnterpriseDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n  },\n});\n\n/**\n * Create or update a domain verification challenge for an enterprise domain.\n *\n * If a verification record already exists for the domain, all fields are\n * updated in place (e.g. to rotate the token). Otherwise a new record is\n * created. The caller is responsible for generating the DNS record name,\n * token, and token hash.\n *\n * @param args.enterpriseId - The ID of the enterprise that owns the domain.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.domainId - The document ID of the enterprise domain to verify.\n * @param args.domain - The domain name string (e.g. `\"acme.com\"`).\n * @param args.recordName - The DNS TXT record name to be published (e.g. `\"_convex-verify.acme.com\"`).\n * @param args.token - The plaintext verification token value.\n * @param args.tokenHash - A hash of the verification token for secure storage.\n * @param args.requestedAt - Epoch timestamp (ms) when the verification was requested.\n * @param args.expiresAt - Epoch timestamp (ms) after which the challenge expires.\n * @returns The ID of the created or updated `EnterpriseDomainVerification` document.\n *\n * @example\n * ```ts\n * const verificationId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseDomainVerificationUpsert,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     domainId,\n *     domain: \"acme.com\",\n *     recordName: \"_convex-verify.acme.com\",\n *     token: \"abc123\",\n *     tokenHash: \"sha256:...\",\n *     requestedAt: Date.now(),\n *     expiresAt: Date.now() + 7 * 24 * 60 * 60 * 1000,\n *   },\n * );\n * ```\n */\nexport const enterpriseDomainVerificationUpsert = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    domainId: v.id(\"EnterpriseDomain\"),\n    domain: v.string(),\n    recordName: v.string(),\n    token: v.string(),\n    tokenHash: v.string(),\n    requestedAt: v.number(),\n    expiresAt: v.number(),\n  },\n  returns: v.id(\"EnterpriseDomainVerification\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", args.domainId))\n      .first();\n    if (existing) {\n      await ctx.db.patch(existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"EnterpriseDomainVerification\", args);\n  },\n});\n\n/**\n * Delete the pending domain verification record for an enterprise domain.\n *\n * Removes the `EnterpriseDomainVerification` document associated with the\n * given domain, effectively cancelling the verification challenge. If no\n * verification record exists, this is a no-op.\n *\n * @param args.domainId - The document ID of the enterprise domain whose verification to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseDomainVerificationDelete,\n *   { domainId },\n * );\n * ```\n */\nexport const enterpriseDomainVerificationDelete = mutation({\n  args: { domainId: v.id(\"EnterpriseDomain\") },\n  returns: v.null(),\n  handler: async (ctx, { domainId }) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (existing) {\n      await ctx.db.delete(existing._id);\n    }\n    return null;\n  },\n});\n\n/**\n * Mark an enterprise domain as verified and clean up the verification record.\n *\n * Sets the `verifiedAt` timestamp on the domain document and deletes the\n * associated `EnterpriseDomainVerification` record (if any). Throws an\n * `INVALID_PARAMETERS` error if the domain document does not exist.\n *\n * @param args.domainId - The document ID of the enterprise domain to mark as verified.\n * @param args.verifiedAt - Epoch timestamp (ms) at which the domain was verified.\n * @returns The updated enterprise domain document with the `verifiedAt` field set.\n *\n * @example\n * ```ts\n * const verifiedDomain = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseDomainVerify,\n *   { domainId, verifiedAt: Date.now() },\n * );\n * console.log(\"Domain verified:\", verifiedDomain.domain);\n * ```\n */\nexport const enterpriseDomainVerify = mutation({\n  args: {\n    domainId: v.id(\"EnterpriseDomain\"),\n    verifiedAt: v.number(),\n  },\n  returns: vEnterpriseDomainDoc,\n  handler: async (ctx, { domainId, verifiedAt }) => {\n    await ctx.db.patch(domainId, { verifiedAt });\n    const domain = await ctx.db.get(\"EnterpriseDomain\", domainId);\n    if (!domain) {\n      throw new ConvexError({\n        code: \"INVALID_PARAMETERS\",\n        message: \"Enterprise domain not found.\",\n      });\n    }\n    const verification = await ctx.db\n      .query(\"EnterpriseDomainVerification\")\n      .withIndex(\"domain_id\", (idx) => idx.eq(\"domainId\", domainId))\n      .first();\n    if (verification) {\n      await ctx.db.delete(verification._id);\n    }\n    return domain;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAa,sBAAsB,SAAS;CAC1C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ,EAAE,QAAQ;EAClB,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC;EACnC;CACD,SAAS,EAAE,GAAG,mBAAmB;CACjC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,mBAAmB,MAAM,IAAI,GAChC,MAAM,mBAAmB,CACzB,UAAU,WAAW,QAAQ,IAAI,GAAG,UAAU,KAAK,OAAO,CAAC,CAC3D,OAAO;AACV,MACE,oBACA,iBAAiB,iBAAiB,KAAK,aAEvC,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;EAGJ,MAAM,wBAAwB,MAAM,IAAI,GACrC,MAAM,mBAAmB,CACzB,UAAU,kBAAkB,QAC3B,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAC1C,CACA,SAAS;AAEZ,OAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,WAAW,KAAK,QAAQ;AAC9B,SAAM,IAAI,GAAG,MAAM,IAAI,KAAK,EAC1B,WAAW,KAAK,aAAa,IAAI,WAClC,CAAC;AACF,UAAO,IAAI;;AAIf,MAAI,KAAK,cAAc,MACrB;QAAK,MAAM,OAAO,sBAChB,KAAI,IAAI,UACN,OAAM,IAAI,GAAG,MAAM,IAAI,KAAK,EAAE,WAAW,OAAO,CAAC;;AAKvD,SAAO,MAAM,IAAI,GAAG,OAAO,oBAAoB;GAC7C,GAAG;GACH,WAAW,KAAK,aAAa,sBAAsB,WAAW;GAC/D,CAAC;;CAEL,CAAC;;;;;;;;;;;;;;;;;;;;;;AAuBF,MAAa,uBAAuB,MAAM;CACxC,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,EAAE;CAC1C,SAAS,EAAE,MAAM,qBAAqB;CACtC,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,mBAAmB,CACzB,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;AAmBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE;CAC5C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;EACpC,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,+BAA+B,CACrC,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,aAAa,IAAI;AAEvC,QAAM,IAAI,GAAG,OAAO,SAAS;AAC7B,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,kCAAkC,MAAM;CACnD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE;CAC5C,SAAS,EAAE,MAAM,kCAAkC,EAAE,MAAM,CAAC;CAC5D,SAAS,OAAO,KAAK,EAAE,eAAe;AACpC,SAAO,MAAM,IAAI,GACd,MAAM,+BAA+B,CACrC,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCF,MAAa,qCAAqC,SAAS;CACzD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,UAAU,EAAE,GAAG,mBAAmB;EAClC,QAAQ,EAAE,QAAQ;EAClB,YAAY,EAAE,QAAQ;EACtB,OAAO,EAAE,QAAQ;EACjB,WAAW,EAAE,QAAQ;EACrB,aAAa,EAAE,QAAQ;EACvB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,+BAA+B;CAC7C,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,+BAA+B,CACrC,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,KAAK,SAAS,CAAC,CAClE,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK;AACtC,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,gCAAgC,KAAK;;CAEnE,CAAC;;;;;;;;;;;;;;;;;;;AAoBF,MAAa,qCAAqC,SAAS;CACzD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,EAAE;CAC5C,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,eAAe;EACpC,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,+BAA+B,CACrC,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,SACF,OAAM,IAAI,GAAG,OAAO,SAAS,IAAI;AAEnC,SAAO;;CAEV,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,UAAU,EAAE,GAAG,mBAAmB;EAClC,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS;CACT,SAAS,OAAO,KAAK,EAAE,UAAU,iBAAiB;AAChD,QAAM,IAAI,GAAG,MAAM,UAAU,EAAE,YAAY,CAAC;EAC5C,MAAM,SAAS,MAAM,IAAI,GAAG,IAAI,oBAAoB,SAAS;AAC7D,MAAI,CAAC,OACH,OAAM,IAAI,YAAY;GACpB,MAAM;GACN,SAAS;GACV,CAAC;EAEJ,MAAM,eAAe,MAAM,IAAI,GAC5B,MAAM,+BAA+B,CACrC,UAAU,cAAc,QAAQ,IAAI,GAAG,YAAY,SAAS,CAAC,CAC7D,OAAO;AACV,MAAI,aACF,OAAM,IAAI,GAAG,OAAO,aAAa,IAAI;AAEvC,SAAO;;CAEV,CAAC"}

package/dist/component/public/enterprise/scim.d.ts

@@ -0,0 +1,245 @@
+declare namespace scim_d_exports {
+  export { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert };
+}
+/**
+ * Create or update the SCIM provisioning configuration for an enterprise.
+ *
+ * If a SCIM config already exists for the given enterprise, all fields are
+ * patched in place (useful for rotating the bearer token). Otherwise a new
+ * config document is created. Only one SCIM config is allowed per enterprise.
+ *
+ * @param args.enterpriseId - The ID of the enterprise to configure SCIM for.
+ * @param args.groupId - The ID of the root group that owns the enterprise.
+ * @param args.status - The SCIM config lifecycle status: `"draft"`, `"active"`, or `"disabled"`.
+ * @param args.basePath - The base URL path for the SCIM endpoint (e.g. `"/scim/v2"`).
+ * @param args.tokenHash - A hash of the bearer token used to authenticate SCIM requests.
+ * @param args.lastRotatedAt - An optional epoch timestamp (ms) recording when the token was last rotated.
+ * @param args.extend - An optional arbitrary extension object for custom SCIM settings.
+ * @returns The ID of the created or updated `EnterpriseScimConfig` document.
+ *
+ * @example
+ * ```ts
+ * const configId = await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseScimConfigUpsert,
+ *   {
+ *     enterpriseId,
+ *     groupId: orgGroupId,
+ *     status: "active",
+ *     basePath: "/scim/v2",
+ *     tokenHash: "sha256:abc123...",
+ *     lastRotatedAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const enterpriseScimConfigUpsert: any;
+/**
+ * Retrieve the SCIM configuration for a specific enterprise.
+ *
+ * Looks up the SCIM config document by enterprise ID using the
+ * `enterprise_id` index. Returns `null` if SCIM has not been configured.
+ *
+ * @param args.enterpriseId - The ID of the enterprise whose SCIM config to retrieve.
+ * @returns The SCIM configuration document, or `null` if not configured.
+ *
+ * @example
+ * ```ts
+ * const config = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimConfigGetByEnterprise,
+ *   { enterpriseId },
+ * );
+ * if (config) {
+ *   console.log(config.status, config.basePath);
+ * }
+ * ```
+ */
+declare const enterpriseScimConfigGetByEnterprise: any;
+/**
+ * Look up a SCIM configuration by its bearer token hash.
+ *
+ * Used during SCIM request authentication to resolve which enterprise a
+ * given bearer token belongs to. Returns `null` if no config matches.
+ *
+ * @param args.tokenHash - The hash of the bearer token from the incoming SCIM request.
+ * @returns The matching SCIM configuration document, or `null` if not found.
+ *
+ * @example
+ * ```ts
+ * const config = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimConfigGetByTokenHash,
+ *   { tokenHash: "sha256:abc123..." },
+ * );
+ * if (config) {
+ *   console.log("Authenticated enterprise:", config.enterpriseId);
+ * }
+ * ```
+ */
+declare const enterpriseScimConfigGetByTokenHash: any;
+/**
+ * Retrieve a SCIM identity by enterprise, resource type, and external ID.
+ *
+ * Looks up a SCIM-provisioned identity using the composite index on
+ * `(enterpriseId, resourceType, externalId)`. This is the primary lookup
+ * used when processing incoming SCIM user or group operations.
+ *
+ * @param args.enterpriseId - The ID of the enterprise that owns the SCIM identity.
+ * @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
+ * @param args.externalId - The external identifier assigned by the identity provider.
+ * @returns The SCIM identity document, or `null` if not found.
+ *
+ * @example
+ * ```ts
+ * const identity = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimIdentityGet,
+ *   {
+ *     enterpriseId,
+ *     resourceType: "user",
+ *     externalId: "okta-user-abc123",
+ *   },
+ * );
+ * ```
+ */
+declare const enterpriseScimIdentityGet: any;
+/**
+ * Retrieve the SCIM identity linked to a specific user.
+ *
+ * Looks up the first SCIM identity document associated with the given user ID
+ * via the `user_id` index. Useful for checking whether a user was provisioned
+ * through SCIM.
+ *
+ * @param args.userId - The document ID of the user whose SCIM identity to retrieve.
+ * @returns The SCIM identity document, or `null` if the user has no SCIM identity.
+ *
+ * @example
+ * ```ts
+ * const scimIdentity = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimIdentityGetByUser,
+ *   { userId },
+ * );
+ * if (scimIdentity) {
+ *   console.log("User provisioned via SCIM:", scimIdentity.externalId);
+ * }
+ * ```
+ */
+declare const enterpriseScimIdentityGetByUser: any;
+/**
+ * Retrieve the SCIM identity for a specific user within a specific enterprise.
+ *
+ * Uses the composite `(enterpriseId, userId)` index to find the SCIM identity
+ * that links a user to a particular enterprise. This is useful when a user may
+ * belong to multiple enterprises.
+ *
+ * @param args.enterpriseId - The ID of the enterprise to scope the lookup to.
+ * @param args.userId - The document ID of the user.
+ * @returns The SCIM identity document, or `null` if not found.
+ *
+ * @example
+ * ```ts
+ * const identity = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimIdentityGetByEnterpriseAndUser,
+ *   { enterpriseId, userId },
+ * );
+ * ```
+ */
+declare const enterpriseScimIdentityGetByEnterpriseAndUser: any;
+/**
+ * Retrieve the SCIM identity that is mapped to a specific group.
+ *
+ * Looks up a SCIM identity by its `mappedGroupId` field. This is used when
+ * a SCIM group resource has been mapped to an internal group, and you need
+ * to find the corresponding SCIM identity record.
+ *
+ * @param args.mappedGroupId - The document ID of the internal group that a SCIM group is mapped to.
+ * @returns The SCIM identity document, or `null` if no mapping exists.
+ *
+ * @example
+ * ```ts
+ * const scimGroup = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimIdentityGetByMappedGroup,
+ *   { mappedGroupId: teamGroupId },
+ * );
+ * if (scimGroup) {
+ *   console.log("SCIM external group ID:", scimGroup.externalId);
+ * }
+ * ```
+ */
+declare const enterpriseScimIdentityGetByMappedGroup: any;
+/**
+ * List all SCIM identities belonging to a specific enterprise.
+ *
+ * Returns all `EnterpriseScimIdentity` documents for the given enterprise,
+ * including both user and group resource types. Useful for displaying all
+ * SCIM-provisioned resources or for bulk operations.
+ *
+ * @param args.enterpriseId - The ID of the enterprise whose SCIM identities to list.
+ * @returns An array of SCIM identity documents.
+ *
+ * @example
+ * ```ts
+ * const identities = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseScimIdentityListByEnterprise,
+ *   { enterpriseId },
+ * );
+ * const users = identities.filter((i) => i.resourceType === "user");
+ * const groups = identities.filter((i) => i.resourceType === "group");
+ * ```
+ */
+declare const enterpriseScimIdentityListByEnterprise: any;
+/**
+ * Create or update a SCIM-provisioned identity record.
+ *
+ * If a SCIM identity with the same `(enterpriseId, resourceType, externalId)`
+ * already exists, its fields are patched in place. Otherwise a new record is
+ * created. This is the core upsert used by the SCIM provisioning handler to
+ * sync users and groups from external identity providers.
+ *
+ * @param args.enterpriseId - The ID of the enterprise the identity belongs to.
+ * @param args.groupId - The ID of the root group that owns the enterprise.
+ * @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
+ * @param args.externalId - The external identifier assigned by the identity provider.
+ * @param args.userId - An optional link to the internal user document (for user resources).
+ * @param args.mappedGroupId - An optional link to an internal group document (for group resources).
+ * @param args.lastProvisionedAt - An optional epoch timestamp (ms) of the last sync.
+ * @param args.active - An optional flag indicating whether the identity is active.
+ * @param args.raw - An optional raw SCIM payload stored for debugging or re-processing.
+ * @returns The ID of the created or updated `EnterpriseScimIdentity` document.
+ *
+ * @example
+ * ```ts
+ * const identityId = await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseScimIdentityUpsert,
+ *   {
+ *     enterpriseId,
+ *     groupId: orgGroupId,
+ *     resourceType: "user",
+ *     externalId: "okta-user-abc123",
+ *     userId,
+ *     active: true,
+ *     lastProvisionedAt: Date.now(),
+ *     raw: { schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"], userName: "jane@acme.com" },
+ *   },
+ * );
+ * ```
+ */
+declare const enterpriseScimIdentityUpsert: any;
+/**
+ * Permanently delete a SCIM identity record.
+ *
+ * Removes the `EnterpriseScimIdentity` document. This is typically called
+ * when a SCIM DELETE request is received for a user or group resource.
+ *
+ * @param args.identityId - The document ID of the SCIM identity to delete.
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseScimIdentityDelete,
+ *   { identityId: scimIdentity._id },
+ * );
+ * ```
+ */
+declare const enterpriseScimIdentityDelete: any;
+//#endregion
+export { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert, scim_d_exports };
+//# sourceMappingURL=scim.d.ts.map

package/dist/component/public/enterprise/scim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.d.ts","names":[],"sources":["../../../../src/component/public/enterprise/scim.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAwCA;;;;;AA8CA;;;;;AA+BA;;;;;AAmCA;cAhHa,0BAAA;;;;AAyJb;;;;;AA8BA;;;;;AAqCA;;;;;AAiCA;;cA/Ma,mCAAA;;;AA8Pb;;;;;AAgDA;;;;;;;;;;;;;cA/Qa,kCAAA;;;;;;;;;;;;;;;;;;;;;;;;;cAmCA,yBAAA;;;;;;;;;;;;;;;;;;;;;;cAyCA,+BAAA;;;;;;;;;;;;;;;;;;;;cA8BA,4CAAA;;;;;;;;;;;;;;;;;;;;;;cAqCA,sCAAA;;;;;;;;;;;;;;;;;;;;;cAiCA,sCAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA+CA,4BAAA;;;;;;;;;;;;;;;;;;cAgDA,4BAAA"}