@sixb/core 0.1.13 → 0.1.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (97) hide show
  1. package/dist/actions/index.js +9 -9
  2. package/dist/agents/index.js +16 -16
  3. package/dist/auth/errors.d.ts +12 -0
  4. package/dist/auth/errors.d.ts.map +1 -1
  5. package/dist/auth/index.d.ts +1 -1
  6. package/dist/auth/index.d.ts.map +1 -1
  7. package/dist/auth/index.js +5 -3
  8. package/dist/auth/index.js.map +1 -1
  9. package/dist/auth/runtime.d.ts.map +1 -1
  10. package/dist/auth/strategy.d.ts +2 -0
  11. package/dist/auth/strategy.d.ts.map +1 -1
  12. package/dist/auth/strategy.js +4 -2
  13. package/dist/auth/strategy.js.map +1 -1
  14. package/dist/auth/types.d.ts +8 -0
  15. package/dist/auth/types.d.ts.map +1 -1
  16. package/dist/bootstrap/index.js +20 -20
  17. package/dist/{chunk-rqtdtm43.js → chunk-00pfcqh4.js} +1 -1
  18. package/dist/{chunk-cvrbhvtr.js → chunk-16jenmzw.js} +10 -10
  19. package/dist/{chunk-0321g649.js → chunk-2jntasmh.js} +13 -2
  20. package/dist/{chunk-0321g649.js.map → chunk-2jntasmh.js.map} +3 -3
  21. package/dist/{chunk-n33e8dz8.js → chunk-3a338wrp.js} +1 -1
  22. package/dist/{chunk-gc226ten.js → chunk-3fpgxpsq.js} +3 -3
  23. package/dist/{chunk-gmt22nxx.js → chunk-4ypbe95r.js} +1 -1
  24. package/dist/{chunk-9pfw47qx.js → chunk-6rzb1g6h.js} +52 -47
  25. package/dist/{chunk-9pfw47qx.js.map → chunk-6rzb1g6h.js.map} +7 -7
  26. package/dist/{chunk-898y24dd.js → chunk-728fp090.js} +1 -1
  27. package/dist/{chunk-693f3zn8.js → chunk-dv4ct8mp.js} +2 -2
  28. package/dist/{chunk-jhyc777j.js → chunk-e2c5yxfe.js} +1 -1
  29. package/dist/{chunk-darm7eeg.js → chunk-gct3m1da.js} +1 -1
  30. package/dist/{chunk-mf6hwpzh.js → chunk-hj0n3c2p.js} +12 -12
  31. package/dist/{chunk-91wthfwe.js → chunk-hxgj4kzd.js} +4 -4
  32. package/dist/{chunk-w9bp61e7.js → chunk-jfdggg1p.js} +1 -1
  33. package/dist/{chunk-04h4t2b5.js → chunk-kxea54yg.js} +1 -1
  34. package/dist/{chunk-jmwy25mf.js → chunk-ma1mhh7w.js} +5 -5
  35. package/dist/{chunk-63fp9x3q.js → chunk-pvgpckm1.js} +2 -2
  36. package/dist/{chunk-a69fkrtr.js → chunk-q2xghyft.js} +1 -1
  37. package/dist/{chunk-s24qbp32.js → chunk-wn7mznxc.js} +2 -2
  38. package/dist/{chunk-gbcrz0gr.js → chunk-wnxabtn4.js} +2 -2
  39. package/dist/{chunk-bep5rrdq.js → chunk-ww185kt6.js} +1 -1
  40. package/dist/{chunk-2hbhn1ff.js → chunk-yvf2jqj8.js} +1 -1
  41. package/dist/execution/agent.js +16 -16
  42. package/dist/execution/primitive.js +16 -16
  43. package/dist/execution/request.js +16 -16
  44. package/dist/index.js +22 -22
  45. package/dist/materializer/index.js +6 -6
  46. package/dist/models/execution/index.js +6 -6
  47. package/dist/objects/index.js +9 -9
  48. package/dist/objects/query/index.js +6 -6
  49. package/dist/pipelines/index.js +7 -7
  50. package/dist/projections/internal.js +5 -5
  51. package/dist/runtime/internal.js +8 -8
  52. package/dist/shares/internal.js +6 -6
  53. package/dist/storage/auth/errors.d.ts +1 -1
  54. package/dist/storage/auth/errors.d.ts.map +1 -1
  55. package/dist/storage/auth/in-memory/auth-storage.d.ts +2 -1
  56. package/dist/storage/auth/in-memory/auth-storage.d.ts.map +1 -1
  57. package/dist/storage/auth/types.d.ts +15 -7
  58. package/dist/storage/auth/types.d.ts.map +1 -1
  59. package/dist/storage/file-upload-sessions/provider.js +3 -3
  60. package/dist/storage/index.js +5 -5
  61. package/dist/storage/workflow-runs/provider.js +3 -3
  62. package/dist/syncs/index.js +7 -7
  63. package/dist/testing/auth-storage-contract.d.ts.map +1 -1
  64. package/dist/testing/index.js +107 -139
  65. package/dist/testing/index.js.map +3 -3
  66. package/dist/webhooks/internal.js +5 -5
  67. package/dist/workflows/index.js +17 -17
  68. package/package.json +1 -1
  69. package/src/auth/errors.ts +23 -0
  70. package/src/auth/index.ts +1 -1
  71. package/src/auth/runtime.ts +56 -22
  72. package/src/auth/strategy.ts +2 -0
  73. package/src/auth/types.ts +8 -0
  74. package/src/storage/auth/errors.ts +0 -1
  75. package/src/storage/auth/in-memory/auth-storage.ts +44 -65
  76. package/src/storage/auth/types.ts +15 -7
  77. package/src/testing/auth-storage-contract.ts +104 -130
  78. /package/dist/{chunk-rqtdtm43.js.map → chunk-00pfcqh4.js.map} +0 -0
  79. /package/dist/{chunk-cvrbhvtr.js.map → chunk-16jenmzw.js.map} +0 -0
  80. /package/dist/{chunk-n33e8dz8.js.map → chunk-3a338wrp.js.map} +0 -0
  81. /package/dist/{chunk-gc226ten.js.map → chunk-3fpgxpsq.js.map} +0 -0
  82. /package/dist/{chunk-gmt22nxx.js.map → chunk-4ypbe95r.js.map} +0 -0
  83. /package/dist/{chunk-898y24dd.js.map → chunk-728fp090.js.map} +0 -0
  84. /package/dist/{chunk-693f3zn8.js.map → chunk-dv4ct8mp.js.map} +0 -0
  85. /package/dist/{chunk-jhyc777j.js.map → chunk-e2c5yxfe.js.map} +0 -0
  86. /package/dist/{chunk-darm7eeg.js.map → chunk-gct3m1da.js.map} +0 -0
  87. /package/dist/{chunk-mf6hwpzh.js.map → chunk-hj0n3c2p.js.map} +0 -0
  88. /package/dist/{chunk-91wthfwe.js.map → chunk-hxgj4kzd.js.map} +0 -0
  89. /package/dist/{chunk-w9bp61e7.js.map → chunk-jfdggg1p.js.map} +0 -0
  90. /package/dist/{chunk-04h4t2b5.js.map → chunk-kxea54yg.js.map} +0 -0
  91. /package/dist/{chunk-jmwy25mf.js.map → chunk-ma1mhh7w.js.map} +0 -0
  92. /package/dist/{chunk-63fp9x3q.js.map → chunk-pvgpckm1.js.map} +0 -0
  93. /package/dist/{chunk-a69fkrtr.js.map → chunk-q2xghyft.js.map} +0 -0
  94. /package/dist/{chunk-s24qbp32.js.map → chunk-wn7mznxc.js.map} +0 -0
  95. /package/dist/{chunk-gbcrz0gr.js.map → chunk-wnxabtn4.js.map} +0 -0
  96. /package/dist/{chunk-bep5rrdq.js.map → chunk-ww185kt6.js.map} +0 -0
  97. /package/dist/{chunk-2hbhn1ff.js.map → chunk-yvf2jqj8.js.map} +0 -0
@@ -36,7 +36,7 @@ import {
36
36
  runMigrationSet2,
37
37
  describeMigrationHistory2,
38
38
  VECTOR_INDEXING_FAILURE_CODES2
39
- } from "../chunk-gc226ten.js";
39
+ } from "../chunk-3fpgxpsq.js";
40
40
  import {
41
41
  SyncRunError2
42
42
  } from "../chunk-jmfet9r4.js";
@@ -45,7 +45,7 @@ import {
45
45
  } from "../chunk-qf954wje.js";
46
46
  import {
47
47
  WorkflowRunError2
48
- } from "../chunk-darm7eeg.js";
48
+ } from "../chunk-gct3m1da.js";
49
49
  import {
50
50
  isTerminalActionRun2,
51
51
  ObjectNotFoundError2,
@@ -97,7 +97,7 @@ import {
97
97
  } from "../chunk-tw03bsmb.js";
98
98
  import {
99
99
  FileUploadSessionError2
100
- } from "../chunk-n33e8dz8.js";
100
+ } from "../chunk-3a338wrp.js";
101
101
  import {
102
102
  DEFAULT_FILE_UPLOAD_SESSION_TTL_MS2,
103
103
  DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2
@@ -125,7 +125,7 @@ import {
125
125
  AuthStorageError2,
126
126
  MAX_PENDING_DEVICE_AUTHORIZATIONS2,
127
127
  InMemoryAuthStorage2
128
- } from "../chunk-9pfw47qx.js";
128
+ } from "../chunk-6rzb1g6h.js";
129
129
  import"../chunk-2fv8sajb.js";
130
130
  import"../chunk-drz59ve0.js";
131
131
  import {
@@ -145,7 +145,7 @@ import"../chunk-z3y5kg1x.js";
145
145
  import {
146
146
  stableJsonStringify2
147
147
  } from "../chunk-wy0qdqfm.js";
148
- import"../chunk-0321g649.js";
148
+ import"../chunk-2jntasmh.js";
149
149
  export {
150
150
  ACTION_RUN_FAILURE_CODES2 as ACTION_RUN_FAILURE_CODES,
151
151
  ACTION_RUN_PHASES2 as ACTION_RUN_PHASES,
@@ -2,8 +2,8 @@
2
2
  import {
3
3
  assertWorkflowRunExecution2,
4
4
  assertWorkflowAgentNodeRunExecution2
5
- } from "../../chunk-darm7eeg.js";
6
- import"../../chunk-9pfw47qx.js";
5
+ } from "../../chunk-gct3m1da.js";
6
+ import"../../chunk-6rzb1g6h.js";
7
7
  import"../../chunk-2fv8sajb.js";
8
8
  import"../../chunk-drz59ve0.js";
9
9
  import"../../chunk-rzcjp5m2.js";
@@ -11,7 +11,7 @@ import"../../chunk-v4jbb3rs.js";
11
11
  import"../../chunk-d8yes9yx.js";
12
12
  import"../../chunk-rzkr70gr.js";
13
13
  import"../../chunk-z3y5kg1x.js";
14
- import"../../chunk-0321g649.js";
14
+ import"../../chunk-2jntasmh.js";
15
15
  export {
16
16
  assertWorkflowAgentNodeRunExecution2 as assertWorkflowAgentNodeRunExecution,
17
17
  assertWorkflowRunExecution2 as assertWorkflowRunExecution
@@ -3,7 +3,7 @@ import {
3
3
  defineSync2,
4
4
  resolveSyncConnectorSources2,
5
5
  isSyncDefinition2
6
- } from "../chunk-jhyc777j.js";
6
+ } from "../chunk-e2c5yxfe.js";
7
7
  import"../chunk-e1c18xjx.js";
8
8
  import"../chunk-fb3feg1e.js";
9
9
  import"../chunk-dfm066qg.js";
@@ -12,14 +12,14 @@ import {
12
12
  SyncValidationError2,
13
13
  SyncRunDispatcher2,
14
14
  requestSyncRun2
15
- } from "../chunk-a69fkrtr.js";
15
+ } from "../chunk-q2xghyft.js";
16
16
  import"../chunk-cbn96bve.js";
17
17
  import"../chunk-cd234ba4.js";
18
18
  import"../chunk-m8zkvep1.js";
19
- import"../chunk-gc226ten.js";
19
+ import"../chunk-3fpgxpsq.js";
20
20
  import"../chunk-jmfet9r4.js";
21
21
  import"../chunk-qf954wje.js";
22
- import"../chunk-darm7eeg.js";
22
+ import"../chunk-gct3m1da.js";
23
23
  import"../chunk-zdkcdshk.js";
24
24
  import"../chunk-ht4a7mjg.js";
25
25
  import"../chunk-mr60an99.js";
@@ -33,7 +33,7 @@ import"../chunk-xnx96gfy.js";
33
33
  import"../chunk-s3csryxe.js";
34
34
  import"../chunk-jgwb25gc.js";
35
35
  import"../chunk-tw03bsmb.js";
36
- import"../chunk-n33e8dz8.js";
36
+ import"../chunk-3a338wrp.js";
37
37
  import"../chunk-h89wz928.js";
38
38
  import"../chunk-xgptywp0.js";
39
39
  import"../chunk-ky7zpbtt.js";
@@ -44,7 +44,7 @@ import"../chunk-y6vnvayj.js";
44
44
  import"../chunk-bdhfn0ww.js";
45
45
  import"../chunk-39tqv9hz.js";
46
46
  import"../chunk-gfdh9kqa.js";
47
- import"../chunk-9pfw47qx.js";
47
+ import"../chunk-6rzb1g6h.js";
48
48
  import"../chunk-2fv8sajb.js";
49
49
  import"../chunk-drz59ve0.js";
50
50
  import"../chunk-rzcjp5m2.js";
@@ -52,7 +52,7 @@ import"../chunk-v4jbb3rs.js";
52
52
  import"../chunk-d8yes9yx.js";
53
53
  import"../chunk-rzkr70gr.js";
54
54
  import"../chunk-z3y5kg1x.js";
55
- import"../chunk-0321g649.js";
55
+ import"../chunk-2jntasmh.js";
56
56
  export {
57
57
  SyncRunDispatcher2 as SyncRunDispatcher,
58
58
  SyncValidationError2 as SyncValidationError,
@@ -1 +1 @@
1
- {"version":3,"file":"auth-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/auth-storage-contract.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EAIZ,MAAM,iBAAiB,CAAA;AAGxB,MAAM,WAAW,+BAA+B,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW;IACzF,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1D,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE;AAqED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,SAAS,WAAW,EACtE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,+BAA+B,CAAC,QAAQ,CAAC,GACjD,IAAI,CA0+DN"}
1
+ {"version":3,"file":"auth-storage-contract.d.ts","sourceRoot":"","sources":["../../src/testing/auth-storage-contract.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EAIZ,MAAM,iBAAiB,CAAA;AAGxB,MAAM,WAAW,+BAA+B,CAAC,QAAQ,SAAS,WAAW,GAAG,WAAW;IACzF,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1D,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChE;AAiGD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,QAAQ,SAAS,WAAW,EACtE,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,+BAA+B,CAAC,QAAQ,CAAC,GACjD,IAAI,CAo7DN"}
@@ -2,7 +2,7 @@
2
2
  import {
3
3
  AuthStorageError2,
4
4
  SYSTEM_PRINCIPAL2
5
- } from "../chunk-9pfw47qx.js";
5
+ } from "../chunk-6rzb1g6h.js";
6
6
  import {
7
7
  defineProjection2,
8
8
  agentServiceAccountId2,
@@ -17,7 +17,7 @@ import"../chunk-d8yes9yx.js";
17
17
  import {
18
18
  ref2
19
19
  } from "../chunk-drz59ve0.js";
20
- import"../chunk-0321g649.js";
20
+ import"../chunk-2jntasmh.js";
21
21
  import"../chunk-pqajwytd.js";
22
22
  import"../chunk-ky7zpbtt.js";
23
23
  import"../chunk-gfdh9kqa.js";
@@ -39,7 +39,7 @@ import {
39
39
  import {
40
40
  DEFAULT_FILE_UPLOAD_TERMINAL_SESSION_TTL_MS2
41
41
  } from "../chunk-h89wz928.js";
42
- import"../chunk-n33e8dz8.js";
42
+ import"../chunk-3a338wrp.js";
43
43
  import"../chunk-tw03bsmb.js";
44
44
  import {
45
45
  OntologyRegistry2,
@@ -59,7 +59,7 @@ import {
59
59
  objectLinkCursor2,
60
60
  WorkflowInterventionError2,
61
61
  InMemoryStorage2
62
- } from "../chunk-gc226ten.js";
62
+ } from "../chunk-3fpgxpsq.js";
63
63
  import"../chunk-7ytf06d3.js";
64
64
  import"../chunk-mr60an99.js";
65
65
  import"../chunk-mmagke4x.js";
@@ -67,20 +67,20 @@ import"../chunk-qma80ych.js";
67
67
  import"../chunk-znw0zvy4.js";
68
68
  import"../chunk-jmfet9r4.js";
69
69
  import"../chunk-qf954wje.js";
70
- import"../chunk-darm7eeg.js";
70
+ import"../chunk-gct3m1da.js";
71
71
  import {
72
72
  ProjectionRegistry2,
73
73
  createLinkScopeFingerprint2,
74
74
  createOntologyMaterializer2
75
- } from "../chunk-rqtdtm43.js";
75
+ } from "../chunk-00pfcqh4.js";
76
76
  import {
77
77
  bindModelExecutionAttempt,
78
78
  isBoundSixb
79
- } from "../chunk-cvrbhvtr.js";
79
+ } from "../chunk-16jenmzw.js";
80
80
  import"../chunk-5a4a52tq.js";
81
81
  import {
82
82
  SixbHost2
83
- } from "../chunk-mf6hwpzh.js";
83
+ } from "../chunk-hj0n3c2p.js";
84
84
  import"../chunk-y6vnvayj.js";
85
85
  import"../chunk-ypj2wqtj.js";
86
86
  import"../chunk-r2y23egw.js";
@@ -94,18 +94,18 @@ import {
94
94
  existsObjects2,
95
95
  facetObjects2,
96
96
  executeObjectQueryLinks2
97
- } from "../chunk-898y24dd.js";
98
- import"../chunk-63fp9x3q.js";
97
+ } from "../chunk-728fp090.js";
98
+ import"../chunk-pvgpckm1.js";
99
99
  import"../chunk-3qms4nax.js";
100
100
  import"../chunk-f85hpqnm.js";
101
101
  import"../chunk-4tnrzqqh.js";
102
- import"../chunk-gbcrz0gr.js";
102
+ import"../chunk-wnxabtn4.js";
103
103
  import"../chunk-y487ywrv.js";
104
104
  import"../chunk-fb3feg1e.js";
105
105
  import"../chunk-z5rnrmz1.js";
106
106
  import"../chunk-85cd7e8c.js";
107
107
  import"../chunk-wr8qp979.js";
108
- import"../chunk-693f3zn8.js";
108
+ import"../chunk-dv4ct8mp.js";
109
109
  import"../chunk-dsfw1bdr.js";
110
110
  import {
111
111
  col2,
@@ -122,7 +122,7 @@ import {
122
122
  import"../chunk-vn3yh259.js";
123
123
  import {
124
124
  workflowAgentStepActorId2
125
- } from "../chunk-s24qbp32.js";
125
+ } from "../chunk-wn7mznxc.js";
126
126
  import {
127
127
  BrokerError2,
128
128
  InMemoryBroker2
@@ -135,22 +135,22 @@ import"../chunk-mdnw7nj8.js";
135
135
  import {
136
136
  SandboxNotRunningError2
137
137
  } from "../chunk-vef6qa14.js";
138
- import"../chunk-jhyc777j.js";
139
- import"../chunk-2hbhn1ff.js";
138
+ import"../chunk-e2c5yxfe.js";
139
+ import"../chunk-yvf2jqj8.js";
140
140
  import"../chunk-7n30ybym.js";
141
- import"../chunk-jmwy25mf.js";
141
+ import"../chunk-ma1mhh7w.js";
142
142
  import {
143
143
  createTestingScope
144
144
  } from "../chunk-z9h698s8.js";
145
145
  import"../chunk-x9v4cx1d.js";
146
146
  import"../chunk-ffwvdgk1.js";
147
- import"../chunk-a69fkrtr.js";
148
- import"../chunk-bep5rrdq.js";
149
- import"../chunk-gmt22nxx.js";
150
- import"../chunk-91wthfwe.js";
151
- import"../chunk-w9bp61e7.js";
147
+ import"../chunk-q2xghyft.js";
148
+ import"../chunk-ww185kt6.js";
149
+ import"../chunk-4ypbe95r.js";
150
+ import"../chunk-hxgj4kzd.js";
151
+ import"../chunk-jfdggg1p.js";
152
152
  import"../chunk-bxx3ms5t.js";
153
- import"../chunk-04h4t2b5.js";
153
+ import"../chunk-kxea54yg.js";
154
154
  import {
155
155
  LakeStorageError2
156
156
  } from "../chunk-rb143ggb.js";
@@ -3931,6 +3931,30 @@ async function createUser(storage, input = {}) {
3931
3931
  createdAt: at4("2026-05-14T10:00:00.000Z")
3932
3932
  });
3933
3933
  }
3934
+ async function completeOidcSignInForAva(storage, directoryGroupIds) {
3935
+ await storage.oidcAuthorizationAttempts.create({
3936
+ id: "oidc_directory",
3937
+ projectId: projectId6,
3938
+ strategyId: "entra",
3939
+ audience: "atlas",
3940
+ stateHash: "directory-state",
3941
+ nonceHash: "nonce-hash",
3942
+ codeVerifier: "verifier",
3943
+ createdAt: at4("2026-05-14T10:00:00.000Z"),
3944
+ expiresAt: at4("2026-05-14T10:10:00.000Z")
3945
+ });
3946
+ await storage.completeOidcSignIn({
3947
+ projectId: projectId6,
3948
+ oidcAuthorizationAttemptId: "oidc_directory",
3949
+ stateHash: "directory-state",
3950
+ completedAt: at4("2026-05-14T10:01:00.000Z"),
3951
+ subject: "entra-ava",
3952
+ email: "ava@acme.com",
3953
+ directoryGroupIds,
3954
+ newUserId: "usr_unused",
3955
+ session: sessionInput("ses_directory")
3956
+ });
3957
+ }
3934
3958
  function runAuthStorageContractSuite(label, options) {
3935
3959
  const withStorage = async (body) => {
3936
3960
  const storage = await options.createStorage();
@@ -5299,81 +5323,6 @@ function runAuthStorageContractSuite(label, options) {
5299
5323
  await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_founder" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
5300
5324
  });
5301
5325
  });
5302
- test6("closes bootstrap user creation when an active user already exists", async () => {
5303
- await withStorage(async (storage) => {
5304
- await createUser(storage, {
5305
- id: "usr_existing",
5306
- email: "existing@acme.com"
5307
- });
5308
- await storage.magicLinks.create({
5309
- id: "ml_1",
5310
- projectId: projectId6,
5311
- strategyId: "magic-link",
5312
- audience: "atlas",
5313
- email: "founder@acme.com",
5314
- tokenHash: "link-hash",
5315
- createdAt: at4("2026-05-14T10:01:00.000Z"),
5316
- expiresAt: at4("2026-05-14T10:16:00.000Z")
5317
- });
5318
- await expectAuthError(storage.completeMagicLinkSignIn({
5319
- projectId: projectId6,
5320
- magicLinkId: "ml_1",
5321
- tokenHash: "link-hash",
5322
- completedAt: at4("2026-05-14T10:03:00.000Z"),
5323
- newUserId: "usr_founder",
5324
- allowUserCreationWithoutInvitation: true,
5325
- requireNoActiveUsersForUserCreation: true,
5326
- session: sessionInput("ses_founder")
5327
- }), "user_creation_not_allowed");
5328
- await expect6(storage.users.getByEmail({ projectId: projectId6, email: "founder@acme.com" })).resolves.toBeNull();
5329
- await expect6(storage.magicLinks.getById({ projectId: projectId6, id: "ml_1" })).resolves.toMatchObject({
5330
- consumedAt: at4("2026-05-14T10:03:00.000Z")
5331
- });
5332
- });
5333
- });
5334
- test6("does not apply the bootstrap closure guard to invited user creation", async () => {
5335
- await withStorage(async (storage) => {
5336
- await createUser(storage, {
5337
- id: "usr_existing",
5338
- email: "existing@acme.com"
5339
- });
5340
- await storage.invitations.createOrUpdateActive({
5341
- id: "inv_1",
5342
- projectId: projectId6,
5343
- email: "invited@acme.com",
5344
- groupIds: ["commercial"],
5345
- createdAt: at4("2026-05-14T10:00:00.000Z"),
5346
- expiresAt: at4("2026-05-21T10:00:00.000Z")
5347
- });
5348
- await storage.magicLinks.create({
5349
- id: "ml_1",
5350
- projectId: projectId6,
5351
- strategyId: "magic-link",
5352
- audience: "atlas",
5353
- email: "invited@acme.com",
5354
- tokenHash: "link-hash",
5355
- createdAt: at4("2026-05-14T10:01:00.000Z"),
5356
- expiresAt: at4("2026-05-14T10:16:00.000Z")
5357
- });
5358
- const result = await storage.completeMagicLinkSignIn({
5359
- projectId: projectId6,
5360
- magicLinkId: "ml_1",
5361
- tokenHash: "link-hash",
5362
- completedAt: at4("2026-05-14T10:03:00.000Z"),
5363
- newUserId: "usr_invited",
5364
- requireNoActiveUsersForUserCreation: true,
5365
- session: sessionInput("ses_invited")
5366
- });
5367
- expect6(result.user).toMatchObject({
5368
- id: "usr_invited",
5369
- email: "invited@acme.com"
5370
- });
5371
- expect6(result.invitation).toMatchObject({
5372
- id: "inv_1",
5373
- status: "accepted"
5374
- });
5375
- });
5376
- });
5377
5326
  test6("consumes valid magic links when an existing user is suspended", async () => {
5378
5327
  await withStorage(async (storage) => {
5379
5328
  await createUser(storage, { status: "suspended" });
@@ -5429,7 +5378,6 @@ function runAuthStorageContractSuite(label, options) {
5429
5378
  completedAt: at4("2026-05-14T10:02:00.000Z"),
5430
5379
  subject: "00u1",
5431
5380
  email: "renamed@acme.com",
5432
- emailVerified: true,
5433
5381
  claims: { email: "renamed@acme.com" },
5434
5382
  newUserId: "usr_unused",
5435
5383
  session: sessionInput("ses_oidc")
@@ -5445,59 +5393,33 @@ function runAuthStorageContractSuite(label, options) {
5445
5393
  });
5446
5394
  });
5447
5395
  });
5448
- test6("auto-links OIDC by verified email only when explicitly allowed", async () => {
5396
+ test6("links a new OIDC identity to the existing user with its email", async () => {
5449
5397
  await withStorage(async (storage) => {
5450
5398
  await createUser(storage, { id: "usr_existing", email: "ava@acme.com" });
5451
5399
  await storage.oidcAuthorizationAttempts.create({
5452
- id: "oidc_blocked",
5400
+ id: "oidc_1",
5453
5401
  projectId: projectId6,
5454
5402
  strategyId: "okta",
5455
5403
  audience: "atlas",
5456
- stateHash: "blocked-state",
5404
+ stateHash: "state-hash",
5457
5405
  nonceHash: "nonce-hash",
5458
5406
  codeVerifier: "verifier",
5459
5407
  createdAt: at4("2026-05-14T10:00:00.000Z"),
5460
5408
  expiresAt: at4("2026-05-14T10:10:00.000Z")
5461
5409
  });
5462
- await expectAuthError(storage.completeOidcSignIn({
5463
- projectId: projectId6,
5464
- oidcAuthorizationAttemptId: "oidc_blocked",
5465
- stateHash: "blocked-state",
5466
- completedAt: at4("2026-05-14T10:01:00.000Z"),
5467
- subject: "00u1",
5468
- email: "ava@acme.com",
5469
- emailVerified: false,
5470
- autoLinkByVerifiedEmail: true,
5471
- newUserId: "usr_unused",
5472
- session: sessionInput("ses_blocked")
5473
- }), "email_link_not_allowed");
5474
- await storage.oidcAuthorizationAttempts.create({
5475
- id: "oidc_allowed",
5476
- projectId: projectId6,
5477
- strategyId: "okta",
5478
- audience: "atlas",
5479
- stateHash: "allowed-state",
5480
- nonceHash: "nonce-hash",
5481
- codeVerifier: "verifier",
5482
- createdAt: at4("2026-05-14T10:02:00.000Z"),
5483
- expiresAt: at4("2026-05-14T10:12:00.000Z")
5484
- });
5485
5410
  const result = await storage.completeOidcSignIn({
5486
5411
  projectId: projectId6,
5487
- oidcAuthorizationAttemptId: "oidc_allowed",
5488
- stateHash: "allowed-state",
5489
- completedAt: at4("2026-05-14T10:03:00.000Z"),
5412
+ oidcAuthorizationAttemptId: "oidc_1",
5413
+ stateHash: "state-hash",
5414
+ completedAt: at4("2026-05-14T10:01:00.000Z"),
5490
5415
  subject: "00u1",
5491
5416
  email: "ava@acme.com",
5492
- emailVerified: true,
5493
- autoLinkByVerifiedEmail: true,
5494
5417
  newUserId: "usr_unused",
5495
- session: sessionInput("ses_allowed")
5418
+ session: sessionInput("ses_oidc")
5496
5419
  });
5497
5420
  expect6(result.user.id).toBe("usr_existing");
5498
- expect6(result.identity).toMatchObject({
5499
- userId: "usr_existing"
5500
- });
5421
+ expect6(result.identity).toMatchObject({ subject: "00u1", userId: "usr_existing" });
5422
+ await expect6(storage.users.getById({ projectId: projectId6, id: "usr_unused" })).resolves.toBeNull();
5501
5423
  });
5502
5424
  });
5503
5425
  test6("creates new OIDC users through active invitations and applies groups", async () => {
@@ -5529,7 +5451,6 @@ function runAuthStorageContractSuite(label, options) {
5529
5451
  subject: "00u1",
5530
5452
  email: "ava@acme.com",
5531
5453
  displayName: "Ava Chen",
5532
- emailVerified: true,
5533
5454
  newUserId: "usr_oidc",
5534
5455
  session: sessionInput("ses_oidc")
5535
5456
  });
@@ -5570,14 +5491,13 @@ function runAuthStorageContractSuite(label, options) {
5570
5491
  completedAt: at4("2026-05-14T10:01:00.000Z"),
5571
5492
  subject: "00u1",
5572
5493
  email: "ava@acme.com",
5573
- emailVerified: true,
5574
5494
  newUserId: "usr_oidc",
5575
5495
  session: sessionInput("ses_oidc")
5576
5496
  }), "user_creation_not_allowed");
5577
5497
  await expect6(storage.users.getByEmail({ projectId: projectId6, email: "ava@acme.com" })).resolves.toBeNull();
5578
5498
  });
5579
5499
  });
5580
- test6("allows first OIDC bootstrap user creation with manual groups", async () => {
5500
+ test6("allows OIDC bootstrap user creation with manual groups", async () => {
5581
5501
  await withStorage(async (storage) => {
5582
5502
  await storage.oidcAuthorizationAttempts.create({
5583
5503
  id: "oidc_bootstrap",
@@ -5597,9 +5517,7 @@ function runAuthStorageContractSuite(label, options) {
5597
5517
  completedAt: at4("2026-05-14T10:01:00.000Z"),
5598
5518
  subject: "00u1",
5599
5519
  email: "founder@acme.com",
5600
- emailVerified: true,
5601
5520
  allowUserCreationWithoutInvitation: true,
5602
- requireNoActiveUsersForUserCreation: true,
5603
5521
  manualGroupIds: ["security-admins"],
5604
5522
  newUserId: "usr_founder",
5605
5523
  session: sessionInput("ses_oidc_bootstrap")
@@ -5611,6 +5529,56 @@ function runAuthStorageContractSuite(label, options) {
5611
5529
  await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_founder" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
5612
5530
  });
5613
5531
  });
5532
+ test6("syncs directory memberships to exactly the groups the provider grants", async () => {
5533
+ await withStorage(async (storage) => {
5534
+ await createUser(storage);
5535
+ for (const [groupId, source] of [
5536
+ ["security-admins", "manual"],
5537
+ ["commercial", "invitation"],
5538
+ ["legacy-team", "directory"]
5539
+ ]) {
5540
+ await storage.groupMemberships.upsert({ projectId: projectId6, userId: "usr_1", groupId, source });
5541
+ }
5542
+ await completeOidcSignInForAva(storage, ["security-admins", "field-ops"]);
5543
+ await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([
5544
+ { groupId: "commercial", source: "invitation" },
5545
+ { groupId: "field-ops", source: "directory" },
5546
+ { groupId: "security-admins", source: "manual" }
5547
+ ]);
5548
+ });
5549
+ });
5550
+ test6("removes every directory membership when the provider grants no groups", async () => {
5551
+ await withStorage(async (storage) => {
5552
+ await createUser(storage);
5553
+ await storage.groupMemberships.upsert({
5554
+ projectId: projectId6,
5555
+ userId: "usr_1",
5556
+ groupId: "security-admins",
5557
+ source: "manual"
5558
+ });
5559
+ await storage.groupMemberships.upsert({
5560
+ projectId: projectId6,
5561
+ userId: "usr_1",
5562
+ groupId: "field-ops",
5563
+ source: "directory"
5564
+ });
5565
+ await completeOidcSignInForAva(storage, []);
5566
+ await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([{ groupId: "security-admins", source: "manual" }]);
5567
+ });
5568
+ });
5569
+ test6("leaves directory memberships alone when sign-in syncs no groups", async () => {
5570
+ await withStorage(async (storage) => {
5571
+ await createUser(storage);
5572
+ await storage.groupMemberships.upsert({
5573
+ projectId: projectId6,
5574
+ userId: "usr_1",
5575
+ groupId: "field-ops",
5576
+ source: "directory"
5577
+ });
5578
+ await completeOidcSignInForAva(storage, undefined);
5579
+ await expect6(storage.groupMemberships.listForUser({ projectId: projectId6, userId: "usr_1" })).resolves.toMatchObject([{ groupId: "field-ops", source: "directory" }]);
5580
+ });
5581
+ });
5614
5582
  test6("suspends users and revokes active sessions immediately", async () => {
5615
5583
  await withStorage(async (storage) => {
5616
5584
  await createUser(storage);
@@ -16024,4 +15992,4 @@ export {
16024
15992
  startTestWebhookRun
16025
15993
  };
16026
15994
 
16027
- //# debugId=02F2DAA06B348FD164756E2164756E21
15995
+ //# debugId=3E6B1E78CE757E1764756E2164756E21