@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/mounts.js

@@ -1,7 +1,6 @@
-import { enterpriseConnectionWhereValidator, enterpriseDomainInputValidator, enterpriseDomainVerificationInputValidator, enterprisePolicyPatchValidator, enterpriseSamlAttributeMappingValidator, enterpriseSamlSpValidator, enterpriseStatusValidator } from "./enterprise/validators.js";
-import { Cv } from "@robelest/fx/convex";
-import { actionGeneric, mutationGeneric, queryGeneric } from "convex/server";
+import { groupConnectionDomainInputValidator, groupConnectionDomainVerificationInputValidator, groupConnectionStatusValidator, groupConnectionWhereValidator, groupPolicyPatchValidator, ssoSamlAttributeMappingValidator, ssoSamlSecurityValidator, ssoSamlSpValidator } from "./sso/validators.js";
 import { ConvexError, v } from "convex/values";
+import { actionGeneric, mutationGeneric, queryGeneric } from "convex/server";
 
 //#region src/server/mounts.ts
 function requireSignedInUser(auth) {
@@ -9,65 +8,82 @@ function requireSignedInUser(auth) {
 		return (await auth.context(ctx, { optional: true })).userId;
 	};
 }
-function normalizeCreatorRoleIds(roles) {
-	return roles?.map((role) => typeof role === "string" ? role : role.id);
-}
-async function resolveMountedEnterpriseTarget(auth, ctx, target) {
+async function resolveMountedGroupTarget(auth, ctx, target) {
 	if (target.groupId !== void 0) return {
-		enterpriseId: target.enterpriseId,
-		groupId: target.groupId,
-		resolvedGroupId: target.groupId
+		connectionId: target.connectionId,
+		groupId: target.groupId
 	};
-	if (target.enterpriseId !== void 0) {
-		const enterprise = await auth.sso.admin.connection.get(ctx, target.enterpriseId);
-		if (enterprise === null) throw new ConvexError({
+	if (target.connectionId !== void 0) {
+		const connection = await auth.group.sso.connection.get(ctx, target.connectionId);
+		if (connection === null) throw new ConvexError({
 			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
+			message: "Connection not found."
 		});
 		return {
-			enterpriseId: enterprise._id,
-			groupId: enterprise.groupId,
-			resolvedGroupId: enterprise.groupId
+			connectionId: connection._id,
+			groupId: connection.groupId
 		};
 	}
 	if (target.domain !== void 0) {
-		const resolved = await auth.sso.admin.connection.getByDomain(ctx, target.domain);
-		if (resolved?.enterprise === void 0) throw new ConvexError({
+		const resolved = await auth.group.sso.connection.getByDomain(ctx, target.domain);
+		if (resolved?.connection == null) throw new ConvexError({
 			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
+			message: "Connection not found."
 		});
 		return {
-			enterpriseId: resolved.enterprise._id,
-			groupId: resolved.enterprise.groupId,
-			resolvedGroupId: resolved.enterprise.groupId
+			connectionId: resolved.connection._id,
+			groupId: resolved.connection.groupId
 		};
 	}
 	return {
-		enterpriseId: void 0,
-		groupId: void 0,
-		resolvedGroupId: null
+		connectionId: void 0,
+		groupId: void 0
 	};
 }
+function resolveRequiredAccess(permissions, permission) {
+	const ssoRequire = permissions.sso?.require;
+	const scimRequire = permissions.scim?.require;
+	switch (permission) {
+		case "sso.connection.create": return permissions.sso?.connection?.create ?? ssoRequire;
+		case "sso.connection.read": return permissions.sso?.connection?.read ?? ssoRequire;
+		case "sso.connection.manage": return permissions.sso?.connection?.manage ?? ssoRequire;
+		case "sso.domain.manage": return permissions.sso?.domain?.manage ?? ssoRequire;
+		case "sso.protocol.manage": return permissions.sso?.protocol?.manage ?? ssoRequire;
+		case "sso.policy.manage": return permissions.sso?.policy?.manage ?? ssoRequire;
+		case "sso.audit.read": return permissions.sso?.audit?.read ?? ssoRequire;
+		case "sso.webhook.manage": return permissions.sso?.webhook?.manage ?? ssoRequire;
+		case "scim.manage": return permissions.scim?.manage ?? scimRequire;
+	}
+}
 function createMountedAdminAuthorizer(auth, options) {
 	const requireUserId = requireSignedInUser(auth);
 	return async (ctx, permission, target = {}) => {
 		const userId = await requireUserId(ctx);
-		if (userId === null) throw Cv.error({
+		if (userId === null) throw new ConvexError({
 			code: "NOT_SIGNED_IN",
 			message: "You must be signed in to perform this action."
 		});
-		if (!options?.admin?.authorized) throw Cv.error({
+		if (!options) throw new ConvexError({
 			code: "FORBIDDEN",
 			message: "Access denied."
 		});
-		const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-		await options.admin.authorized(ctx, {
+		const resolved = await resolveMountedGroupTarget(auth, ctx, target);
+		const input = {
 			userId,
 			permission,
-			enterpriseId: resolved.enterpriseId,
-			groupId: resolved.groupId,
-			resolvedGroupId: resolved.resolvedGroupId
-		});
+			connectionId: resolved.connectionId,
+			groupId: resolved.groupId
+		};
+		if (options.permissions === void 0) {
+			await options.access(ctx, input);
+			return {
+				userId,
+				...resolved
+			};
+		}
+		const required = resolveRequiredAccess(options.permissions, permission);
+		if (required === void 0) throw new Error(`Missing permissions entry for mounted Group SSO permission: ${permission}`);
+		await options.access(ctx, input, required);
 		return {
 			userId,
 			...resolved
@@ -76,15 +92,17 @@ function createMountedAdminAuthorizer(auth, options) {
 }
 /**
 * Build optional public SSO management actions that apps can mount under
-* `convex/auth/sso/**` when they want client-callable enterprise APIs.
+* `convex/auth/sso/**` when they want client-callable group SSO APIs.
 *
 * `admin` is for tenant-admin control-plane operations and should be mounted
-* with an explicit authorization policy. `client` is for end-user sign-in
+* with an explicit access policy. `client` is for end-user sign-in
 * helpers and does not require tenant-admin authorization.
 *
 * @param auth - Auth API subset providing `group`, `member`, `sso`, and `user` namespaces.
-* @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+* @param options - Optional admin access config. See {@link CreateAuthGroupSsoOptions}.
 * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+* @typeParam TRequirement - App-defined requirement values used by declarative
+*   `permissions` configs.
 * @returns An object with `admin` (connection CRUD, OIDC/SAML protocol config, policy,
 *   audit, webhooks, domain management) and `client` (signIn, metadata) namespaces.
 *
@@ -95,9 +113,10 @@ function createMountedAdminAuthorizer(auth, options) {
 * import { auth } from "../auth";
 *
 * const mounted = sso(auth, {
-*   admin: {
-*     authorized: async (ctx, input) => { /* check permissions *\/ },
+*   permissions: {
+*     sso: { require: ["workspace.sso.manage"] },
 *   },
+*   access: async (_ctx, _input, _required) => {},
 * });
 *
 * export const createConnection = mounted.admin.connection.create;
@@ -105,76 +124,58 @@ function createMountedAdminAuthorizer(auth, options) {
 * ```
 *
 * @see {@link scim}
-* @see {@link enterprise}
+* @see {@link createAuthGroupSso}
 */
 function sso(auth, options) {
 	const authorize = createMountedAdminAuthorizer(auth, options);
-	const adminRoleIds = normalizeCreatorRoleIds(options?.admin?.roles);
 	return {
 		admin: {
 			connection: {
 				create: mutationGeneric({
 					args: {
-						groupId: v.optional(v.string()),
+						groupId: v.string(),
 						name: v.optional(v.string()),
 						slug: v.optional(v.string()),
-						status: v.optional(enterpriseStatusValidator),
+						protocol: v.union(v.literal("oidc"), v.literal("saml")),
+						status: v.optional(groupConnectionStatusValidator),
 						domain: v.optional(v.string())
 					},
 					handler: async (ctx, args) => {
-						const { userId } = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
-						const createsGroup = args.groupId === void 0;
-						const groupId = args.groupId ?? (await auth.group.create(ctx, {
-							name: args.name?.trim() || args.slug?.trim() || "Enterprise",
-							slug: args.slug,
-							type: "enterprise"
-						})).groupId;
-						if (createsGroup) await auth.member.create(ctx, {
-							groupId,
-							userId,
-							roleIds: adminRoleIds
-						});
-						const created = await auth.sso.admin.connection.create(ctx, {
-							groupId,
+						await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
+						const created = await auth.group.sso.connection.create(ctx, {
+							groupId: args.groupId,
 							name: args.name,
 							slug: args.slug,
+							protocol: args.protocol,
 							status: args.status
 						});
-						if (args.domain) await auth.sso.admin.connection.domain.set(ctx, created.enterpriseId, [{
+						if (args.domain) await auth.group.sso.connection.domain.set(ctx, created.connectionId, [{
 							domain: args.domain,
 							isPrimary: true
 						}]);
 						return {
 							...created,
-							groupId,
-							createdGroup: createsGroup
+							groupId: args.groupId
 						};
 					}
 				}),
 				get: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.connection.get(ctx, args.enterpriseId);
-					}
-				}),
-				getByGroup: queryGeneric({
-					args: { groupId: v.string() },
-					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { groupId: args.groupId });
-						return await auth.sso.admin.connection.getByGroup(ctx, args.groupId);
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.connection.get(ctx, args.connectionId);
 					}
 				}),
 				getByDomain: queryGeneric({
 					args: { domain: v.string() },
 					handler: async (ctx, args) => {
 						await authorize(ctx, "sso.connection.read", { domain: args.domain });
-						return await auth.sso.admin.connection.getByDomain(ctx, args.domain);
+						return await auth.group.sso.connection.getByDomain(ctx, args.domain);
 					}
 				}),
 				list: queryGeneric({
 					args: {
-						where: v.optional(enterpriseConnectionWhereValidator),
+						where: v.optional(groupConnectionWhereValidator),
 						limit: v.optional(v.number()),
 						cursor: v.optional(v.union(v.string(), v.null())),
 						orderBy: v.optional(v.string()),
@@ -182,76 +183,83 @@ function sso(auth, options) {
 					},
 					handler: async (ctx, args) => {
 						await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId });
-						return await auth.sso.admin.connection.list(ctx, args);
+						return await auth.group.sso.connection.list(ctx, args);
 					}
 				}),
 				update: mutationGeneric({
 					args: {
-						enterpriseId: v.string(),
+						connectionId: v.string(),
 						data: v.object({
 							name: v.optional(v.string()),
 							slug: v.optional(v.string()),
-							status: v.optional(enterpriseStatusValidator)
+							status: v.optional(groupConnectionStatusValidator)
 						})
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						await auth.sso.admin.connection.update(ctx, args.enterpriseId, args.data);
-						return { enterpriseId: args.enterpriseId };
+						await authorize(ctx, "sso.connection.manage", { connectionId: args.connectionId });
+						await auth.group.sso.connection.update(ctx, args.connectionId, args.data);
+						return { connectionId: args.connectionId };
 					}
 				}),
 				delete: mutationGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.connection.delete(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.connection.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.connection.delete(ctx, args.connectionId);
 					}
 				}),
 				status: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.connection.status(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.connection.status(ctx, args.connectionId);
 					}
 				}),
 				domain: {
 					list: queryGeneric({
-						args: { enterpriseId: v.string() },
+						args: { connectionId: v.string() },
+						handler: async (ctx, args) => {
+							await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+							return await auth.group.sso.connection.domain.list(ctx, args.connectionId);
+						}
+					}),
+					status: queryGeneric({
+						args: { connectionId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
-							return await auth.sso.admin.connection.domain.list(ctx, args.enterpriseId);
+							await authorize(ctx, "sso.domain.manage", { connectionId: args.connectionId });
+							return await auth.group.sso.connection.domain.status(ctx, args.connectionId);
 						}
 					}),
 					validate: queryGeneric({
-						args: { enterpriseId: v.string() },
+						args: { connectionId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-							return await auth.sso.admin.connection.domain.validate(ctx, args.enterpriseId);
+							await authorize(ctx, "sso.domain.manage", { connectionId: args.connectionId });
+							return await auth.group.sso.connection.domain.validate(ctx, args.connectionId);
 						}
 					}),
 					set: mutationGeneric({
 						args: {
-							enterpriseId: v.string(),
-							domains: v.array(enterpriseDomainInputValidator)
+							connectionId: v.string(),
+							domains: v.array(groupConnectionDomainInputValidator)
 						},
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-							return await auth.sso.admin.connection.domain.set(ctx, args.enterpriseId, args.domains);
+							await authorize(ctx, "sso.domain.manage", { connectionId: args.connectionId });
+							return await auth.group.sso.connection.domain.set(ctx, args.connectionId, args.domains);
 						}
 					}),
 					verification: {
 						request: mutationGeneric({
-							args: enterpriseDomainVerificationInputValidator,
+							args: groupConnectionDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								return await auth.sso.admin.connection.domain.verification.request(ctx, args);
+								await authorize(ctx, "sso.domain.manage", { connectionId: args.connectionId });
+								return await auth.group.sso.connection.domain.verification.request(ctx, args);
 							}
 						}),
 						confirm: actionGeneric({
-							args: enterpriseDomainVerificationInputValidator,
+							args: groupConnectionDomainVerificationInputValidator,
 							handler: async (ctx, args) => {
-								await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								return await auth.sso.admin.connection.domain.verification.confirm(ctx, args);
+								await authorize(ctx, "sso.domain.manage", { connectionId: args.connectionId });
+								return await auth.group.sso.connection.domain.verification.confirm(ctx, args);
 							}
 						})
 					}
@@ -260,129 +268,197 @@ function sso(auth, options) {
 			oidc: {
 				configure: mutationGeneric({
 					args: {
-						enterpriseId: v.string(),
-						issuer: v.optional(v.string()),
-						discoveryUrl: v.optional(v.string()),
-						clientId: v.string(),
-						clientSecret: v.optional(v.string()),
-						scopes: v.optional(v.array(v.string())),
-						authorizationParams: v.optional(v.record(v.string(), v.string())),
-						clockToleranceSeconds: v.optional(v.number()),
-						strictIssuer: v.optional(v.boolean()),
-						extraFields: v.optional(v.record(v.string(), v.string()))
+						connectionId: v.string(),
+						discovery: v.object({
+							issuer: v.optional(v.string()),
+							discoveryUrl: v.optional(v.string()),
+							jwksUri: v.optional(v.string()),
+							audience: v.optional(v.union(v.string(), v.array(v.string())))
+						}),
+						client: v.object({
+							id: v.string(),
+							secret: v.optional(v.string()),
+							authMethod: v.optional(v.union(v.literal("client_secret_post"), v.literal("client_secret_basic")))
+						}),
+						request: v.optional(v.object({
+							scopes: v.optional(v.array(v.string())),
+							loginHint: v.optional(v.string()),
+							authorizationParams: v.optional(v.record(v.string(), v.string()))
+						})),
+						security: v.optional(v.object({
+							clockToleranceSeconds: v.optional(v.number()),
+							strictIssuer: v.optional(v.boolean())
+						})),
+						profile: v.optional(v.object({
+							mapping: v.optional(v.object({
+								subject: v.optional(v.string()),
+								email: v.optional(v.string()),
+								emailVerified: v.optional(v.string()),
+								name: v.optional(v.string()),
+								image: v.optional(v.string()),
+								groups: v.optional(v.string()),
+								roles: v.optional(v.string())
+							})),
+							extraFields: v.optional(v.record(v.string(), v.string()))
+						}))
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.oidc.configure(ctx, args);
+						await authorize(ctx, "sso.protocol.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.oidc.configure(ctx, {
+							...args,
+							connectionId: args.connectionId
+						});
 					}
 				}),
 				get: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.oidc.get(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.oidc.get(ctx, args.connectionId);
 					}
 				}),
 				validate: actionGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.oidc.validate(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.protocol.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.oidc.validate(ctx, args.connectionId);
+					}
+				}),
+				status: queryGeneric({
+					args: { connectionId: v.string() },
+					handler: async (ctx, args) => {
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.oidc.status(ctx, args.connectionId);
 					}
 				})
 			},
 			saml: {
 				configure: actionGeneric({
 					args: {
-						enterpriseId: v.string(),
-						metadataXml: v.optional(v.string()),
-						metadataUrl: v.optional(v.string()),
+						connectionId: v.string(),
+						metadata: v.object({
+							xml: v.optional(v.string()),
+							url: v.optional(v.string())
+						}),
 						domains: v.optional(v.array(v.string())),
-						signAuthnRequests: v.optional(v.boolean()),
-						attributeMapping: v.optional(enterpriseSamlAttributeMappingValidator),
-						sp: v.optional(enterpriseSamlSpValidator)
+						request: v.optional(v.object({
+							signAuthnRequests: v.optional(v.boolean()),
+							nameIdFormat: v.optional(v.string()),
+							forceAuthn: v.optional(v.boolean()),
+							authnContextClassRefs: v.optional(v.array(v.string()))
+						})),
+						profile: v.optional(v.object({
+							mapping: v.optional(ssoSamlAttributeMappingValidator),
+							extraFields: v.optional(v.record(v.string(), v.string()))
+						})),
+						security: v.optional(ssoSamlSecurityValidator),
+						serviceProvider: v.optional(ssoSamlSpValidator)
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.saml.configure(ctx, args);
+						await authorize(ctx, "sso.protocol.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.saml.configure(ctx, {
+							...args,
+							connectionId: args.connectionId
+						});
 					}
 				}),
 				validate: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { connectionId: v.string() },
+					handler: async (ctx, args) => {
+						await authorize(ctx, "sso.protocol.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.saml.validate(ctx, args.connectionId);
+					}
+				}),
+				get: queryGeneric({
+					args: { connectionId: v.string() },
+					handler: async (ctx, args) => {
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.saml.get(ctx, args.connectionId);
+					}
+				}),
+				status: queryGeneric({
+					args: { connectionId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.saml.validate(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.connection.read", { connectionId: args.connectionId });
+						return await auth.group.sso.saml.status(ctx, args.connectionId);
+					}
+				}),
+				refresh: actionGeneric({
+					args: { connectionId: v.string() },
+					handler: async (ctx, args) => {
+						await authorize(ctx, "sso.protocol.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.saml.refresh(ctx, args);
 					}
 				})
 			},
 			policy: {
 				get: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { groupId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.policy.get(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.policy.manage", { groupId: args.groupId });
+						return await auth.group.sso.policy.get(ctx, args.groupId);
 					}
 				}),
 				update: mutationGeneric({
 					args: {
-						enterpriseId: v.string(),
-						patch: enterprisePolicyPatchValidator
+						groupId: v.string(),
+						patch: groupPolicyPatchValidator
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.policy.update(ctx, args.enterpriseId, args.patch);
+						await authorize(ctx, "sso.policy.manage", { groupId: args.groupId });
+						return await auth.group.sso.policy.update(ctx, args.groupId, args.patch);
 					}
 				}),
 				validate: queryGeneric({
-					args: { enterpriseId: v.string() },
+					args: { groupId: v.string() },
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.policy.validate(ctx, args.enterpriseId);
+						await authorize(ctx, "sso.policy.manage", { groupId: args.groupId });
+						return await auth.group.sso.policy.validate(ctx, args.groupId);
 					}
 				})
 			},
 			audit: { list: queryGeneric({
 				args: {
-					enterpriseId: v.optional(v.string()),
 					groupId: v.optional(v.string()),
+					connectionId: v.optional(v.string()),
 					limit: v.optional(v.number())
 				},
 				handler: async (ctx, args) => {
 					await authorize(ctx, "sso.audit.read", {
-						enterpriseId: args.enterpriseId,
+						connectionId: args.connectionId,
 						groupId: args.groupId
 					});
-					return await auth.sso.admin.audit.list(ctx, args);
+					return await auth.group.sso.audit.list(ctx, args);
 				}
 			}) },
 			webhook: {
 				delivery: { list: queryGeneric({
 					args: {
-						enterpriseId: v.string(),
+						connectionId: v.string(),
 						limit: v.optional(v.number())
 					},
 					handler: async (ctx, args) => {
-						await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
-						return await auth.sso.admin.webhook.delivery.list(ctx, args);
+						await authorize(ctx, "sso.webhook.manage", { connectionId: args.connectionId });
+						return await auth.group.sso.webhook.delivery.list(ctx, args);
 					}
 				}) },
 				endpoint: {
 					create: mutationGeneric({
 						args: {
-							enterpriseId: v.string(),
+							connectionId: v.string(),
 							url: v.string(),
 							secret: v.string(),
 							subscriptions: v.array(v.string()),
 							createdByUserId: v.optional(v.string())
 						},
 						handler: async (ctx, args) => {
-							const { userId } = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
+							const { userId } = await authorize(ctx, "sso.webhook.manage", { connectionId: args.connectionId });
 							return {
-								_id: (await auth.sso.admin.webhook.endpoint.create(ctx, {
+								_id: (await auth.group.sso.webhook.endpoint.create(ctx, {
 									...args,
 									createdByUserId: args.createdByUserId ?? userId
 								})).endpointId,
-								enterpriseId: args.enterpriseId,
+								connectionId: args.connectionId,
 								url: args.url,
 								subscriptions: args.subscriptions,
 								createdByUserId: args.createdByUserId ?? userId,
@@ -392,10 +468,10 @@ function sso(auth, options) {
 						}
 					}),
 					list: queryGeneric({
-						args: { enterpriseId: v.string() },
+						args: { connectionId: v.string() },
 						handler: async (ctx, args) => {
-							await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
-							return (await auth.sso.admin.webhook.endpoint.list(ctx, args.enterpriseId)).map((endpoint) => {
+							await authorize(ctx, "sso.webhook.manage", { connectionId: args.connectionId });
+							return (await auth.group.sso.webhook.endpoint.list(ctx, args.connectionId)).map((endpoint) => {
 								const { secretHash: _secretHash, ...rest } = endpoint;
 								return rest;
 							});
@@ -404,16 +480,16 @@ function sso(auth, options) {
 					disable: mutationGeneric({
 						args: { endpointId: v.string() },
 						handler: async (ctx, args) => {
-							const endpoint = await auth.sso.admin.webhook.endpoint.get(ctx, args.endpointId);
-							if (!endpoint) throw Cv.error({
+							const endpoint = await auth.group.sso.webhook.endpoint.get(ctx, args.endpointId);
+							if (!endpoint) throw new ConvexError({
 								code: "INVALID_PARAMETERS",
 								message: "Webhook endpoint not found."
 							});
 							await authorize(ctx, "sso.webhook.manage", {
-								enterpriseId: endpoint.enterpriseId,
+								connectionId: endpoint.connectionId,
 								groupId: endpoint.groupId
 							});
-							return await auth.sso.admin.webhook.endpoint.disable(ctx, args.endpointId);
+							return await auth.group.sso.webhook.endpoint.disable(ctx, args.endpointId);
 						}
 					})
 				}
@@ -422,24 +498,31 @@ function sso(auth, options) {
 		client: {
 			signIn: queryGeneric({
 				args: {
-					enterpriseId: v.optional(v.string()),
+					connectionId: v.optional(v.string()),
 					email: v.optional(v.string()),
 					domain: v.optional(v.string()),
-					redirectTo: v.optional(v.string())
+					redirectTo: v.optional(v.string()),
+					loginHint: v.optional(v.string())
 				},
 				handler: async (ctx, args) => {
-					return await auth.sso.client.signIn(ctx, args);
+					return await auth.group.sso.signIn(ctx, {
+						...args,
+						connectionId: args.connectionId
+					});
 				}
 			}),
 			metadata: queryGeneric({
 				args: {
-					enterpriseId: v.string(),
+					connectionId: v.string(),
 					entityId: v.optional(v.string()),
 					acsUrl: v.optional(v.string()),
 					sloUrl: v.optional(v.string())
 				},
 				handler: async (ctx, args) => {
-					return await auth.sso.client.metadata(ctx, args);
+					return await auth.group.sso.metadata(ctx, {
+						...args,
+						connectionId: args.connectionId
+					});
 				}
 			})
 		}
@@ -447,23 +530,26 @@ function sso(auth, options) {
 }
 /**
 * Build optional public SCIM management actions that apps can mount under
-* `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
+* `convex/auth/group/**` when they want client-callable group SSO admin APIs.
 *
-* @param auth - Auth API subset providing `scim`, `sso`, and `user` namespaces.
-* @param options - Optional admin authorization config. See {@link EnterpriseMountOptions}.
+* @param auth - Auth API subset providing `group` and `context` namespaces.
+* @param options - Optional admin access config. See {@link CreateAuthGroupSsoOptions}.
 * @typeParam TAuthorization - Optional authorization config for typed role IDs.
+* @typeParam TRequirement - App-defined requirement values used by declarative
+*   `permissions` configs.
 * @returns An object with `admin.configure`, `admin.get`, and `admin.validate` actions.
 *
 * @example
 * ```ts
-* // convex/auth/scim.ts
+* // convex/auth/group.ts
 * import { scim } from "@robelest/convex-auth/server";
 * import { auth } from "../auth";
 *
 * const mounted = scim(auth, {
-*   admin: {
-*     authorized: async (ctx, input) => { /* check permissions *\/ },
+*   permissions: {
+*     scim: { require: ["workspace.scim.manage"] },
 *   },
+*   access: async (_ctx, _input, _required) => {},
 * });
 *
 * export const configure = mounted.admin.configure;
@@ -472,63 +558,91 @@ function sso(auth, options) {
 * ```
 *
 * @see {@link sso}
-* @see {@link enterprise}
+* @see {@link createAuthGroupSso}
 */
 function scim(auth, options) {
 	const authorize = createMountedAdminAuthorizer(auth, options);
 	return { admin: {
 		configure: mutationGeneric({
 			args: {
-				enterpriseId: v.string(),
-				basePath: v.optional(v.string()),
-				status: v.optional(enterpriseStatusValidator)
+				connectionId: v.string(),
+				status: v.optional(groupConnectionStatusValidator),
+				security: v.optional(v.object({ maxRequestSize: v.optional(v.number()) })),
+				profile: v.optional(v.object({
+					mapping: v.optional(v.object({
+						subject: v.optional(v.string()),
+						externalId: v.optional(v.string()),
+						email: v.optional(v.string()),
+						firstName: v.optional(v.string()),
+						lastName: v.optional(v.string()),
+						name: v.optional(v.string()),
+						phone: v.optional(v.string()),
+						active: v.optional(v.string()),
+						groups: v.optional(v.string()),
+						roles: v.optional(v.string())
+					})),
+					extraFields: v.optional(v.record(v.string(), v.string()))
+				}))
 			},
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
-				return await auth.scim.admin.configure(ctx, args);
+				await authorize(ctx, "scim.manage", { connectionId: args.connectionId });
+				return await auth.group.sso.scim.configure(ctx, {
+					...args,
+					connectionId: args.connectionId
+				});
 			}
 		}),
 		get: queryGeneric({
-			args: { enterpriseId: v.string() },
+			args: { connectionId: v.string() },
+			handler: async (ctx, args) => {
+				await authorize(ctx, "scim.manage", { connectionId: args.connectionId });
+				return await auth.group.sso.scim.get(ctx, args.connectionId);
+			}
+		}),
+		status: queryGeneric({
+			args: { connectionId: v.string() },
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
-				return await auth.scim.admin.get(ctx, args.enterpriseId);
+				await authorize(ctx, "scim.manage", { connectionId: args.connectionId });
+				return await auth.group.sso.scim.status(ctx, args.connectionId);
 			}
 		}),
 		validate: queryGeneric({
-			args: { enterpriseId: v.string() },
+			args: { connectionId: v.string() },
 			handler: async (ctx, args) => {
-				await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
-				return await auth.scim.admin.validate(ctx, args.enterpriseId);
+				await authorize(ctx, "scim.manage", { connectionId: args.connectionId });
+				return await auth.group.sso.scim.validate(ctx, args.connectionId);
 			}
 		})
 	} };
 }
 /**
-* Build a flat mounted enterprise API surface for app-owned Convex exports.
+* Build a flat mounted group SSO API surface for app-owned Convex exports.
 *
 * Combines {@link sso} and {@link scim} into a single flat object with
 * all SSO connection, protocol, policy, audit, webhook, and SCIM
-* management functions plus end-user sign-in helpers. The `authorized`
-* callback is required for all admin operations.
+* management functions plus end-user sign-in helpers. The `access`
+* config is required for all admin operations.
 *
-* @param auth - Auth API subset providing `group`, `member`, `scim`, `sso`, and `user` namespaces.
-* @param options - Required {@link EnterpriseMountOptions} with an `admin.authorized` callback.
+* @param auth - Auth API subset providing `group`, `member`, and `context` namespaces.
+* @param options - Required {@link CreateAuthGroupSsoOptions} with an `access` policy.
 * @typeParam TAuthorization - Optional authorization config for typed role IDs.
-* @returns A flat object with all enterprise management functions (e.g. `createConnection`,
+* @typeParam TRequirement - App-defined requirement values used by declarative
+*   `permissions` configs.
+* @returns A flat object with all group connection management functions (e.g. `createConnection`,
 *   `configureOidc`, `configureScim`, `signIn`, etc.).
 *
 * @example
 * ```ts
-* // convex/auth/enterprise.ts
-* import { enterprise } from "@robelest/convex-auth/server";
+* // convex/auth/group.ts
+* import { createAuthGroupSso } from "@robelest/convex-auth/server";
 * import { auth } from "../auth";
 *
-* const api = enterprise(auth, {
-*   admin: {
-*     authorized: async (ctx, input) => { /* check permissions *\/ },
-*     roles: ["admin"],
+* const api = createAuthGroupSso(auth, {
+*   permissions: {
+*     sso: { require: ["workspace.sso.manage"] },
+*     scim: { require: ["workspace.scim.manage"] },
 *   },
+*   access: async (_ctx, _input, _required) => {},
 * });
 *
 * export const createConnection = api.createConnection;
@@ -539,28 +653,32 @@ function scim(auth, options) {
 * @see {@link sso}
 * @see {@link scim}
 */
-function enterprise(auth, options) {
-	const mountedSso = sso(auth, { admin: options.admin });
-	const mountedScim = scim(auth, { admin: { authorized: options.admin.authorized } });
+function createAuthGroupSso(auth, options) {
+	const mountedSso = sso(auth, options);
+	const mountedScim = scim(auth, options);
 	return {
 		createConnection: mountedSso.admin.connection.create,
 		getConnection: mountedSso.admin.connection.get,
-		getConnectionByGroup: mountedSso.admin.connection.getByGroup,
 		getConnectionByDomain: mountedSso.admin.connection.getByDomain,
 		listConnections: mountedSso.admin.connection.list,
 		updateConnection: mountedSso.admin.connection.update,
 		deleteConnection: mountedSso.admin.connection.delete,
 		getConnectionStatus: mountedSso.admin.connection.status,
 		listDomains: mountedSso.admin.connection.domain.list,
+		getDomainStatus: mountedSso.admin.connection.domain.status,
 		validateDomains: mountedSso.admin.connection.domain.validate,
 		setDomains: mountedSso.admin.connection.domain.set,
 		requestDomainVerification: mountedSso.admin.connection.domain.verification.request,
 		confirmDomainVerification: mountedSso.admin.connection.domain.verification.confirm,
 		configureOidc: mountedSso.admin.oidc.configure,
 		getOidc: mountedSso.admin.oidc.get,
+		getOidcStatus: mountedSso.admin.oidc.status,
 		validateOidc: mountedSso.admin.oidc.validate,
 		configureSaml: mountedSso.admin.saml.configure,
+		getSaml: mountedSso.admin.saml.get,
+		getSamlStatus: mountedSso.admin.saml.status,
 		validateSaml: mountedSso.admin.saml.validate,
+		refreshSaml: mountedSso.admin.saml.refresh,
 		getPolicy: mountedSso.admin.policy.get,
 		updatePolicy: mountedSso.admin.policy.update,
 		validatePolicy: mountedSso.admin.policy.validate,
@@ -571,6 +689,7 @@ function enterprise(auth, options) {
 		disableWebhookEndpoint: mountedSso.admin.webhook.endpoint.disable,
 		configureScim: mountedScim.admin.configure,
 		getScim: mountedScim.admin.get,
+		getScimStatus: mountedScim.admin.status,
 		validateScim: mountedScim.admin.validate,
 		signIn: mountedSso.client.signIn,
 		metadata: mountedSso.client.metadata
@@ -578,5 +697,5 @@ function enterprise(auth, options) {
 }
 
 //#endregion
-export { enterprise, scim, sso };
+export { createAuthGroupSso, scim, sso };
 //# sourceMappingURL=mounts.js.map