@robelest/convex-auth 0.0.4-preview.2 → 0.0.4-preview.21

package/dist/component/public/enterprise/scim.js

@@ -0,0 +1,344 @@
+import { mutation, query } from "../../functions.js";
+import { vEnterpriseScimConfigDoc, vEnterpriseScimIdentityDoc, vScimResourceType, vScimStatus } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/enterprise/scim.ts
+/**
+* Create or update the SCIM provisioning configuration for an enterprise.
+*
+* If a SCIM config already exists for the given enterprise, all fields are
+* patched in place (useful for rotating the bearer token). Otherwise a new
+* config document is created. Only one SCIM config is allowed per enterprise.
+*
+* @param args.enterpriseId - The ID of the enterprise to configure SCIM for.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.status - The SCIM config lifecycle status: `"draft"`, `"active"`, or `"disabled"`.
+* @param args.basePath - The base URL path for the SCIM endpoint (e.g. `"/scim/v2"`).
+* @param args.tokenHash - A hash of the bearer token used to authenticate SCIM requests.
+* @param args.lastRotatedAt - An optional epoch timestamp (ms) recording when the token was last rotated.
+* @param args.extend - An optional arbitrary extension object for custom SCIM settings.
+* @returns The ID of the created or updated `EnterpriseScimConfig` document.
+*
+* @example
+* ```ts
+* const configId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseScimConfigUpsert,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     status: "active",
+*     basePath: "/scim/v2",
+*     tokenHash: "sha256:abc123...",
+*     lastRotatedAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const enterpriseScimConfigUpsert = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		status: vScimStatus,
+		basePath: v.string(),
+		tokenHash: v.string(),
+		lastRotatedAt: v.optional(v.number()),
+		extend: v.optional(v.any())
+	},
+	returns: v.id("EnterpriseScimConfig"),
+	handler: async (ctx, args) => {
+		const existing = await ctx.db.query("EnterpriseScimConfig").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", args.enterpriseId)).first();
+		if (existing) {
+			await ctx.db.patch(existing._id, args);
+			return existing._id;
+		}
+		return await ctx.db.insert("EnterpriseScimConfig", args);
+	}
+});
+/**
+* Retrieve the SCIM configuration for a specific enterprise.
+*
+* Looks up the SCIM config document by enterprise ID using the
+* `enterprise_id` index. Returns `null` if SCIM has not been configured.
+*
+* @param args.enterpriseId - The ID of the enterprise whose SCIM config to retrieve.
+* @returns The SCIM configuration document, or `null` if not configured.
+*
+* @example
+* ```ts
+* const config = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimConfigGetByEnterprise,
+*   { enterpriseId },
+* );
+* if (config) {
+*   console.log(config.status, config.basePath);
+* }
+* ```
+*/
+const enterpriseScimConfigGetByEnterprise = query({
+	args: { enterpriseId: v.id("Enterprise") },
+	returns: v.union(vEnterpriseScimConfigDoc, v.null()),
+	handler: async (ctx, { enterpriseId }) => {
+		return await ctx.db.query("EnterpriseScimConfig").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", enterpriseId)).first();
+	}
+});
+/**
+* Look up a SCIM configuration by its bearer token hash.
+*
+* Used during SCIM request authentication to resolve which enterprise a
+* given bearer token belongs to. Returns `null` if no config matches.
+*
+* @param args.tokenHash - The hash of the bearer token from the incoming SCIM request.
+* @returns The matching SCIM configuration document, or `null` if not found.
+*
+* @example
+* ```ts
+* const config = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimConfigGetByTokenHash,
+*   { tokenHash: "sha256:abc123..." },
+* );
+* if (config) {
+*   console.log("Authenticated enterprise:", config.enterpriseId);
+* }
+* ```
+*/
+const enterpriseScimConfigGetByTokenHash = query({
+	args: { tokenHash: v.string() },
+	returns: v.union(vEnterpriseScimConfigDoc, v.null()),
+	handler: async (ctx, { tokenHash }) => {
+		return await ctx.db.query("EnterpriseScimConfig").withIndex("token_hash", (idx) => idx.eq("tokenHash", tokenHash)).first();
+	}
+});
+/**
+* Retrieve a SCIM identity by enterprise, resource type, and external ID.
+*
+* Looks up a SCIM-provisioned identity using the composite index on
+* `(enterpriseId, resourceType, externalId)`. This is the primary lookup
+* used when processing incoming SCIM user or group operations.
+*
+* @param args.enterpriseId - The ID of the enterprise that owns the SCIM identity.
+* @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
+* @param args.externalId - The external identifier assigned by the identity provider.
+* @returns The SCIM identity document, or `null` if not found.
+*
+* @example
+* ```ts
+* const identity = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimIdentityGet,
+*   {
+*     enterpriseId,
+*     resourceType: "user",
+*     externalId: "okta-user-abc123",
+*   },
+* );
+* ```
+*/
+const enterpriseScimIdentityGet = query({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		resourceType: vScimResourceType,
+		externalId: v.string()
+	},
+	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	handler: async (ctx, args) => {
+		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_resource_type_external_id", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
+	}
+});
+/**
+* Retrieve the SCIM identity linked to a specific user.
+*
+* Looks up the first SCIM identity document associated with the given user ID
+* via the `user_id` index. Useful for checking whether a user was provisioned
+* through SCIM.
+*
+* @param args.userId - The document ID of the user whose SCIM identity to retrieve.
+* @returns The SCIM identity document, or `null` if the user has no SCIM identity.
+*
+* @example
+* ```ts
+* const scimIdentity = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimIdentityGetByUser,
+*   { userId },
+* );
+* if (scimIdentity) {
+*   console.log("User provisioned via SCIM:", scimIdentity.externalId);
+* }
+* ```
+*/
+const enterpriseScimIdentityGetByUser = query({
+	args: { userId: v.id("User") },
+	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	handler: async (ctx, { userId }) => {
+		return await ctx.db.query("EnterpriseScimIdentity").withIndex("user_id", (idx) => idx.eq("userId", userId)).first();
+	}
+});
+/**
+* Retrieve the SCIM identity for a specific user within a specific enterprise.
+*
+* Uses the composite `(enterpriseId, userId)` index to find the SCIM identity
+* that links a user to a particular enterprise. This is useful when a user may
+* belong to multiple enterprises.
+*
+* @param args.enterpriseId - The ID of the enterprise to scope the lookup to.
+* @param args.userId - The document ID of the user.
+* @returns The SCIM identity document, or `null` if not found.
+*
+* @example
+* ```ts
+* const identity = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimIdentityGetByEnterpriseAndUser,
+*   { enterpriseId, userId },
+* );
+* ```
+*/
+const enterpriseScimIdentityGetByEnterpriseAndUser = query({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		userId: v.id("User")
+	},
+	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	handler: async (ctx, { enterpriseId, userId }) => {
+		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_user_id", (idx) => idx.eq("enterpriseId", enterpriseId).eq("userId", userId)).first();
+	}
+});
+/**
+* Retrieve the SCIM identity that is mapped to a specific group.
+*
+* Looks up a SCIM identity by its `mappedGroupId` field. This is used when
+* a SCIM group resource has been mapped to an internal group, and you need
+* to find the corresponding SCIM identity record.
+*
+* @param args.mappedGroupId - The document ID of the internal group that a SCIM group is mapped to.
+* @returns The SCIM identity document, or `null` if no mapping exists.
+*
+* @example
+* ```ts
+* const scimGroup = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimIdentityGetByMappedGroup,
+*   { mappedGroupId: teamGroupId },
+* );
+* if (scimGroup) {
+*   console.log("SCIM external group ID:", scimGroup.externalId);
+* }
+* ```
+*/
+const enterpriseScimIdentityGetByMappedGroup = query({
+	args: { mappedGroupId: v.id("Group") },
+	returns: v.union(vEnterpriseScimIdentityDoc, v.null()),
+	handler: async (ctx, { mappedGroupId }) => {
+		return await ctx.db.query("EnterpriseScimIdentity").withIndex("mapped_group_id", (idx) => idx.eq("mappedGroupId", mappedGroupId)).first();
+	}
+});
+/**
+* List all SCIM identities belonging to a specific enterprise.
+*
+* Returns all `EnterpriseScimIdentity` documents for the given enterprise,
+* including both user and group resource types. Useful for displaying all
+* SCIM-provisioned resources or for bulk operations.
+*
+* @param args.enterpriseId - The ID of the enterprise whose SCIM identities to list.
+* @returns An array of SCIM identity documents.
+*
+* @example
+* ```ts
+* const identities = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseScimIdentityListByEnterprise,
+*   { enterpriseId },
+* );
+* const users = identities.filter((i) => i.resourceType === "user");
+* const groups = identities.filter((i) => i.resourceType === "group");
+* ```
+*/
+const enterpriseScimIdentityListByEnterprise = query({
+	args: { enterpriseId: v.id("Enterprise") },
+	returns: v.array(vEnterpriseScimIdentityDoc),
+	handler: async (ctx, { enterpriseId }) => {
+		return await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id", (idx) => idx.eq("enterpriseId", enterpriseId)).collect();
+	}
+});
+/**
+* Create or update a SCIM-provisioned identity record.
+*
+* If a SCIM identity with the same `(enterpriseId, resourceType, externalId)`
+* already exists, its fields are patched in place. Otherwise a new record is
+* created. This is the core upsert used by the SCIM provisioning handler to
+* sync users and groups from external identity providers.
+*
+* @param args.enterpriseId - The ID of the enterprise the identity belongs to.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.resourceType - The SCIM resource type: `"user"` or `"group"`.
+* @param args.externalId - The external identifier assigned by the identity provider.
+* @param args.userId - An optional link to the internal user document (for user resources).
+* @param args.mappedGroupId - An optional link to an internal group document (for group resources).
+* @param args.lastProvisionedAt - An optional epoch timestamp (ms) of the last sync.
+* @param args.active - An optional flag indicating whether the identity is active.
+* @param args.raw - An optional raw SCIM payload stored for debugging or re-processing.
+* @returns The ID of the created or updated `EnterpriseScimIdentity` document.
+*
+* @example
+* ```ts
+* const identityId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseScimIdentityUpsert,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     resourceType: "user",
+*     externalId: "okta-user-abc123",
+*     userId,
+*     active: true,
+*     lastProvisionedAt: Date.now(),
+*     raw: { schemas: ["urn:ietf:params:scim:schemas:core:2.0:User"], userName: "jane@acme.com" },
+*   },
+* );
+* ```
+*/
+const enterpriseScimIdentityUpsert = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		resourceType: vScimResourceType,
+		externalId: v.string(),
+		userId: v.optional(v.id("User")),
+		mappedGroupId: v.optional(v.id("Group")),
+		lastProvisionedAt: v.optional(v.number()),
+		active: v.optional(v.boolean()),
+		raw: v.optional(v.any())
+	},
+	returns: v.id("EnterpriseScimIdentity"),
+	handler: async (ctx, args) => {
+		const existing = await ctx.db.query("EnterpriseScimIdentity").withIndex("enterprise_id_resource_type_external_id", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("resourceType", args.resourceType).eq("externalId", args.externalId)).first();
+		if (existing) {
+			await ctx.db.patch(existing._id, args);
+			return existing._id;
+		}
+		return await ctx.db.insert("EnterpriseScimIdentity", args);
+	}
+});
+/**
+* Permanently delete a SCIM identity record.
+*
+* Removes the `EnterpriseScimIdentity` document. This is typically called
+* when a SCIM DELETE request is received for a user or group resource.
+*
+* @param args.identityId - The document ID of the SCIM identity to delete.
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.enterprise.enterpriseScimIdentityDelete,
+*   { identityId: scimIdentity._id },
+* );
+* ```
+*/
+const enterpriseScimIdentityDelete = mutation({
+	args: { identityId: v.id("EnterpriseScimIdentity") },
+	returns: v.null(),
+	handler: async (ctx, { identityId }) => {
+		await ctx.db.delete(identityId);
+		return null;
+	}
+});
+
+//#endregion
+export { enterpriseScimConfigGetByEnterprise, enterpriseScimConfigGetByTokenHash, enterpriseScimConfigUpsert, enterpriseScimIdentityDelete, enterpriseScimIdentityGet, enterpriseScimIdentityGetByEnterpriseAndUser, enterpriseScimIdentityGetByMappedGroup, enterpriseScimIdentityGetByUser, enterpriseScimIdentityListByEnterprise, enterpriseScimIdentityUpsert };
+//# sourceMappingURL=scim.js.map

package/dist/component/public/enterprise/scim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim.js","names":[],"sources":["../../../../src/component/public/enterprise/scim.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport {\n  vEnterpriseScimConfigDoc,\n  vEnterpriseScimIdentityDoc,\n  vScimResourceType,\n  vScimStatus,\n} from \"../../model\";\n\n/**\n * Create or update the SCIM provisioning configuration for an enterprise.\n *\n * If a SCIM config already exists for the given enterprise, all fields are\n * patched in place (useful for rotating the bearer token). Otherwise a new\n * config document is created. Only one SCIM config is allowed per enterprise.\n *\n * @param args.enterpriseId - The ID of the enterprise to configure SCIM for.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.status - The SCIM config lifecycle status: `\"draft\"`, `\"active\"`, or `\"disabled\"`.\n * @param args.basePath - The base URL path for the SCIM endpoint (e.g. `\"/scim/v2\"`).\n * @param args.tokenHash - A hash of the bearer token used to authenticate SCIM requests.\n * @param args.lastRotatedAt - An optional epoch timestamp (ms) recording when the token was last rotated.\n * @param args.extend - An optional arbitrary extension object for custom SCIM settings.\n * @returns The ID of the created or updated `EnterpriseScimConfig` document.\n *\n * @example\n * ```ts\n * const configId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseScimConfigUpsert,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     status: \"active\",\n *     basePath: \"/scim/v2\",\n *     tokenHash: \"sha256:abc123...\",\n *     lastRotatedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const enterpriseScimConfigUpsert = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    status: vScimStatus,\n    basePath: v.string(),\n    tokenHash: v.string(),\n    lastRotatedAt: v.optional(v.number()),\n    extend: v.optional(v.any()),\n  },\n  returns: v.id(\"EnterpriseScimConfig\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseScimConfig\")\n      .withIndex(\"enterprise_id\", (idx) =>\n        idx.eq(\"enterpriseId\", args.enterpriseId),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.patch(existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"EnterpriseScimConfig\", args);\n  },\n});\n\n/**\n * Retrieve the SCIM configuration for a specific enterprise.\n *\n * Looks up the SCIM config document by enterprise ID using the\n * `enterprise_id` index. Returns `null` if SCIM has not been configured.\n *\n * @param args.enterpriseId - The ID of the enterprise whose SCIM config to retrieve.\n * @returns The SCIM configuration document, or `null` if not configured.\n *\n * @example\n * ```ts\n * const config = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimConfigGetByEnterprise,\n *   { enterpriseId },\n * );\n * if (config) {\n *   console.log(config.status, config.basePath);\n * }\n * ```\n */\nexport const enterpriseScimConfigGetByEnterprise = query({\n  args: { enterpriseId: v.id(\"Enterprise\") },\n  returns: v.union(vEnterpriseScimConfigDoc, v.null()),\n  handler: async (ctx, { enterpriseId }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimConfig\")\n      .withIndex(\"enterprise_id\", (idx) => idx.eq(\"enterpriseId\", enterpriseId))\n      .first();\n  },\n});\n\n/**\n * Look up a SCIM configuration by its bearer token hash.\n *\n * Used during SCIM request authentication to resolve which enterprise a\n * given bearer token belongs to. Returns `null` if no config matches.\n *\n * @param args.tokenHash - The hash of the bearer token from the incoming SCIM request.\n * @returns The matching SCIM configuration document, or `null` if not found.\n *\n * @example\n * ```ts\n * const config = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimConfigGetByTokenHash,\n *   { tokenHash: \"sha256:abc123...\" },\n * );\n * if (config) {\n *   console.log(\"Authenticated enterprise:\", config.enterpriseId);\n * }\n * ```\n */\nexport const enterpriseScimConfigGetByTokenHash = query({\n  args: { tokenHash: v.string() },\n  returns: v.union(vEnterpriseScimConfigDoc, v.null()),\n  handler: async (ctx, { tokenHash }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimConfig\")\n      .withIndex(\"token_hash\", (idx) => idx.eq(\"tokenHash\", tokenHash))\n      .first();\n  },\n});\n\n/**\n * Retrieve a SCIM identity by enterprise, resource type, and external ID.\n *\n * Looks up a SCIM-provisioned identity using the composite index on\n * `(enterpriseId, resourceType, externalId)`. This is the primary lookup\n * used when processing incoming SCIM user or group operations.\n *\n * @param args.enterpriseId - The ID of the enterprise that owns the SCIM identity.\n * @param args.resourceType - The SCIM resource type: `\"user\"` or `\"group\"`.\n * @param args.externalId - The external identifier assigned by the identity provider.\n * @returns The SCIM identity document, or `null` if not found.\n *\n * @example\n * ```ts\n * const identity = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimIdentityGet,\n *   {\n *     enterpriseId,\n *     resourceType: \"user\",\n *     externalId: \"okta-user-abc123\",\n *   },\n * );\n * ```\n */\nexport const enterpriseScimIdentityGet = query({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    resourceType: vScimResourceType,\n    externalId: v.string(),\n  },\n  returns: v.union(vEnterpriseScimIdentityDoc, v.null()),\n  handler: async (ctx, args) => {\n    return await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"enterprise_id_resource_type_external_id\", (idx) =>\n        idx\n          .eq(\"enterpriseId\", args.enterpriseId)\n          .eq(\"resourceType\", args.resourceType)\n          .eq(\"externalId\", args.externalId),\n      )\n      .first();\n  },\n});\n\n/**\n * Retrieve the SCIM identity linked to a specific user.\n *\n * Looks up the first SCIM identity document associated with the given user ID\n * via the `user_id` index. Useful for checking whether a user was provisioned\n * through SCIM.\n *\n * @param args.userId - The document ID of the user whose SCIM identity to retrieve.\n * @returns The SCIM identity document, or `null` if the user has no SCIM identity.\n *\n * @example\n * ```ts\n * const scimIdentity = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimIdentityGetByUser,\n *   { userId },\n * );\n * if (scimIdentity) {\n *   console.log(\"User provisioned via SCIM:\", scimIdentity.externalId);\n * }\n * ```\n */\nexport const enterpriseScimIdentityGetByUser = query({\n  args: { userId: v.id(\"User\") },\n  returns: v.union(vEnterpriseScimIdentityDoc, v.null()),\n  handler: async (ctx, { userId }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"user_id\", (idx) => idx.eq(\"userId\", userId))\n      .first();\n  },\n});\n\n/**\n * Retrieve the SCIM identity for a specific user within a specific enterprise.\n *\n * Uses the composite `(enterpriseId, userId)` index to find the SCIM identity\n * that links a user to a particular enterprise. This is useful when a user may\n * belong to multiple enterprises.\n *\n * @param args.enterpriseId - The ID of the enterprise to scope the lookup to.\n * @param args.userId - The document ID of the user.\n * @returns The SCIM identity document, or `null` if not found.\n *\n * @example\n * ```ts\n * const identity = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimIdentityGetByEnterpriseAndUser,\n *   { enterpriseId, userId },\n * );\n * ```\n */\nexport const enterpriseScimIdentityGetByEnterpriseAndUser = query({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    userId: v.id(\"User\"),\n  },\n  returns: v.union(vEnterpriseScimIdentityDoc, v.null()),\n  handler: async (ctx, { enterpriseId, userId }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"enterprise_id_user_id\", (idx) =>\n        idx.eq(\"enterpriseId\", enterpriseId).eq(\"userId\", userId),\n      )\n      .first();\n  },\n});\n\n/**\n * Retrieve the SCIM identity that is mapped to a specific group.\n *\n * Looks up a SCIM identity by its `mappedGroupId` field. This is used when\n * a SCIM group resource has been mapped to an internal group, and you need\n * to find the corresponding SCIM identity record.\n *\n * @param args.mappedGroupId - The document ID of the internal group that a SCIM group is mapped to.\n * @returns The SCIM identity document, or `null` if no mapping exists.\n *\n * @example\n * ```ts\n * const scimGroup = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimIdentityGetByMappedGroup,\n *   { mappedGroupId: teamGroupId },\n * );\n * if (scimGroup) {\n *   console.log(\"SCIM external group ID:\", scimGroup.externalId);\n * }\n * ```\n */\nexport const enterpriseScimIdentityGetByMappedGroup = query({\n  args: { mappedGroupId: v.id(\"Group\") },\n  returns: v.union(vEnterpriseScimIdentityDoc, v.null()),\n  handler: async (ctx, { mappedGroupId }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"mapped_group_id\", (idx) =>\n        idx.eq(\"mappedGroupId\", mappedGroupId),\n      )\n      .first();\n  },\n});\n\n/**\n * List all SCIM identities belonging to a specific enterprise.\n *\n * Returns all `EnterpriseScimIdentity` documents for the given enterprise,\n * including both user and group resource types. Useful for displaying all\n * SCIM-provisioned resources or for bulk operations.\n *\n * @param args.enterpriseId - The ID of the enterprise whose SCIM identities to list.\n * @returns An array of SCIM identity documents.\n *\n * @example\n * ```ts\n * const identities = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseScimIdentityListByEnterprise,\n *   { enterpriseId },\n * );\n * const users = identities.filter((i) => i.resourceType === \"user\");\n * const groups = identities.filter((i) => i.resourceType === \"group\");\n * ```\n */\nexport const enterpriseScimIdentityListByEnterprise = query({\n  args: { enterpriseId: v.id(\"Enterprise\") },\n  returns: v.array(vEnterpriseScimIdentityDoc),\n  handler: async (ctx, { enterpriseId }) => {\n    return await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"enterprise_id\", (idx) => idx.eq(\"enterpriseId\", enterpriseId))\n      .collect();\n  },\n});\n\n/**\n * Create or update a SCIM-provisioned identity record.\n *\n * If a SCIM identity with the same `(enterpriseId, resourceType, externalId)`\n * already exists, its fields are patched in place. Otherwise a new record is\n * created. This is the core upsert used by the SCIM provisioning handler to\n * sync users and groups from external identity providers.\n *\n * @param args.enterpriseId - The ID of the enterprise the identity belongs to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.resourceType - The SCIM resource type: `\"user\"` or `\"group\"`.\n * @param args.externalId - The external identifier assigned by the identity provider.\n * @param args.userId - An optional link to the internal user document (for user resources).\n * @param args.mappedGroupId - An optional link to an internal group document (for group resources).\n * @param args.lastProvisionedAt - An optional epoch timestamp (ms) of the last sync.\n * @param args.active - An optional flag indicating whether the identity is active.\n * @param args.raw - An optional raw SCIM payload stored for debugging or re-processing.\n * @returns The ID of the created or updated `EnterpriseScimIdentity` document.\n *\n * @example\n * ```ts\n * const identityId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseScimIdentityUpsert,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     resourceType: \"user\",\n *     externalId: \"okta-user-abc123\",\n *     userId,\n *     active: true,\n *     lastProvisionedAt: Date.now(),\n *     raw: { schemas: [\"urn:ietf:params:scim:schemas:core:2.0:User\"], userName: \"jane@acme.com\" },\n *   },\n * );\n * ```\n */\nexport const enterpriseScimIdentityUpsert = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    resourceType: vScimResourceType,\n    externalId: v.string(),\n    userId: v.optional(v.id(\"User\")),\n    mappedGroupId: v.optional(v.id(\"Group\")),\n    lastProvisionedAt: v.optional(v.number()),\n    active: v.optional(v.boolean()),\n    raw: v.optional(v.any()),\n  },\n  returns: v.id(\"EnterpriseScimIdentity\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseScimIdentity\")\n      .withIndex(\"enterprise_id_resource_type_external_id\", (idx) =>\n        idx\n          .eq(\"enterpriseId\", args.enterpriseId)\n          .eq(\"resourceType\", args.resourceType)\n          .eq(\"externalId\", args.externalId),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.patch(existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"EnterpriseScimIdentity\", args);\n  },\n});\n\n/**\n * Permanently delete a SCIM identity record.\n *\n * Removes the `EnterpriseScimIdentity` document. This is typically called\n * when a SCIM DELETE request is received for a user or group resource.\n *\n * @param args.identityId - The document ID of the SCIM identity to delete.\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseScimIdentityDelete,\n *   { identityId: scimIdentity._id },\n * );\n * ```\n */\nexport const enterpriseScimIdentityDelete = mutation({\n  args: { identityId: v.id(\"EnterpriseScimIdentity\") },\n  returns: v.null(),\n  handler: async (ctx, { identityId }) => {\n    await ctx.db.delete(identityId);\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,MAAa,6BAA6B,SAAS;CACjD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,QAAQ;EACR,UAAU,EAAE,QAAQ;EACpB,WAAW,EAAE,QAAQ;EACrB,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC;EACrC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC;EAC5B;CACD,SAAS,EAAE,GAAG,uBAAuB;CACrC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,uBAAuB,CAC7B,UAAU,kBAAkB,QAC3B,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAC1C,CACA,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK;AACtC,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,wBAAwB,KAAK;;CAE3D,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,sCAAsC,MAAM;CACvD,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,EAAE;CAC1C,SAAS,EAAE,MAAM,0BAA0B,EAAE,MAAM,CAAC;CACpD,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,qCAAqC,MAAM;CACtD,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE;CAC/B,SAAS,EAAE,MAAM,0BAA0B,EAAE,MAAM,CAAC;CACpD,SAAS,OAAO,KAAK,EAAE,gBAAgB;AACrC,SAAO,MAAM,IAAI,GACd,MAAM,uBAAuB,CAC7B,UAAU,eAAe,QAAQ,IAAI,GAAG,aAAa,UAAU,CAAC,CAChE,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;AA0BF,MAAa,4BAA4B,MAAM;CAC7C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,cAAc;EACd,YAAY,EAAE,QAAQ;EACvB;CACD,SAAS,EAAE,MAAM,4BAA4B,EAAE,MAAM,CAAC;CACtD,SAAS,OAAO,KAAK,SAAS;AAC5B,SAAO,MAAM,IAAI,GACd,MAAM,yBAAyB,CAC/B,UAAU,4CAA4C,QACrD,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,cAAc,KAAK,WAAW,CACrC,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;AAuBF,MAAa,kCAAkC,MAAM;CACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE;CAC9B,SAAS,EAAE,MAAM,4BAA4B,EAAE,MAAM,CAAC;CACtD,SAAS,OAAO,KAAK,EAAE,aAAa;AAClC,SAAO,MAAM,IAAI,GACd,MAAM,yBAAyB,CAC/B,UAAU,YAAY,QAAQ,IAAI,GAAG,UAAU,OAAO,CAAC,CACvD,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;AAqBF,MAAa,+CAA+C,MAAM;CAChE,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,QAAQ,EAAE,GAAG,OAAO;EACrB;CACD,SAAS,EAAE,MAAM,4BAA4B,EAAE,MAAM,CAAC;CACtD,SAAS,OAAO,KAAK,EAAE,cAAc,aAAa;AAChD,SAAO,MAAM,IAAI,GACd,MAAM,yBAAyB,CAC/B,UAAU,0BAA0B,QACnC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,UAAU,OAAO,CAC1D,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;;AAuBF,MAAa,yCAAyC,MAAM;CAC1D,MAAM,EAAE,eAAe,EAAE,GAAG,QAAQ,EAAE;CACtC,SAAS,EAAE,MAAM,4BAA4B,EAAE,MAAM,CAAC;CACtD,SAAS,OAAO,KAAK,EAAE,oBAAoB;AACzC,SAAO,MAAM,IAAI,GACd,MAAM,yBAAyB,CAC/B,UAAU,oBAAoB,QAC7B,IAAI,GAAG,iBAAiB,cAAc,CACvC,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;;;AAsBF,MAAa,yCAAyC,MAAM;CAC1D,MAAM,EAAE,cAAc,EAAE,GAAG,aAAa,EAAE;CAC1C,SAAS,EAAE,MAAM,2BAA2B;CAC5C,SAAS,OAAO,KAAK,EAAE,mBAAmB;AACxC,SAAO,MAAM,IAAI,GACd,MAAM,yBAAyB,CAC/B,UAAU,kBAAkB,QAAQ,IAAI,GAAG,gBAAgB,aAAa,CAAC,CACzE,SAAS;;CAEf,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCF,MAAa,+BAA+B,SAAS;CACnD,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,cAAc;EACd,YAAY,EAAE,QAAQ;EACtB,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;EAChC,eAAe,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;EACxC,mBAAmB,EAAE,SAAS,EAAE,QAAQ,CAAC;EACzC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC;EAC/B,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;EACzB;CACD,SAAS,EAAE,GAAG,yBAAyB;CACvC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,yBAAyB,CAC/B,UAAU,4CAA4C,QACrD,IACG,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,gBAAgB,KAAK,aAAa,CACrC,GAAG,cAAc,KAAK,WAAW,CACrC,CACA,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK;AACtC,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,0BAA0B,KAAK;;CAE7D,CAAC;;;;;;;;;;;;;;;;;;AAmBF,MAAa,+BAA+B,SAAS;CACnD,MAAM,EAAE,YAAY,EAAE,GAAG,yBAAyB,EAAE;CACpD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,iBAAiB;AACtC,QAAM,IAAI,GAAG,OAAO,WAAW;AAC/B,SAAO;;CAEV,CAAC"}

package/dist/component/public/enterprise/secrets.d.ts

@@ -0,0 +1,78 @@
+declare namespace secrets_d_exports {
+  export { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert };
+}
+/**
+ * Create or update an encrypted secret for an enterprise.
+ *
+ * Stores a secret identified by the combination of `(enterpriseId, kind)`.
+ * If a secret of the same kind already exists for the enterprise, it is
+ * updated with the new ciphertext and timestamp. Otherwise a new secret
+ * document is created. Only one secret per kind is allowed per enterprise.
+ *
+ * @param args.enterpriseId - The ID of the enterprise the secret belongs to.
+ * @param args.groupId - The ID of the root group that owns the enterprise.
+ * @param args.kind - The type of secret being stored (e.g. `"oidc_client_secret"`).
+ * @param args.ciphertext - The encrypted secret value.
+ * @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.
+ * @returns The ID of the created or updated `EnterpriseSecret` document.
+ *
+ * @example
+ * ```ts
+ * const secretId = await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseSecretUpsert,
+ *   {
+ *     enterpriseId,
+ *     groupId: orgGroupId,
+ *     kind: "oidc_client_secret",
+ *     ciphertext: "encrypted:aes256:...",
+ *     updatedAt: Date.now(),
+ *   },
+ * );
+ * ```
+ */
+declare const enterpriseSecretUpsert: any;
+/**
+ * Retrieve an encrypted secret for an enterprise by kind.
+ *
+ * Looks up the secret using the composite `(enterpriseId, kind)` index.
+ * Returns the full document including the ciphertext, or `null` if no secret
+ * of that kind has been stored for the enterprise.
+ *
+ * @param args.enterpriseId - The ID of the enterprise whose secret to retrieve.
+ * @param args.kind - The type of secret to look up (e.g. `"oidc_client_secret"`).
+ * @returns The enterprise secret document, or `null` if not found.
+ *
+ * @example
+ * ```ts
+ * const secret = await ctx.runQuery(
+ *   components.auth.enterprise.enterpriseSecretGet,
+ *   { enterpriseId, kind: "oidc_client_secret" },
+ * );
+ * if (secret) {
+ *   const plaintext = decrypt(secret.ciphertext);
+ * }
+ * ```
+ */
+declare const enterpriseSecretGet: any;
+/**
+ * Delete an encrypted secret for an enterprise by kind.
+ *
+ * Removes the secret document matching the `(enterpriseId, kind)` pair.
+ * If no such secret exists, this is a no-op.
+ *
+ * @param args.enterpriseId - The ID of the enterprise whose secret to delete.
+ * @param args.kind - The type of secret to remove (e.g. `"oidc_client_secret"`).
+ * @returns `null` on success.
+ *
+ * @example
+ * ```ts
+ * await ctx.runMutation(
+ *   components.auth.enterprise.enterpriseSecretDelete,
+ *   { enterpriseId, kind: "oidc_client_secret" },
+ * );
+ * ```
+ */
+declare const enterpriseSecretDelete: any;
+//#endregion
+export { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert, secrets_d_exports };
+//# sourceMappingURL=secrets.d.ts.map

package/dist/component/public/enterprise/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","names":[],"sources":["../../../../src/component/public/enterprise/secrets.ts"],"mappings":";;;;;;;;;;;AAiCA;;;;;AA8CA;;;;;AAkCA;;;;;;;;;;;cAhFa,sBAAA;;;;;;;;;;;;;;;;;;;;;;;cA8CA,mBAAA;;;;;;;;;;;;;;;;;;;cAkCA,sBAAA"}

package/dist/component/public/enterprise/secrets.js

@@ -0,0 +1,118 @@
+import { mutation, query } from "../../functions.js";
+import { vEnterpriseSecretDoc, vEnterpriseSecretKind } from "../../model.js";
+import { v } from "convex/values";
+
+//#region src/component/public/enterprise/secrets.ts
+/**
+* Create or update an encrypted secret for an enterprise.
+*
+* Stores a secret identified by the combination of `(enterpriseId, kind)`.
+* If a secret of the same kind already exists for the enterprise, it is
+* updated with the new ciphertext and timestamp. Otherwise a new secret
+* document is created. Only one secret per kind is allowed per enterprise.
+*
+* @param args.enterpriseId - The ID of the enterprise the secret belongs to.
+* @param args.groupId - The ID of the root group that owns the enterprise.
+* @param args.kind - The type of secret being stored (e.g. `"oidc_client_secret"`).
+* @param args.ciphertext - The encrypted secret value.
+* @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.
+* @returns The ID of the created or updated `EnterpriseSecret` document.
+*
+* @example
+* ```ts
+* const secretId = await ctx.runMutation(
+*   components.auth.enterprise.enterpriseSecretUpsert,
+*   {
+*     enterpriseId,
+*     groupId: orgGroupId,
+*     kind: "oidc_client_secret",
+*     ciphertext: "encrypted:aes256:...",
+*     updatedAt: Date.now(),
+*   },
+* );
+* ```
+*/
+const enterpriseSecretUpsert = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		groupId: v.id("Group"),
+		kind: vEnterpriseSecretKind,
+		ciphertext: v.string(),
+		updatedAt: v.number()
+	},
+	returns: v.id("EnterpriseSecret"),
+	handler: async (ctx, args) => {
+		const existing = await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", args.enterpriseId).eq("kind", args.kind)).first();
+		if (existing) {
+			await ctx.db.patch(existing._id, args);
+			return existing._id;
+		}
+		return await ctx.db.insert("EnterpriseSecret", args);
+	}
+});
+/**
+* Retrieve an encrypted secret for an enterprise by kind.
+*
+* Looks up the secret using the composite `(enterpriseId, kind)` index.
+* Returns the full document including the ciphertext, or `null` if no secret
+* of that kind has been stored for the enterprise.
+*
+* @param args.enterpriseId - The ID of the enterprise whose secret to retrieve.
+* @param args.kind - The type of secret to look up (e.g. `"oidc_client_secret"`).
+* @returns The enterprise secret document, or `null` if not found.
+*
+* @example
+* ```ts
+* const secret = await ctx.runQuery(
+*   components.auth.enterprise.enterpriseSecretGet,
+*   { enterpriseId, kind: "oidc_client_secret" },
+* );
+* if (secret) {
+*   const plaintext = decrypt(secret.ciphertext);
+* }
+* ```
+*/
+const enterpriseSecretGet = query({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		kind: vEnterpriseSecretKind
+	},
+	returns: v.union(vEnterpriseSecretDoc, v.null()),
+	handler: async (ctx, { enterpriseId, kind }) => {
+		return await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", enterpriseId).eq("kind", kind)).first();
+	}
+});
+/**
+* Delete an encrypted secret for an enterprise by kind.
+*
+* Removes the secret document matching the `(enterpriseId, kind)` pair.
+* If no such secret exists, this is a no-op.
+*
+* @param args.enterpriseId - The ID of the enterprise whose secret to delete.
+* @param args.kind - The type of secret to remove (e.g. `"oidc_client_secret"`).
+* @returns `null` on success.
+*
+* @example
+* ```ts
+* await ctx.runMutation(
+*   components.auth.enterprise.enterpriseSecretDelete,
+*   { enterpriseId, kind: "oidc_client_secret" },
+* );
+* ```
+*/
+const enterpriseSecretDelete = mutation({
+	args: {
+		enterpriseId: v.id("Enterprise"),
+		kind: vEnterpriseSecretKind
+	},
+	returns: v.null(),
+	handler: async (ctx, { enterpriseId, kind }) => {
+		const existing = await ctx.db.query("EnterpriseSecret").withIndex("enterprise_id_kind", (idx) => idx.eq("enterpriseId", enterpriseId).eq("kind", kind)).first();
+		if (existing) await ctx.db.delete(existing._id);
+		return null;
+	}
+});
+
+//#endregion
+export { enterpriseSecretDelete, enterpriseSecretGet, enterpriseSecretUpsert };
+//# sourceMappingURL=secrets.js.map

package/dist/component/public/enterprise/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","names":[],"sources":["../../../../src/component/public/enterprise/secrets.ts"],"sourcesContent":["import { v } from \"convex/values\";\nimport { mutation, query } from \"../../functions\";\nimport { vEnterpriseSecretDoc, vEnterpriseSecretKind } from \"../../model\";\n\n/**\n * Create or update an encrypted secret for an enterprise.\n *\n * Stores a secret identified by the combination of `(enterpriseId, kind)`.\n * If a secret of the same kind already exists for the enterprise, it is\n * updated with the new ciphertext and timestamp. Otherwise a new secret\n * document is created. Only one secret per kind is allowed per enterprise.\n *\n * @param args.enterpriseId - The ID of the enterprise the secret belongs to.\n * @param args.groupId - The ID of the root group that owns the enterprise.\n * @param args.kind - The type of secret being stored (e.g. `\"oidc_client_secret\"`).\n * @param args.ciphertext - The encrypted secret value.\n * @param args.updatedAt - Epoch timestamp (ms) when the secret was last updated.\n * @returns The ID of the created or updated `EnterpriseSecret` document.\n *\n * @example\n * ```ts\n * const secretId = await ctx.runMutation(\n *   components.auth.enterprise.enterpriseSecretUpsert,\n *   {\n *     enterpriseId,\n *     groupId: orgGroupId,\n *     kind: \"oidc_client_secret\",\n *     ciphertext: \"encrypted:aes256:...\",\n *     updatedAt: Date.now(),\n *   },\n * );\n * ```\n */\nexport const enterpriseSecretUpsert = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    groupId: v.id(\"Group\"),\n    kind: vEnterpriseSecretKind,\n    ciphertext: v.string(),\n    updatedAt: v.number(),\n  },\n  returns: v.id(\"EnterpriseSecret\"),\n  handler: async (ctx, args) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", args.enterpriseId).eq(\"kind\", args.kind),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.patch(existing._id, args);\n      return existing._id;\n    }\n    return await ctx.db.insert(\"EnterpriseSecret\", args);\n  },\n});\n\n/**\n * Retrieve an encrypted secret for an enterprise by kind.\n *\n * Looks up the secret using the composite `(enterpriseId, kind)` index.\n * Returns the full document including the ciphertext, or `null` if no secret\n * of that kind has been stored for the enterprise.\n *\n * @param args.enterpriseId - The ID of the enterprise whose secret to retrieve.\n * @param args.kind - The type of secret to look up (e.g. `\"oidc_client_secret\"`).\n * @returns The enterprise secret document, or `null` if not found.\n *\n * @example\n * ```ts\n * const secret = await ctx.runQuery(\n *   components.auth.enterprise.enterpriseSecretGet,\n *   { enterpriseId, kind: \"oidc_client_secret\" },\n * );\n * if (secret) {\n *   const plaintext = decrypt(secret.ciphertext);\n * }\n * ```\n */\nexport const enterpriseSecretGet = query({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    kind: vEnterpriseSecretKind,\n  },\n  returns: v.union(vEnterpriseSecretDoc, v.null()),\n  handler: async (ctx, { enterpriseId, kind }) => {\n    return await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", enterpriseId).eq(\"kind\", kind),\n      )\n      .first();\n  },\n});\n\n/**\n * Delete an encrypted secret for an enterprise by kind.\n *\n * Removes the secret document matching the `(enterpriseId, kind)` pair.\n * If no such secret exists, this is a no-op.\n *\n * @param args.enterpriseId - The ID of the enterprise whose secret to delete.\n * @param args.kind - The type of secret to remove (e.g. `\"oidc_client_secret\"`).\n * @returns `null` on success.\n *\n * @example\n * ```ts\n * await ctx.runMutation(\n *   components.auth.enterprise.enterpriseSecretDelete,\n *   { enterpriseId, kind: \"oidc_client_secret\" },\n * );\n * ```\n */\nexport const enterpriseSecretDelete = mutation({\n  args: {\n    enterpriseId: v.id(\"Enterprise\"),\n    kind: vEnterpriseSecretKind,\n  },\n  returns: v.null(),\n  handler: async (ctx, { enterpriseId, kind }) => {\n    const existing = await ctx.db\n      .query(\"EnterpriseSecret\")\n      .withIndex(\"enterprise_id_kind\", (idx) =>\n        idx.eq(\"enterpriseId\", enterpriseId).eq(\"kind\", kind),\n      )\n      .first();\n    if (existing) {\n      await ctx.db.delete(existing._id);\n    }\n    return null;\n  },\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiCA,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,SAAS,EAAE,GAAG,QAAQ;EACtB,MAAM;EACN,YAAY,EAAE,QAAQ;EACtB,WAAW,EAAE,QAAQ;EACtB;CACD,SAAS,EAAE,GAAG,mBAAmB;CACjC,SAAS,OAAO,KAAK,SAAS;EAC5B,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,KAAK,aAAa,CAAC,GAAG,QAAQ,KAAK,KAAK,CAChE,CACA,OAAO;AACV,MAAI,UAAU;AACZ,SAAM,IAAI,GAAG,MAAM,SAAS,KAAK,KAAK;AACtC,UAAO,SAAS;;AAElB,SAAO,MAAM,IAAI,GAAG,OAAO,oBAAoB,KAAK;;CAEvD,CAAC;;;;;;;;;;;;;;;;;;;;;;;AAwBF,MAAa,sBAAsB,MAAM;CACvC,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,MAAM;EACP;CACD,SAAS,EAAE,MAAM,sBAAsB,EAAE,MAAM,CAAC;CAChD,SAAS,OAAO,KAAK,EAAE,cAAc,WAAW;AAC9C,SAAO,MAAM,IAAI,GACd,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,QAAQ,KAAK,CACtD,CACA,OAAO;;CAEb,CAAC;;;;;;;;;;;;;;;;;;;AAoBF,MAAa,yBAAyB,SAAS;CAC7C,MAAM;EACJ,cAAc,EAAE,GAAG,aAAa;EAChC,MAAM;EACP;CACD,SAAS,EAAE,MAAM;CACjB,SAAS,OAAO,KAAK,EAAE,cAAc,WAAW;EAC9C,MAAM,WAAW,MAAM,IAAI,GACxB,MAAM,mBAAmB,CACzB,UAAU,uBAAuB,QAChC,IAAI,GAAG,gBAAgB,aAAa,CAAC,GAAG,QAAQ,KAAK,CACtD,CACA,OAAO;AACV,MAAI,SACF,OAAM,IAAI,GAAG,OAAO,SAAS,IAAI;AAEnC,SAAO;;CAEV,CAAC"}