@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/component/server/enterprise/domain.js

@@ -1,974 +0,0 @@
-import { Cv } from "@robelest/fx/convex";
-import { Fx } from "@robelest/fx";
-
-//#region src/server/enterprise/domain.ts
-/**
-* Build the enterprise and SSO management domain.
-*/
-function createEnterpriseDomain(deps) {
-	const { config, normalizeEnterprisePolicy, normalizeDomain, getEnterpriseSecret, loadEnterpriseOrThrow, validateEnterprisePolicy, recordEnterpriseAuditEvent, emitEnterpriseWebhookDeliveries, enterpriseNotFoundError, ENTERPRISE_OIDC_CLIENT_SECRET_KIND, requireEnv, generateRandomString, INVITE_TOKEN_ALPHABET, sha256, encryptSecret, upsertProtocolConfig, parseSamlIdpMetadata, createServiceProviderMetadata, getSamlServiceProviderOptions, getPublicOidcConfig, withOidcSecretState, getOidcConfig, getEnterpriseOidcUrls, enterpriseOidcProviderId, getPolicyFromEnterprise, patchEnterprisePolicy } = deps;
-	const ENTERPRISE_DOMAIN_VERIFICATION_PREFIX = "_convex-auth-verification";
-	const ENTERPRISE_DOMAIN_VERIFICATION_TTL_MS = 1e3 * 60 * 60 * 24 * 7;
-	const toDomainSummary = (domain) => ({
-		domainId: domain._id,
-		domain: domain.domain,
-		isPrimary: domain.isPrimary,
-		verified: domain.verifiedAt !== void 0,
-		verifiedAt: domain.verifiedAt ?? null
-	});
-	const getDomainVerificationRecordName = (domain) => `${ENTERPRISE_DOMAIN_VERIFICATION_PREFIX}.${normalizeDomain(domain)}`;
-	const parseTxtAnswer = (value) => {
-		const quoted = [...value.matchAll(/"([^"]*)"/g)].map((match) => match[1]);
-		if (quoted.length > 0) return quoted.join("");
-		return value.replace(/^"|"$/g, "").trim();
-	};
-	const resolveTxtValues = async (recordName) => {
-		const url = new URL("https://dns.google/resolve");
-		url.searchParams.set("name", recordName);
-		url.searchParams.set("type", "TXT");
-		const response = await fetch(url, { headers: { accept: "application/json" } });
-		if (!response.ok) throw new Error(`DNS TXT lookup failed with status ${response.status}.`);
-		return ((await response.json()).Answer ?? []).map((answer) => typeof answer.data === "string" ? parseTxtAnswer(answer.data) : null).filter((value) => value !== null && value.length > 0);
-	};
-	return {
-		connection: {
-			create: async (ctx, data) => {
-				return {
-					enterpriseId: await ctx.runMutation(config.component.public.enterpriseCreate, {
-						...data,
-						policy: normalizeEnterprisePolicy(data.policy)
-					}),
-					groupId: data.groupId
-				};
-			},
-			get: async (ctx, enterpriseId) => {
-				return await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-			},
-			getByGroup: async (ctx, groupId) => {
-				return await ctx.runQuery(config.component.public.enterpriseGetByGroup, { groupId });
-			},
-			getByDomain: async (ctx, domain) => {
-				return await ctx.runQuery(config.component.public.enterpriseGetByDomain, { domain: normalizeDomain(domain) });
-			},
-			list: async (ctx, opts) => {
-				return await ctx.runQuery(config.component.public.enterpriseList, {
-					where: opts?.where,
-					limit: opts?.limit,
-					cursor: opts?.cursor,
-					orderBy: opts?.orderBy,
-					order: opts?.order
-				});
-			},
-			update: async (ctx, enterpriseId, data) => {
-				await ctx.runMutation(config.component.public.enterpriseUpdate, {
-					enterpriseId,
-					data
-				});
-				return { enterpriseId };
-			},
-			delete: async (ctx, enterpriseId) => {
-				await ctx.runMutation(config.component.public.enterpriseDelete, { enterpriseId });
-				return { enterpriseId };
-			},
-			status: async (ctx, enterpriseId) => {
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (!enterprise) throw Cv.error({
-					code: "INVALID_PARAMETERS",
-					message: enterpriseNotFoundError
-				});
-				const policy = getPolicyFromEnterprise(enterprise);
-				const protocols = enterprise.config?.protocols ?? {};
-				const oidcConfig = protocols.oidc;
-				const oidcSecret = await getEnterpriseSecret(ctx, enterprise._id, ENTERPRISE_OIDC_CLIENT_SECRET_KIND);
-				const samlConfig = protocols.saml;
-				const scimConfig = await ctx.runQuery(config.component.public.enterpriseScimConfigGetByEnterprise, { enterpriseId });
-				const domains = await ctx.runQuery(config.component.public.enterpriseDomainList, { enterpriseId });
-				const oidcReady = oidcConfig?.enabled === true && typeof oidcConfig?.clientId === "string" && oidcConfig.clientId.length > 0 && oidcSecret !== null && (typeof oidcConfig?.issuer === "string" || typeof oidcConfig?.discoveryUrl === "string");
-				const samlReady = samlConfig?.enabled === true && typeof samlConfig?.idp?.entityId === "string";
-				const scimReady = scimConfig !== null && scimConfig !== void 0 && scimConfig.status === "active";
-				const ready = enterprise.status === "active" && (oidcReady || samlReady);
-				return {
-					enterpriseId: enterprise._id,
-					status: enterprise.status,
-					ready,
-					domainCount: domains.length,
-					protocols: {
-						oidc: {
-							configured: oidcReady,
-							ready: oidcReady,
-							clientId: oidcConfig?.clientId ?? null,
-							issuer: oidcConfig?.issuer ?? oidcConfig?.discoveryUrl ?? null
-						},
-						saml: {
-							configured: samlReady,
-							ready: samlReady,
-							entityId: samlConfig?.idp?.entityId ?? null
-						},
-						scim: {
-							configured: scimReady,
-							ready: scimReady,
-							basePath: scimConfig?.basePath ?? null,
-							deprovisionMode: policy.provisioning.deprovision.mode
-						}
-					}
-				};
-			}
-		},
-		domain: {
-			add: async (ctx, data) => {
-				return await ctx.runMutation(config.component.public.enterpriseDomainAdd, {
-					...data,
-					domain: normalizeDomain(data.domain)
-				});
-			},
-			list: async (ctx, enterpriseId) => {
-				return await ctx.runQuery(config.component.public.enterpriseDomainList, { enterpriseId });
-			},
-			validate: async (ctx, enterpriseId) => {
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (enterprise === null) throw Cv.error({
-					code: "INVALID_PARAMETERS",
-					message: enterpriseNotFoundError
-				});
-				const domains = await ctx.runQuery(config.component.public.enterpriseDomainList, { enterpriseId });
-				const primaryDomains = domains.filter((domain) => domain.isPrimary);
-				const verifiedDomains = domains.filter((domain) => domain.verifiedAt !== void 0);
-				const warnings = [];
-				if (domains.length === 0) warnings.push("No domains configured.");
-				if (primaryDomains.length === 0 && domains.length > 0) warnings.push("No primary domain configured.");
-				if (primaryDomains.length > 1) warnings.push("Multiple primary domains configured.");
-				if (verifiedDomains.length === 0 && domains.length > 0) warnings.push("No verified domains yet.");
-				return {
-					enterpriseId,
-					ready: enterprise.status === "active" && domains.length > 0 && primaryDomains.length === 1 && verifiedDomains.length > 0,
-					summary: {
-						domainCount: domains.length,
-						primaryCount: primaryDomains.length,
-						verifiedCount: verifiedDomains.length
-					},
-					domains: domains.map((domain) => toDomainSummary(domain)),
-					warnings
-				};
-			},
-			remove: async (ctx, domainId) => {
-				await ctx.runMutation(config.component.public.enterpriseDomainDelete, { domainId });
-			},
-			verification: {
-				request: async (ctx, args) => {
-					const enterprise = await loadEnterpriseOrThrow(ctx, args.enterpriseId);
-					const normalizedDomain = normalizeDomain(args.domain);
-					const domain = (await ctx.runQuery(config.component.public.enterpriseDomainList, { enterpriseId: enterprise._id })).find((entry) => entry.domain === normalizedDomain);
-					if (!domain) throw Cv.error({
-						code: "INVALID_PARAMETERS",
-						message: "Domain is not attached to this enterprise."
-					});
-					const requestedAt = Date.now();
-					const expiresAt = requestedAt + ENTERPRISE_DOMAIN_VERIFICATION_TTL_MS;
-					const token = generateRandomString(32, INVITE_TOKEN_ALPHABET);
-					const tokenHash = await sha256(token);
-					const recordName = getDomainVerificationRecordName(normalizedDomain);
-					await ctx.runMutation(config.component.public.enterpriseDomainVerificationUpsert, {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId,
-						domainId: domain._id,
-						domain: normalizedDomain,
-						recordName,
-						token,
-						tokenHash,
-						requestedAt,
-						expiresAt
-					});
-					await recordEnterpriseAuditEvent(ctx, {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId,
-						eventType: "enterprise.domain.verification_requested",
-						actorType: "system",
-						subjectType: "enterprise_domain",
-						subjectId: domain._id,
-						ok: true,
-						metadata: {
-							domain: normalizedDomain,
-							recordName,
-							expiresAt
-						}
-					});
-					return {
-						enterpriseId: enterprise._id,
-						domain: normalizedDomain,
-						requestedAt,
-						expiresAt,
-						challenge: {
-							recordType: "TXT",
-							recordName,
-							recordValue: token
-						}
-					};
-				},
-				confirm: async (ctx, args) => {
-					const enterprise = await loadEnterpriseOrThrow(ctx, args.enterpriseId);
-					const normalizedDomain = normalizeDomain(args.domain);
-					const domain = (await ctx.runQuery(config.component.public.enterpriseDomainList, { enterpriseId: enterprise._id })).find((entry) => entry.domain === normalizedDomain);
-					if (!domain) throw Cv.error({
-						code: "INVALID_PARAMETERS",
-						message: "Domain is not attached to this enterprise."
-					});
-					if (domain.verifiedAt !== void 0) return {
-						ok: true,
-						enterpriseId: enterprise._id,
-						domain: normalizedDomain,
-						verifiedAt: domain.verifiedAt,
-						checks: [{
-							name: "domain_verified",
-							ok: true,
-							message: "Domain is already verified."
-						}]
-					};
-					const verification = await ctx.runQuery(config.component.public.enterpriseDomainVerificationGet, { domainId: domain._id });
-					const checks = [];
-					if (!verification) {
-						checks.push({
-							name: "verification_requested",
-							ok: false,
-							message: "No active domain verification challenge exists."
-						});
-						return {
-							ok: false,
-							enterpriseId: enterprise._id,
-							domain: normalizedDomain,
-							checks
-						};
-					}
-					checks.push({
-						name: "verification_requested",
-						ok: true
-					});
-					if (verification.expiresAt < Date.now()) {
-						await ctx.runMutation(config.component.public.enterpriseDomainVerificationDelete, { domainId: domain._id });
-						checks.push({
-							name: "challenge_active",
-							ok: false,
-							message: "The verification challenge expired. Request a new one."
-						});
-						return {
-							ok: false,
-							enterpriseId: enterprise._id,
-							domain: normalizedDomain,
-							checks
-						};
-					}
-					checks.push({
-						name: "challenge_active",
-						ok: true
-					});
-					let txtValues;
-					try {
-						txtValues = await resolveTxtValues(verification.recordName);
-					} catch (error) {
-						throw Cv.error({
-							code: "INTERNAL_ERROR",
-							message: error instanceof Error ? error.message : "Failed to resolve DNS TXT records."
-						});
-					}
-					checks.push({
-						name: "dns_record_present",
-						ok: txtValues.length > 0,
-						message: txtValues.length > 0 ? void 0 : `No TXT records found at ${verification.recordName}.`
-					});
-					const matches = txtValues.includes(verification.token);
-					checks.push({
-						name: "dns_record_matches",
-						ok: matches,
-						message: matches ? void 0 : `TXT record at ${verification.recordName} does not match the expected value.`
-					});
-					if (!checks.every((check) => check.ok)) return {
-						ok: false,
-						enterpriseId: enterprise._id,
-						domain: normalizedDomain,
-						checks
-					};
-					const verifiedAt = Date.now();
-					await ctx.runMutation(config.component.public.enterpriseDomainVerify, {
-						domainId: domain._id,
-						verifiedAt
-					});
-					await recordEnterpriseAuditEvent(ctx, {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId,
-						eventType: "enterprise.domain.verified",
-						actorType: "system",
-						subjectType: "enterprise_domain",
-						subjectId: domain._id,
-						ok: true,
-						metadata: {
-							domain: normalizedDomain,
-							verifiedAt
-						}
-					});
-					return {
-						ok: true,
-						enterpriseId: enterprise._id,
-						domain: normalizedDomain,
-						verifiedAt,
-						checks
-					};
-				}
-			}
-		},
-		saml: {
-			configure: async (ctx, data) => {
-				return await Fx.run(Fx.gen(function* () {
-					const enterprise = yield* Fx.from({
-						ok: () => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: data.enterpriseId }),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to load enterprise."
-						})
-					}).pipe(Fx.chain((ent) => ent === null ? Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: enterpriseNotFoundError
-					}) : Fx.succeed(ent)));
-					const metadataXml = yield* data.metadataXml ? Fx.succeed(data.metadataXml) : data.metadataUrl ? Fx.defer(() => Fx.from({
-						ok: async () => {
-							const response = await fetch(data.metadataUrl);
-							if (!response.ok) throw new Error(`Failed to fetch SAML metadata: ${response.status}`);
-							return await response.text();
-						},
-						err: (error) => Cv.error({
-							code: "INVALID_PARAMETERS",
-							message: error instanceof Error ? error.message : "Failed to fetch SAML metadata"
-						})
-					})).pipe(Fx.timeout(1e4), Fx.retry(Fx.retry.compose(Fx.retry.jittered(Fx.retry.exponential(200)), Fx.retry.recurs(2))), Fx.recover((error) => Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: error instanceof Error ? error.message : "Failed to fetch SAML metadata"
-					}))) : Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: "SAML registration requires metadataXml or metadataUrl."
-					});
-					const parsed = yield* Fx.from({
-						ok: () => parseSamlIdpMetadata(metadataXml),
-						err: () => Cv.error({
-							code: "INVALID_PARAMETERS",
-							message: "Failed to parse SAML metadata."
-						})
-					});
-					const baseConfig = upsertProtocolConfig(enterprise.config, "saml", {
-						enabled: true,
-						idp: {
-							metadataXml,
-							...parsed
-						},
-						sp: data.sp,
-						signAuthnRequests: data.signAuthnRequests ?? parsed.wantsSignedAuthnRequests,
-						attributeMapping: data.attributeMapping
-					});
-					const normalizedDomains = data.domains?.map(normalizeDomain);
-					const nextConfig = normalizedDomains ? {
-						...baseConfig,
-						domains: normalizedDomains
-					} : baseConfig;
-					yield* Fx.from({
-						ok: () => ctx.runMutation(config.component.public.enterpriseUpdate, {
-							enterpriseId: enterprise._id,
-							data: {
-								status: "active",
-								config: nextConfig
-							}
-						}),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to persist SAML registration."
-						})
-					});
-					if (normalizedDomains) for (const [index, domain] of normalizedDomains.entries()) yield* Fx.from({
-						ok: () => ctx.runMutation(config.component.public.enterpriseDomainAdd, {
-							enterpriseId: enterprise._id,
-							groupId: enterprise.groupId,
-							domain,
-							isPrimary: index === 0
-						}),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to persist enterprise domain."
-						})
-					});
-					yield* Fx.from({
-						ok: () => recordEnterpriseAuditEvent(ctx, {
-							enterpriseId: enterprise._id,
-							groupId: enterprise.groupId,
-							eventType: "enterprise.saml.registered",
-							actorType: "system",
-							subjectType: "enterprise_saml",
-							subjectId: enterprise._id,
-							ok: true,
-							metadata: {
-								metadataUrl: data.metadataUrl,
-								domains: normalizedDomains
-							}
-						}),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to record SAML registration audit event."
-						})
-					});
-					return {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId
-					};
-				}).pipe(Fx.recover((e) => Fx.fatal(e))));
-			},
-			metadata: async (ctx, opts) => {
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: opts.enterpriseId });
-				if (!enterprise) throw Cv.error({
-					code: "INVALID_PARAMETERS",
-					message: "Enterprise not found."
-				});
-				return createServiceProviderMetadata(getSamlServiceProviderOptions({
-					rootUrl: requireEnv("CONVEX_SITE_URL"),
-					source: {
-						kind: "enterprise",
-						id: enterprise._id
-					},
-					config: enterprise.config,
-					overrides: {
-						entityId: opts.entityId,
-						acsUrl: opts.acsUrl,
-						sloUrl: opts.sloUrl
-					}
-				}));
-			},
-			validate: async (ctx, enterpriseId) => {
-				const checks = [];
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (!enterprise) return {
-					ok: false,
-					enterpriseId,
-					checks: [{
-						name: "enterprise_exists",
-						ok: false,
-						message: "Enterprise not found."
-					}]
-				};
-				const samlConfig = enterprise.config?.protocols?.saml;
-				const samlConfigured = samlConfig?.enabled === true && typeof samlConfig?.idp?.metadataXml === "string";
-				checks.push({
-					name: "saml_configured",
-					ok: samlConfigured,
-					message: samlConfigured ? void 0 : "SAML is not configured."
-				});
-				const hasIdpMetadata = typeof samlConfig?.idp?.metadataXml === "string" && samlConfig.idp.metadataXml.length > 0;
-				checks.push({
-					name: "idp_metadata_present",
-					ok: hasIdpMetadata,
-					message: hasIdpMetadata ? void 0 : "IdP metadata XML is missing."
-				});
-				const hasEntityId = typeof samlConfig?.idp?.entityId === "string" && samlConfig.idp.entityId.length > 0;
-				checks.push({
-					name: "idp_entity_id",
-					ok: hasEntityId,
-					message: hasEntityId ? void 0 : "IdP entityId could not be parsed from metadata."
-				});
-				let spMetadataOk = false;
-				let spMetadataMessage;
-				if (samlConfigured) try {
-					createServiceProviderMetadata(getSamlServiceProviderOptions({
-						rootUrl: requireEnv("CONVEX_SITE_URL"),
-						source: {
-							kind: "enterprise",
-							id: enterprise._id
-						},
-						config: enterprise.config,
-						overrides: {}
-					}));
-					spMetadataOk = true;
-				} catch (e) {
-					spMetadataMessage = e instanceof Error ? e.message : "SP metadata generation failed.";
-				}
-				else spMetadataMessage = "Skipped — SAML not configured.";
-				checks.push({
-					name: "sp_metadata_generates",
-					ok: spMetadataOk,
-					message: spMetadataMessage
-				});
-				return {
-					ok: checks.every((c) => c.ok),
-					enterpriseId: enterprise._id,
-					checks
-				};
-			}
-		},
-		policy: {
-			get: async (ctx, enterpriseId) => {
-				return getPolicyFromEnterprise(await loadEnterpriseOrThrow(ctx, enterpriseId));
-			},
-			update: async (ctx, enterpriseId, patch) => {
-				const enterprise = await loadEnterpriseOrThrow(ctx, enterpriseId);
-				const policy = patchEnterprisePolicy(enterprise.policy, patch);
-				await ctx.runMutation(config.component.public.enterpriseUpdate, {
-					enterpriseId,
-					data: { policy }
-				});
-				await recordEnterpriseAuditEvent(ctx, {
-					enterpriseId: enterprise._id,
-					groupId: enterprise.groupId,
-					eventType: "enterprise.policy.updated",
-					actorType: "system",
-					subjectType: "enterprise_policy",
-					subjectId: enterprise._id,
-					ok: true,
-					metadata: { version: policy.version }
-				});
-				return policy;
-			},
-			validate: async (ctx, enterpriseId) => {
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (!enterprise) return {
-					ok: false,
-					enterpriseId,
-					checks: [{
-						name: "enterprise_exists",
-						ok: false,
-						message: enterpriseNotFoundError
-					}]
-				};
-				const policy = getPolicyFromEnterprise(enterprise);
-				const checks = validateEnterprisePolicy(policy);
-				return {
-					ok: checks.every((check) => check.ok),
-					enterpriseId,
-					policy,
-					checks
-				};
-			}
-		},
-		oidc: {
-			configure: async (ctx, data) => {
-				return await Fx.run(Fx.gen(function* () {
-					yield* Fx.guard(data.issuer === void 0 && data.discoveryUrl === void 0, Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: "OIDC registration requires issuer or discoveryUrl."
-					}));
-					const enterprise = yield* Fx.from({
-						ok: () => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: data.enterpriseId }),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to load enterprise."
-						})
-					}).pipe(Fx.chain((ent) => ent === null ? Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: enterpriseNotFoundError
-					}) : Fx.succeed(ent)));
-					const nextConfig = upsertProtocolConfig(enterprise.config, "oidc", {
-						enabled: true,
-						issuer: data.issuer,
-						discoveryUrl: data.discoveryUrl,
-						clientId: data.clientId,
-						scopes: data.scopes ?? [
-							"openid",
-							"profile",
-							"email"
-						],
-						authorizationParams: data.authorizationParams,
-						clockToleranceSeconds: data.clockToleranceSeconds,
-						strictIssuer: data.strictIssuer,
-						extraFields: data.extraFields
-					});
-					yield* Fx.from({
-						ok: () => ctx.runMutation(config.component.public.enterpriseUpdate, {
-							enterpriseId: data.enterpriseId,
-							data: { config: nextConfig }
-						}),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to persist OIDC registration."
-						})
-					});
-					if (data.clientSecret !== void 0) {
-						const ciphertext = yield* Fx.from({
-							ok: () => encryptSecret(data.clientSecret),
-							err: () => Cv.error({
-								code: "INTERNAL_ERROR",
-								message: "Failed to encrypt OIDC client secret."
-							})
-						});
-						yield* Fx.from({
-							ok: () => ctx.runMutation(config.component.public.enterpriseSecretUpsert, {
-								enterpriseId: data.enterpriseId,
-								groupId: enterprise.groupId,
-								kind: ENTERPRISE_OIDC_CLIENT_SECRET_KIND,
-								ciphertext,
-								updatedAt: Date.now()
-							}),
-							err: () => Cv.error({
-								code: "INTERNAL_ERROR",
-								message: "Failed to persist OIDC client secret."
-							})
-						});
-					}
-					yield* Fx.from({
-						ok: () => recordEnterpriseAuditEvent(ctx, {
-							enterpriseId: data.enterpriseId,
-							groupId: enterprise.groupId,
-							eventType: "enterprise.oidc.registered",
-							actorType: "system",
-							subjectType: "enterprise_oidc",
-							subjectId: data.enterpriseId,
-							ok: true,
-							metadata: {
-								issuer: data.issuer,
-								discoveryUrl: data.discoveryUrl
-							}
-						}),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to record OIDC registration audit event."
-						})
-					});
-					const secret = yield* Fx.from({
-						ok: () => getEnterpriseSecret(ctx, data.enterpriseId, ENTERPRISE_OIDC_CLIENT_SECRET_KIND),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to load OIDC secret metadata."
-						})
-					});
-					return withOidcSecretState(getPublicOidcConfig(nextConfig), secret !== null);
-				}).pipe(Fx.recover((e) => Fx.fatal(e))));
-			},
-			get: async (ctx, enterpriseId) => {
-				return await Fx.run(Fx.from({
-					ok: () => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId }),
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "Failed to load enterprise."
-					})
-				}).pipe(Fx.chain((ent) => ent === null ? Cv.fail({
-					code: "INVALID_PARAMETERS",
-					message: enterpriseNotFoundError
-				}) : Fx.succeed(ent)), Fx.chain((enterprise) => Fx.from({
-					ok: async () => {
-						const secret = await getEnterpriseSecret(ctx, enterprise._id, ENTERPRISE_OIDC_CLIENT_SECRET_KIND);
-						return withOidcSecretState(getPublicOidcConfig(enterprise.config), secret !== null);
-					},
-					err: () => Cv.error({
-						code: "INTERNAL_ERROR",
-						message: "Failed to load OIDC secret metadata."
-					})
-				})), Fx.recover((e) => Fx.fatal(e))));
-			},
-			signIn: async (ctx, data) => {
-				return await Fx.run(Fx.gen(function* () {
-					const enterprise = data.enterpriseId !== void 0 ? yield* Fx.from({
-						ok: () => ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: data.enterpriseId }),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to load enterprise."
-						})
-					}).pipe(Fx.chain((ent) => ent === null ? Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: enterpriseNotFoundError
-					}) : Fx.succeed(ent))) : data.domain !== void 0 || data.email !== void 0 ? yield* Fx.from({
-						ok: () => ctx.runQuery(config.component.public.enterpriseGetByDomain, { domain: normalizeDomain(data.domain ?? String(data.email).split("@").pop() ?? "") }),
-						err: () => Cv.error({
-							code: "INTERNAL_ERROR",
-							message: "Failed to resolve enterprise by domain."
-						})
-					}).pipe(Fx.chain((result) => result?.enterprise && result.domain?.verifiedAt !== void 0 ? Fx.succeed(result.enterprise) : Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: "No enterprise OIDC connection matched the provided input."
-					}))) : yield* Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: "No enterprise OIDC connection matched the provided input."
-					});
-					yield* Fx.guard(enterprise.status !== "active", Cv.fail({
-						code: "INVALID_PARAMETERS",
-						message: "Enterprise connection is not active."
-					}));
-					const oidc = getOidcConfig(enterprise.config);
-					yield* Fx.guard(oidc.enabled !== true, Cv.fail({
-						code: "PROVIDER_NOT_CONFIGURED",
-						message: "OIDC is not configured for this enterprise."
-					}));
-					const urls = getEnterpriseOidcUrls({
-						rootUrl: requireEnv("CONVEX_SITE_URL"),
-						enterpriseId: enterprise._id
-					});
-					return {
-						enterpriseId: enterprise._id,
-						providerId: enterpriseOidcProviderId(enterprise._id),
-						signInPath: urls.signInUrl,
-						callbackPath: urls.callbackUrl,
-						redirectTo: data.redirectTo
-					};
-				}).pipe(Fx.recover((e) => Fx.fatal(e))));
-			},
-			validate: async (ctx, enterpriseId) => {
-				const checks = [];
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (!enterprise) return {
-					ok: false,
-					enterpriseId,
-					checks: [{
-						name: "enterprise_exists",
-						ok: false,
-						message: "Enterprise not found."
-					}]
-				};
-				const oidc = getOidcConfig(enterprise.config);
-				const secret = await getEnterpriseSecret(ctx, enterprise._id, ENTERPRISE_OIDC_CLIENT_SECRET_KIND);
-				const oidcConfigured = oidc.enabled === true && typeof oidc.clientId === "string" && oidc.clientId.length > 0;
-				checks.push({
-					name: "oidc_configured",
-					ok: oidcConfigured,
-					message: oidcConfigured ? void 0 : "OIDC is not configured."
-				});
-				const hasClientId = typeof oidc.clientId === "string" && oidc.clientId.length > 0;
-				checks.push({
-					name: "client_id_present",
-					ok: hasClientId,
-					message: hasClientId ? void 0 : "clientId is missing."
-				});
-				checks.push({
-					name: "client_secret_stored",
-					ok: secret !== null,
-					message: secret !== null ? void 0 : "OIDC client secret is missing."
-				});
-				const discoveryTarget = oidc.discoveryUrl ?? oidc.issuer;
-				const hasDiscovery = typeof discoveryTarget === "string" && discoveryTarget.length > 0;
-				checks.push({
-					name: "issuer_or_discovery_url_present",
-					ok: hasDiscovery,
-					message: hasDiscovery ? void 0 : "issuer or discoveryUrl is missing."
-				});
-				let discoveryOk = false;
-				let discoveryMessage;
-				if (hasDiscovery) {
-					const discoveryUrl = oidc.discoveryUrl?.length ? oidc.discoveryUrl : `${oidc.issuer}/.well-known/openid-configuration`;
-					try {
-						const res = await fetch(discoveryUrl, {
-							headers: { Accept: "application/json" },
-							signal: AbortSignal.timeout(8e3)
-						});
-						if (!res.ok) discoveryMessage = `Discovery endpoint returned ${res.status}.`;
-						else {
-							const json = await res.json();
-							if (typeof json.issuer !== "string") discoveryMessage = "Discovery document is missing issuer field.";
-							else if (typeof json.authorization_endpoint !== "string") discoveryMessage = "Discovery document is missing authorization_endpoint.";
-							else discoveryOk = true;
-						}
-					} catch (e) {
-						discoveryMessage = e instanceof Error ? `Discovery fetch failed: ${e.message}` : "Discovery fetch failed.";
-					}
-				} else discoveryMessage = "Skipped — issuer or discoveryUrl not set.";
-				checks.push({
-					name: "discovery_reachable",
-					ok: discoveryOk,
-					message: discoveryMessage
-				});
-				return {
-					ok: checks.every((c) => c.ok),
-					enterpriseId: enterprise._id,
-					checks
-				};
-			}
-		},
-		scim: {
-			configure: async (ctx, data) => {
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: data.enterpriseId });
-				if (enterprise === null) throw Cv.error({
-					code: "INVALID_PARAMETERS",
-					message: "Enterprise not found."
-				});
-				const rawToken = generateRandomString(48, INVITE_TOKEN_ALPHABET);
-				const tokenHash = await sha256(rawToken);
-				const configId = await ctx.runMutation(config.component.public.enterpriseScimConfigUpsert, {
-					enterpriseId: enterprise._id,
-					groupId: enterprise.groupId,
-					status: data.status ?? "active",
-					basePath: data.basePath ?? `${requireEnv("CONVEX_SITE_URL")}/api/auth/sso/${enterprise._id}/scim/v2`,
-					tokenHash,
-					lastRotatedAt: Date.now()
-				});
-				const auditEventId = await recordEnterpriseAuditEvent(ctx, {
-					enterpriseId: enterprise._id,
-					groupId: enterprise.groupId,
-					eventType: "enterprise.scim.configured",
-					actorType: "system",
-					subjectType: "enterprise_scim",
-					subjectId: configId,
-					ok: true
-				});
-				await emitEnterpriseWebhookDeliveries(ctx, {
-					enterpriseId: enterprise._id,
-					eventType: "enterprise.scim.configured",
-					auditEventId,
-					payload: {
-						enterpriseId: enterprise._id,
-						scimConfigId: configId
-					}
-				});
-				return {
-					enterpriseId: enterprise._id,
-					configId,
-					basePath: data.basePath ?? `${requireEnv("CONVEX_SITE_URL")}/api/auth/sso/${enterprise._id}/scim/v2`,
-					token: rawToken
-				};
-			},
-			get: async (ctx, enterpriseId) => {
-				return await ctx.runQuery(config.component.public.enterpriseScimConfigGetByEnterprise, { enterpriseId });
-			},
-			getConfigByToken: async (ctx, token) => {
-				return await ctx.runQuery(config.component.public.enterpriseScimConfigGetByTokenHash, { tokenHash: await sha256(token) });
-			},
-			validate: async (ctx, enterpriseId) => {
-				const checks = [];
-				const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId });
-				if (!enterprise) return {
-					ok: false,
-					enterpriseId,
-					checks: [{
-						name: "enterprise_exists",
-						ok: false,
-						message: "Enterprise not found."
-					}]
-				};
-				const policy = getPolicyFromEnterprise(enterprise);
-				const scimConfig = await ctx.runQuery(config.component.public.enterpriseScimConfigGetByEnterprise, { enterpriseId });
-				const hasConfig = scimConfig !== null && scimConfig !== void 0;
-				checks.push({
-					name: "scim_config_exists",
-					ok: hasConfig,
-					message: hasConfig ? void 0 : "SCIM has not been configured."
-				});
-				const isActive = hasConfig && scimConfig.status === "active";
-				checks.push({
-					name: "scim_config_active",
-					ok: isActive,
-					message: isActive ? void 0 : `SCIM config status is ${hasConfig ? scimConfig.status : "unknown"}.`
-				});
-				const hasToken = hasConfig && typeof scimConfig.tokenHash === "string" && scimConfig.tokenHash.length > 0;
-				checks.push({
-					name: "token_hash_set",
-					ok: hasToken,
-					message: hasToken ? void 0 : "SCIM bearer token has not been set."
-				});
-				const hasBasePath = hasConfig && typeof scimConfig.basePath === "string" && scimConfig.basePath.length > 0;
-				checks.push({
-					name: "base_path_set",
-					ok: hasBasePath,
-					message: hasBasePath ? void 0 : "SCIM basePath is missing."
-				});
-				return {
-					ok: checks.every((c) => c.ok),
-					enterpriseId: enterprise._id,
-					basePath: hasBasePath ? scimConfig.basePath : null,
-					deprovisionMode: policy.provisioning.deprovision.mode,
-					checks
-				};
-			},
-			identity: {
-				get: async (ctx, data) => {
-					return await ctx.runQuery(config.component.public.enterpriseScimIdentityGet, data);
-				},
-				upsert: async (ctx, data) => {
-					return await ctx.runMutation(config.component.public.enterpriseScimIdentityUpsert, {
-						...data,
-						lastProvisionedAt: Date.now()
-					});
-				}
-			}
-		},
-		audit: {
-			record: async (ctx, data) => {
-				return await recordEnterpriseAuditEvent(ctx, data);
-			},
-			list: async (ctx, data) => {
-				return await ctx.runQuery(config.component.public.enterpriseAuditEventList, data);
-			}
-		},
-		webhook: {
-			endpoint: {
-				get: async (ctx, endpointId) => {
-					return await ctx.runQuery(config.component.public.enterpriseWebhookEndpointGet, { endpointId });
-				},
-				create: async (ctx, data) => {
-					const enterprise = await ctx.runQuery(config.component.public.enterpriseGet, { enterpriseId: data.enterpriseId });
-					if (enterprise === null) throw Cv.error({
-						code: "INVALID_PARAMETERS",
-						message: "Enterprise not found."
-					});
-					const secretHash = await sha256(data.secret);
-					const endpointId = await ctx.runMutation(config.component.public.enterpriseWebhookEndpointCreate, {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId,
-						url: data.url,
-						secretHash,
-						subscriptions: data.subscriptions,
-						createdByUserId: data.createdByUserId
-					});
-					await recordEnterpriseAuditEvent(ctx, {
-						enterpriseId: enterprise._id,
-						groupId: enterprise.groupId,
-						eventType: "enterprise.webhook.endpoint.created",
-						actorType: data.createdByUserId ? "user" : "system",
-						actorId: data.createdByUserId,
-						subjectType: "enterprise_webhook_endpoint",
-						subjectId: endpointId,
-						ok: true
-					});
-					return { endpointId };
-				},
-				list: async (ctx, enterpriseId) => {
-					return await ctx.runQuery(config.component.public.enterpriseWebhookEndpointList, { enterpriseId });
-				},
-				disable: async (ctx, endpointId) => {
-					await ctx.runMutation(config.component.public.enterpriseWebhookEndpointUpdate, {
-						endpointId,
-						data: { status: "disabled" }
-					});
-					return { endpointId };
-				}
-			},
-			emit: async (ctx, data) => {
-				await emitEnterpriseWebhookDeliveries(ctx, data);
-			},
-			delivery: {
-				list: async (ctx, data) => {
-					return await ctx.runQuery(config.component.public.enterpriseWebhookDeliveryList, data);
-				},
-				listReady: async (ctx, limit) => {
-					return await ctx.runQuery(config.component.public.enterpriseWebhookDeliveryListReady, {
-						now: Date.now(),
-						limit
-					});
-				},
-				markDelivered: async (ctx, deliveryId, responseStatus) => {
-					await ctx.runMutation(config.component.public.enterpriseWebhookDeliveryPatch, {
-						deliveryId,
-						data: {
-							status: "delivered",
-							attemptCount: 1,
-							lastAttemptAt: Date.now(),
-							lastResponseStatus: responseStatus
-						}
-					});
-				},
-				markFailed: async (ctx, deliveryId, data) => {
-					await ctx.runMutation(config.component.public.enterpriseWebhookDeliveryPatch, {
-						deliveryId,
-						data: {
-							status: data.retryAt ? "pending" : "failed",
-							attemptCount: data.attemptCount,
-							lastAttemptAt: Date.now(),
-							lastResponseStatus: data.responseStatus,
-							lastError: data.error,
-							nextAttemptAt: data.retryAt ?? Date.now()
-						}
-					});
-				}
-			}
-		}
-	};
-}
-
-//#endregion
-export { createEnterpriseDomain };
-//# sourceMappingURL=domain.js.map