@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/sso/oidc.js

@@ -0,0 +1,324 @@
+import { log } from "../log.js";
+import { createCache } from "../utils/cache.js";
+import { retryWithBackoff } from "../utils/retry.js";
+import { withSpan } from "../utils/span.js";
+import { finalizeNormalizedProfile, normalizeStringArray } from "./profile.js";
+import { getGroupOidcUrls, groupOidcProviderId } from "./shared.js";
+import { sha256 } from "@oslojs/crypto/sha2";
+import { encodeBase64urlNoPadding } from "@oslojs/encoding";
+import { createRemoteJWKSet, customFetch, decodeProtectedHeader, jwtVerify } from "jose";
+import { decodeIdToken } from "arctic";
+
+//#region src/server/sso/oidc.ts
+const OIDC_JWKS_CACHE = createCache({
+	capacity: 128,
+	timeToLiveMs: 3600 * 1e3,
+	lookup: (cacheKey) => {
+		const key = JSON.parse(cacheKey);
+		const fetchImpl = key.runtimeOrigin !== void 0 || key.externalHost !== void 0 ? createGroupConnectionOidcFetchFromParts(key.runtimeOrigin, key.externalHost) : void 0;
+		return fetchImpl ? createRemoteJWKSet(new URL(key.url), { [customFetch]: fetchImpl }) : createRemoteJWKSet(new URL(key.url));
+	}
+});
+function validateOidcDiscovery(data) {
+	if (typeof data !== "object" || data === null) throw new Error("OIDC discovery response is not an object.");
+	const obj = data;
+	if (typeof obj.issuer !== "string") throw new Error("OIDC discovery is missing 'issuer'.");
+	if (typeof obj.authorization_endpoint !== "string") throw new Error("OIDC discovery is missing 'authorization_endpoint'.");
+	if (typeof obj.token_endpoint !== "string") throw new Error("OIDC discovery is missing 'token_endpoint'.");
+	if (typeof obj.jwks_uri !== "string") throw new Error("OIDC discovery is missing 'jwks_uri'.");
+	return {
+		issuer: obj.issuer,
+		authorization_endpoint: obj.authorization_endpoint,
+		token_endpoint: obj.token_endpoint,
+		jwks_uri: obj.jwks_uri,
+		userinfo_endpoint: typeof obj.userinfo_endpoint === "string" ? obj.userinfo_endpoint : void 0,
+		token_endpoint_auth_methods_supported: Array.isArray(obj.token_endpoint_auth_methods_supported) ? obj.token_endpoint_auth_methods_supported.filter((v) => typeof v === "string") : void 0,
+		id_token_signing_alg_values_supported: Array.isArray(obj.id_token_signing_alg_values_supported) ? obj.id_token_signing_alg_values_supported.filter((v) => typeof v === "string") : void 0
+	};
+}
+function validateOidcUserInfo(data) {
+	if (typeof data !== "object" || data === null) return {};
+	const obj = data;
+	return {
+		sub: typeof obj.sub === "string" ? obj.sub : void 0,
+		email: typeof obj.email === "string" ? obj.email : void 0,
+		email_verified: typeof obj.email_verified === "boolean" ? obj.email_verified : void 0,
+		name: typeof obj.name === "string" ? obj.name : void 0,
+		picture: typeof obj.picture === "string" ? obj.picture : void 0
+	};
+}
+const asError = (error) => error instanceof Error ? error : new Error(String(error));
+function getOidcSections(config) {
+	return {
+		discovery: typeof config.discovery === "object" && config.discovery !== null ? config.discovery : {},
+		client: typeof config.client === "object" && config.client !== null ? config.client : {},
+		request: typeof config.request === "object" && config.request !== null ? config.request : {},
+		security: typeof config.security === "object" && config.security !== null ? config.security : {},
+		profile: typeof config.profile === "object" && config.profile !== null ? config.profile : {}
+	};
+}
+async function discoverOidcConfiguration(config) {
+	const { discovery } = getOidcSections(config);
+	const discoveryUrl = typeof discovery.discoveryUrl === "string" ? discovery.discoveryUrl : typeof discovery.issuer === "string" ? `${discovery.issuer.replace(/\/$/, "")}/.well-known/openid-configuration` : null;
+	if (!discoveryUrl) throw new Error("Group connection OIDC requires an issuer or discoveryUrl.");
+	const oidcFetch = createGroupConnectionOidcFetch(config, typeof discovery.issuer === "string" ? discovery.issuer : void 0);
+	return withSpan("convex-auth.sso.oidc.discovery", {}, async () => {
+		return retryWithBackoff(async () => {
+			const response = await oidcFetch(discoveryUrl, { signal: AbortSignal.timeout(1e4) });
+			if (!response.ok) throw new Error(`Failed to discover OIDC configuration: ${response.status}`);
+			return validateOidcDiscovery(await response.json());
+		}, {
+			maxRetries: 2,
+			baseMs: 200
+		});
+	});
+}
+function createGroupConnectionOidcFetch(config, discoveredIssuer) {
+	const { discovery } = getOidcSections(config);
+	return createGroupConnectionOidcFetchFromParts(typeof discovery.discoveryUrl === "string" ? new URL(discovery.discoveryUrl).origin : void 0, typeof discovery.issuer === "string" ? new URL(discovery.issuer).host : typeof discoveredIssuer === "string" ? new URL(discoveredIssuer).host : void 0);
+}
+function createGroupConnectionOidcFetchFromParts(runtimeOrigin, externalHost) {
+	return async (input, init) => {
+		const url = new URL(typeof input === "string" ? input : input.toString());
+		const rewrittenUrl = runtimeOrigin !== void 0 && url.origin !== runtimeOrigin ? new URL(`${runtimeOrigin}${url.pathname}${url.search}`) : url;
+		const headers = new Headers(init?.headers);
+		if (runtimeOrigin !== void 0 && externalHost !== void 0) headers.set("host", externalHost);
+		return await fetch(rewrittenUrl, {
+			...init,
+			headers
+		});
+	};
+}
+function normalizeOidcProfile(claims, mapping) {
+	const getMapped = (key) => typeof key === "string" ? claims[key] : void 0;
+	return finalizeNormalizedProfile({
+		id: (typeof getMapped(mapping?.subject) === "string" ? getMapped(mapping?.subject) : void 0) ?? (typeof claims.sub === "string" ? claims.sub : crypto.randomUUID()),
+		email: (typeof getMapped(mapping?.email) === "string" ? getMapped(mapping?.email) : void 0) ?? (typeof claims.email === "string" ? claims.email : void 0),
+		emailVerified: (typeof getMapped(mapping?.emailVerified) === "boolean" ? getMapped(mapping?.emailVerified) : void 0) ?? (typeof claims.email_verified === "boolean" ? claims.email_verified : void 0),
+		name: (typeof getMapped(mapping?.name) === "string" ? getMapped(mapping?.name) : void 0) ?? (typeof claims.name === "string" ? claims.name : void 0),
+		image: (typeof getMapped(mapping?.image) === "string" ? getMapped(mapping?.image) : void 0) ?? (typeof claims.picture === "string" ? claims.picture : void 0),
+		groups: normalizeStringArray(getMapped(mapping?.groups)),
+		roles: normalizeStringArray(getMapped(mapping?.roles))
+	});
+}
+function getOidcJwks(url, runtimeOrigin, externalHost, fetchImpl) {
+	const cacheKey = JSON.stringify({
+		url,
+		runtimeOrigin: fetchImpl ? runtimeOrigin : void 0,
+		externalHost: fetchImpl ? externalHost : void 0
+	});
+	return OIDC_JWKS_CACHE.get(cacheKey);
+}
+async function userInfoProfileFx(opts) {
+	return withSpan("convex-auth.sso.oidc.userinfo", {}, async () => {
+		let userInfo;
+		try {
+			const response = await (opts.fetchImpl ?? fetch)(opts.endpoint, { headers: { Authorization: `Bearer ${opts.accessToken}` } });
+			if (!response.ok) throw new Error(`OIDC userinfo request failed: ${response.status}`);
+			userInfo = validateOidcUserInfo(await response.json());
+		} catch {
+			return null;
+		}
+		const userInfoSubject = typeof userInfo.sub === "string" ? userInfo.sub : void 0;
+		const tokenSubject = typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0;
+		if (userInfoSubject !== void 0 && tokenSubject !== void 0 && userInfoSubject !== tokenSubject) throw new Error("OIDC userinfo subject does not match ID token subject.");
+		return {
+			id: userInfoSubject ?? (typeof opts.verifiedClaims.sub === "string" ? opts.verifiedClaims.sub : void 0) ?? crypto.randomUUID(),
+			email: typeof userInfo.email === "string" ? userInfo.email : opts.verifiedProfile.email,
+			emailVerified: typeof userInfo.email_verified === "boolean" ? userInfo.email_verified : opts.verifiedProfile.emailVerified,
+			name: typeof userInfo.name === "string" ? userInfo.name : opts.verifiedProfile.name,
+			image: typeof userInfo.picture === "string" ? userInfo.picture : opts.verifiedProfile.image
+		};
+	});
+}
+/** @internal */
+async function createGroupConnectionOidcProvider(config, redirectUri) {
+	const { discovery: discoveryConfig, client, request, security, profile } = getOidcSections(config);
+	const discovery = await discoverOidcConfiguration(config);
+	const discoveredIssuer = typeof discovery.issuer === "string" ? discovery.issuer.replace(/\/$/, "") : "";
+	const expectedIssuer = typeof discoveryConfig.issuer === "string" ? discoveryConfig.issuer.replace(/\/$/, "") : discoveredIssuer;
+	const strictIssuer = security.strictIssuer === true;
+	if (typeof discoveryConfig.issuer === "string" && expectedIssuer !== discoveredIssuer) {
+		if (strictIssuer) throw new Error(`Configured OIDC issuer mismatch. configured=${expectedIssuer} discovery=${discoveredIssuer}`);
+		log("WARN", "Configured OIDC issuer differs from discovery issuer; accepting both for token verification.", {
+			configuredIssuer: expectedIssuer,
+			discoveryIssuer: discoveredIssuer
+		});
+	}
+	const authorizationEndpoint = discovery.authorization_endpoint;
+	const tokenEndpoint = discovery.token_endpoint;
+	const jwksUri = typeof discoveryConfig.jwksUri === "string" ? discoveryConfig.jwksUri : typeof discovery.jwks_uri === "string" ? discovery.jwks_uri : "";
+	const supportedIdTokenSigningAlgs = Array.isArray(discovery.id_token_signing_alg_values_supported) ? discovery.id_token_signing_alg_values_supported.filter((value) => typeof value === "string") : [];
+	const discoveredTokenEndpointAuthMethods = Array.isArray(discovery.token_endpoint_auth_methods_supported) ? discovery.token_endpoint_auth_methods_supported.filter((value) => typeof value === "string") : [];
+	const tokenEndpointAuthMethod = client.authMethod === "client_secret_basic" || client.authMethod === "client_secret_post" ? client.authMethod : discoveredTokenEndpointAuthMethods.includes("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
+	const userinfoEndpoint = discovery.userinfo_endpoint ?? void 0;
+	const claimMapping = typeof profile.mapping === "object" && profile.mapping !== null ? profile.mapping : void 0;
+	const oidcFetch = createGroupConnectionOidcFetch(config, discovery.issuer);
+	const runtimeOrigin = typeof discoveryConfig.discoveryUrl === "string" ? new URL(discoveryConfig.discoveryUrl).origin : void 0;
+	const externalHost = typeof discoveryConfig.issuer === "string" ? new URL(discoveryConfig.issuer).host : typeof discovery.issuer === "string" ? new URL(discovery.issuer).host : void 0;
+	const scopes = Array.isArray(request.scopes) ? request.scopes.filter((value) => typeof value === "string") : [
+		"openid",
+		"profile",
+		"email"
+	];
+	const expectedAudience = Array.isArray(discoveryConfig.audience) ? discoveryConfig.audience.filter((value) => typeof value === "string") : typeof discoveryConfig.audience === "string" ? discoveryConfig.audience : String(client.id);
+	const clockToleranceSeconds = typeof security.clockToleranceSeconds === "number" ? security.clockToleranceSeconds : 10;
+	const getIssuerCandidates = (issuer) => {
+		const candidates = [issuer];
+		if (issuer.startsWith("https://")) candidates.push(`http://${issuer.slice(8)}`);
+		else if (issuer.startsWith("http://")) candidates.push(`https://${issuer.slice(7)}`);
+		return candidates;
+	};
+	const expectedIssuers = strictIssuer ? [expectedIssuer] : Array.from(new Set([...getIssuerCandidates(expectedIssuer), ...getIssuerCandidates(discoveredIssuer)]));
+	const jwks = getOidcJwks(jwksUri, runtimeOrigin, externalHost, oidcFetch);
+	let verifiedClaims = null;
+	let verifiedProfile = null;
+	const normalizeProfile = (claims) => normalizeOidcProfile(claims, claimMapping);
+	return {
+		provider: {
+			pkce: "required",
+			createAuthorizationURL({ state, codeVerifier, scopes: requestedScopes, nonce, loginHint }) {
+				if (!codeVerifier) throw new Error("OIDC PKCE requires a code verifier.");
+				const url = new URL(authorizationEndpoint);
+				url.searchParams.set("response_type", "code");
+				url.searchParams.set("client_id", String(client.id));
+				url.searchParams.set("redirect_uri", redirectUri);
+				url.searchParams.set("scope", (requestedScopes.length > 0 ? requestedScopes : scopes).join(" "));
+				url.searchParams.set("state", state);
+				url.searchParams.set("code_challenge_method", "S256");
+				url.searchParams.set("code_challenge", encodeBase64urlNoPadding(sha256(new TextEncoder().encode(codeVerifier))));
+				if (nonce !== void 0) url.searchParams.set("nonce", nonce);
+				if (typeof loginHint === "string") url.searchParams.set("login_hint", loginHint);
+				const authorizationParams = typeof request.authorizationParams === "object" && request.authorizationParams !== null ? request.authorizationParams : {};
+				for (const [key, value] of Object.entries(authorizationParams)) if (typeof value === "string") url.searchParams.set(key, value);
+				return url;
+			},
+			async validateAuthorizationCode({ code, codeVerifier }) {
+				const body = new URLSearchParams({
+					grant_type: "authorization_code",
+					code,
+					redirect_uri: redirectUri
+				});
+				const headers = new Headers({ "Content-Type": "application/x-www-form-urlencoded" });
+				if (typeof client.secret === "string" && tokenEndpointAuthMethod === "client_secret_basic") {
+					const basicAuth = typeof btoa === "function" ? btoa(`${String(client.id)}:${client.secret}`) : Buffer.from(`${String(client.id)}:${client.secret}`).toString("base64");
+					headers.set("Authorization", `Basic ${basicAuth}`);
+				} else {
+					body.set("client_id", String(client.id));
+					if (typeof client.secret === "string") body.set("client_secret", client.secret);
+				}
+				if (codeVerifier) body.set("code_verifier", codeVerifier);
+				const response = await oidcFetch(tokenEndpoint, {
+					method: "POST",
+					headers,
+					body
+				});
+				if (!response.ok) {
+					const detail = await response.text();
+					throw new Error(`OIDC token exchange failed: ${response.status}${detail ? ` ${detail}` : ""}`);
+				}
+				const data = await response.json();
+				return {
+					accessToken: typeof data.access_token === "string" ? data.access_token : void 0,
+					refreshToken: typeof data.refresh_token === "string" ? data.refresh_token : void 0,
+					idToken: typeof data.id_token === "string" ? data.id_token : void 0,
+					accessTokenExpiresAt: typeof data.expires_in === "number" ? new Date(Date.now() + data.expires_in * 1e3) : void 0,
+					scopes: typeof data.scope === "string" ? data.scope.split(/[\s,]+/).map((scope) => scope.trim()).filter((scope) => scope.length > 0) : void 0,
+					raw: data
+				};
+			}
+		},
+		oauthConfig: {
+			scopes,
+			nonce: true,
+			validateTokens: async (tokens, ctx) => {
+				if (ctx.nonce === void 0) throw new Error("OIDC nonce is required.");
+				const idToken = tokens.idToken;
+				if (idToken === void 0) throw new Error("OIDC response is missing id_token.");
+				const verifiedIdToken = idToken;
+				const tokenAlg = decodeProtectedHeader(verifiedIdToken).alg;
+				const useSymmetricValidation = typeof tokenAlg === "string" && (tokenAlg === "HS256" || tokenAlg === "HS384" || tokenAlg === "HS512") && supportedIdTokenSigningAlgs.includes(tokenAlg);
+				const verificationOptions = {
+					audience: expectedAudience,
+					requiredClaims: [
+						"iss",
+						"sub",
+						"aud",
+						"exp",
+						"iat"
+					],
+					clockTolerance: clockToleranceSeconds
+				};
+				let verification;
+				try {
+					verification = await (useSymmetricValidation ? jwtVerify(verifiedIdToken, (() => {
+						if (typeof client.secret !== "string") throw new Error("OIDC provider uses symmetric ID token signatures but clientSecret is missing.");
+						return new TextEncoder().encode(client.secret);
+					})(), verificationOptions) : jwtVerify(verifiedIdToken, jwks, verificationOptions));
+				} catch (error) {
+					throw asError(error);
+				}
+				const payload = verification.payload;
+				const tokenIssuerRaw = typeof payload.iss === "string" ? payload.iss : void 0;
+				const tokenIssuer = typeof tokenIssuerRaw === "string" ? tokenIssuerRaw.replace(/\/$/, "") : void 0;
+				if (!tokenIssuer || !expectedIssuers.includes(tokenIssuer)) throw new Error(`OIDC token issuer mismatch. Received: ${tokenIssuer ?? "<missing>"}. Expected one of: ${expectedIssuers.join(", ")}`);
+				if (payload.nonce !== ctx.nonce) throw new Error("OIDC nonce mismatch.");
+				if (Array.isArray(payload.aud) && payload.aud.length > 1 && payload.azp !== String(client.id)) throw new Error("OIDC authorized party does not match client ID.");
+				verifiedClaims = payload;
+				verifiedProfile = normalizeProfile(payload);
+			},
+			accountLinking: config.accountLinking,
+			profile: async (tokens) => {
+				if (verifiedProfile === null || verifiedClaims === null) {
+					if (tokens.idToken === void 0) throw new Error("OIDC response is missing id_token.");
+					const claims = decodeIdToken(tokens.idToken);
+					verifiedClaims = claims;
+					verifiedProfile = normalizeProfile(claims);
+				}
+				if (userinfoEndpoint && typeof tokens.accessToken === "string") {
+					const userInfoProfile = await userInfoProfileFx({
+						endpoint: userinfoEndpoint,
+						accessToken: tokens.accessToken,
+						verifiedClaims,
+						verifiedProfile,
+						fetchImpl: oidcFetch
+					});
+					if (userInfoProfile !== null) return userInfoProfile;
+				}
+				return verifiedProfile;
+			}
+		}
+	};
+}
+/** @internal */
+function createSyntheticOAuthMaterializedConfig(providerId, options) {
+	return {
+		id: providerId,
+		type: "oauth",
+		provider: null,
+		scopes: [],
+		accountLinking: options?.accountLinking ?? "verifiedEmail"
+	};
+}
+/** @internal */
+async function createGroupConnectionOidcRuntime(opts) {
+	const providerId = groupOidcProviderId(opts.connectionId);
+	const urls = getGroupOidcUrls({
+		rootUrl: opts.rootUrl,
+		connectionId: opts.connectionId,
+		sharedRedirectURI: opts.sharedRedirectURI
+	});
+	const { provider, oauthConfig } = await createGroupConnectionOidcProvider(opts.oidc, urls.callbackUrl);
+	return {
+		oidc: opts.oidc,
+		providerId,
+		provider,
+		oauthConfig,
+		...urls
+	};
+}
+/** @internal */
+
+//#endregion
+export { createGroupConnectionOidcRuntime, createSyntheticOAuthMaterializedConfig };
+//# sourceMappingURL=oidc.js.map

package/dist/server/sso/policies.js

@@ -0,0 +1,59 @@
+import { getGroup } from "../contract.js";
+import { patchGroupConnectionPolicy } from "./policy.js";
+import { ConvexError } from "convex/values";
+
+//#region src/server/sso/policies.ts
+const convexError = (data) => new ConvexError(data);
+function createGroupPolicyDomain(deps) {
+	const { config, loadGroupPolicyOrThrow, validateGroupConnectionPolicy, recordGroupAuditEvent } = deps;
+	return {
+		get: async (ctx, groupId) => {
+			return await loadGroupPolicyOrThrow(ctx, groupId);
+		},
+		update: async (ctx, groupId, patch) => {
+			const group = await getGroup(ctx, config.component.public, groupId);
+			if (!group) throw convexError({
+				code: "INVALID_PARAMETERS",
+				message: "Group not found."
+			});
+			const policy = patchGroupConnectionPolicy(group.policy, patch);
+			await ctx.runMutation(config.component.public.groupUpdate, {
+				groupId,
+				data: { policy }
+			});
+			await recordGroupAuditEvent(ctx, {
+				groupId,
+				eventType: "group.sso.policy.updated",
+				actorType: "system",
+				subjectType: "group_policy",
+				subjectId: groupId,
+				ok: true,
+				metadata: { version: policy.version }
+			});
+			return policy;
+		},
+		validate: async (ctx, groupId) => {
+			if (!await getGroup(ctx, config.component.public, groupId)) return {
+				ok: false,
+				groupId,
+				checks: [{
+					name: "group_exists",
+					ok: false,
+					message: "Group not found."
+				}]
+			};
+			const policy = await loadGroupPolicyOrThrow(ctx, groupId);
+			const checks = validateGroupConnectionPolicy(policy);
+			return {
+				ok: checks.every((check) => check.ok),
+				groupId,
+				policy,
+				checks
+			};
+		}
+	};
+}
+
+//#endregion
+export { createGroupPolicyDomain };
+//# sourceMappingURL=policies.js.map

package/dist/server/sso/policy.js

@@ -0,0 +1,139 @@
+import { asRecord } from "./shared.js";
+
+//#region src/server/sso/policy.ts
+const DEFAULT_GROUP_CONNECTION_POLICY = {
+	version: 1,
+	identity: { accountLinking: {
+		oidc: "verifiedEmail",
+		saml: "verifiedEmail"
+	} },
+	provisioning: {
+		user: {
+			createOnSignIn: true,
+			updateProfileOnLogin: "missing",
+			updateProfileFromScim: "always",
+			authority: "app"
+		},
+		scimReuse: { user: "externalId" },
+		jit: {
+			mode: "createUserAndMembership",
+			defaultRoleIds: []
+		},
+		deprovision: { mode: "soft" },
+		groups: {
+			mode: "ignore",
+			source: "protocol"
+		},
+		roles: {
+			mode: "ignore",
+			source: "protocol"
+		}
+	}
+};
+function normalizeGroupConnectionPolicy(policy) {
+	const input = asRecord(policy) ?? {};
+	const accountLinking = asRecord((asRecord(input.identity) ?? {}).accountLinking) ?? {};
+	const provisioning = asRecord(input.provisioning) ?? {};
+	const scimReuse = asRecord(provisioning.scimReuse) ?? {};
+	const user = asRecord(provisioning.user) ?? {};
+	const jit = asRecord(provisioning.jit) ?? {};
+	const deprovision = asRecord(provisioning.deprovision) ?? {};
+	const groups = asRecord(provisioning.groups) ?? {};
+	const roles = asRecord(provisioning.roles) ?? {};
+	const extend = asRecord(input.extend) ?? void 0;
+	return {
+		version: 1,
+		identity: { accountLinking: {
+			oidc: accountLinking.oidc === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.identity.accountLinking.oidc,
+			saml: accountLinking.saml === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.identity.accountLinking.saml
+		} },
+		provisioning: {
+			user: {
+				createOnSignIn: typeof user.createOnSignIn === "boolean" ? user.createOnSignIn : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.createOnSignIn,
+				updateProfileOnLogin: user.updateProfileOnLogin === "never" || user.updateProfileOnLogin === "always" ? user.updateProfileOnLogin : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.updateProfileOnLogin,
+				updateProfileFromScim: user.updateProfileFromScim === "never" || user.updateProfileFromScim === "missing" ? user.updateProfileFromScim : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.updateProfileFromScim,
+				authority: user.authority === "sso" || user.authority === "scim" ? user.authority : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.user.authority
+			},
+			scimReuse: { user: scimReuse.user === "none" ? "none" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.scimReuse.user },
+			jit: {
+				mode: jit.mode === "off" || jit.mode === "createUser" || jit.mode === "createUserAndMembership" ? jit.mode : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.jit.mode,
+				defaultRoleIds: Array.isArray(jit.defaultRoleIds) ? Array.from(new Set(jit.defaultRoleIds.filter((value) => typeof value === "string" && value.length > 0))) : typeof jit.defaultRole === "string" && jit.defaultRole.length > 0 ? [jit.defaultRole] : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.jit.defaultRoleIds
+			},
+			deprovision: { mode: deprovision.mode === "hard" ? "hard" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.deprovision.mode },
+			groups: {
+				mode: groups.mode === "sync" ? "sync" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.groups.mode,
+				source: "protocol",
+				...typeof groups.mapping === "object" && groups.mapping !== null ? { mapping: Object.fromEntries(Object.entries(groups.mapping).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))])) } : {}
+			},
+			roles: {
+				mode: roles.mode === "map" ? "map" : DEFAULT_GROUP_CONNECTION_POLICY.provisioning.roles.mode,
+				source: "protocol",
+				...typeof roles.mapping === "object" && roles.mapping !== null ? { mapping: Object.fromEntries(Object.entries(roles.mapping).filter(([key, value]) => typeof key === "string" && Array.isArray(value)).map(([key, value]) => [key, Array.from(new Set(value.filter((item) => typeof item === "string" && item.length > 0)))])) } : {}
+			}
+		},
+		...extend ? { extend } : {}
+	};
+}
+function patchGroupConnectionPolicy(current, patch) {
+	const base = normalizeGroupConnectionPolicy(current);
+	return normalizeGroupConnectionPolicy({
+		...base,
+		...patch,
+		identity: {
+			...base.identity,
+			...patch.identity,
+			accountLinking: {
+				...base.identity.accountLinking,
+				...patch.identity?.accountLinking
+			}
+		},
+		provisioning: {
+			...base.provisioning,
+			...patch.provisioning,
+			scimReuse: {
+				...base.provisioning.scimReuse,
+				...patch.provisioning?.scimReuse
+			},
+			user: {
+				...base.provisioning.user,
+				...patch.provisioning?.user
+			},
+			jit: {
+				...base.provisioning.jit,
+				...patch.provisioning?.jit
+			},
+			deprovision: {
+				...base.provisioning.deprovision,
+				...patch.provisioning?.deprovision
+			},
+			groups: {
+				...base.provisioning.groups,
+				...patch.provisioning?.groups
+			},
+			roles: {
+				...base.provisioning.roles,
+				...patch.provisioning?.roles
+			}
+		},
+		extend: patch.extend === void 0 ? base.extend : {
+			...base.extend,
+			...patch.extend
+		}
+	});
+}
+function resolveProvisionedRoleIds(opts) {
+	const roleIds = new Set(opts.policy.provisioning.jit.defaultRoleIds);
+	if (opts.policy.provisioning.groups.mode === "sync") {
+		const mapping = opts.policy.provisioning.groups.mapping ?? {};
+		for (const group of opts.groups ?? []) for (const roleId of mapping[group] ?? []) roleIds.add(roleId);
+	}
+	if (opts.policy.provisioning.roles.mode === "map") {
+		const mapping = opts.policy.provisioning.roles.mapping ?? {};
+		for (const role of opts.roles ?? []) for (const roleId of mapping[role] ?? []) roleIds.add(roleId);
+	}
+	return Array.from(roleIds);
+}
+
+//#endregion
+export { normalizeGroupConnectionPolicy, patchGroupConnectionPolicy, resolveProvisionedRoleIds };
+//# sourceMappingURL=policy.js.map

package/dist/server/sso/profile.js

@@ -0,0 +1,22 @@
+//#region src/server/sso/profile.ts
+/** @internal */
+function normalizeStringArray(value) {
+	if (Array.isArray(value)) {
+		const values = value.filter((item) => typeof item === "string" && item.length > 0);
+		return values.length > 0 ? values : void 0;
+	}
+	if (typeof value === "string" && value.length > 0) return [value];
+}
+/** @internal */
+function finalizeNormalizedProfile(input) {
+	return {
+		...input,
+		groups: normalizeStringArray(input.groups),
+		roles: normalizeStringArray(input.roles),
+		...input.extend && Object.keys(input.extend).length > 0 ? { extend: input.extend } : {}
+	};
+}
+
+//#endregion
+export { finalizeNormalizedProfile, normalizeStringArray };
+//# sourceMappingURL=profile.js.map