@sixb/core 0.1.13 → 0.1.15

package/dist/{chunk-w9bp61e7.js → chunk-n5t4mq6z.js}

@@ -2,17 +2,17 @@
 import {
   createSixbError2,
   toSixbFailure2
-} from "./chunk-rzkr70gr.js";
+} from "./chunk-6fsr7y93.js";
 import {
   reportRunFailure2
-} from "./chunk-y6vnvayj.js";
+} from "./chunk-vjcd8d27.js";
 import {
   resolveExecutionScopeAuthorization,
   assertAuthorized2
-} from "./chunk-rzcjp5m2.js";
+} from "./chunk-8fjmqjyx.js";
 import {
   PIPELINE_RUN_FAILURE_CODES2
-} from "./chunk-gc226ten.js";
+} from "./chunk-fjw417jf.js";
 import {
   PipelineRunError2
 } from "./chunk-mmagke4x.js";
@@ -20,7 +20,7 @@ import {
   executionRecordInputFromRuntime,
   ensureExecutionRecord2,
   createPrimitiveExecutionRecord
-} from "./chunk-m8zkvep1.js";
+} from "./chunk-8w27xf9e.js";
 
 // src/pipelines/errors.ts
 class PipelineError2 extends Error {

package/dist/{chunk-n33e8dz8.js → chunk-p0nbkys4.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   principalsEqual2
-} from "./chunk-9pfw47qx.js";
+} from "./chunk-qne45xqq.js";
 import {
   createFileUploadId2,
   isFileUploadSessionExpired,

package/dist/{chunk-04h4t2b5.js → chunk-py2dw8cw.js}

@@ -2,7 +2,7 @@
 import {
   createSixbError2,
   isSixbError2
-} from "./chunk-rzkr70gr.js";
+} from "./chunk-6fsr7y93.js";
 import {
   AiLimitStorageError2
 } from "./chunk-jgwb25gc.js";
@@ -11,7 +11,7 @@ import {
   applicableAiLimitPolicies2,
   aiUsageLimitExceededError2,
   aiUsageLimitUnavailableError2
-} from "./chunk-4tnrzqqh.js";
+} from "./chunk-fj1dvp37.js";
 import {
   AiUsageStorageError2,
   normalizeAiModelCallCostRecord2,
@@ -19,7 +19,7 @@ import {
 } from "./chunk-xnx96gfy.js";
 import {
   AiCostStorageError2
-} from "./chunk-gc226ten.js";
+} from "./chunk-fjw417jf.js";
 import {
   normalizeAiModelCallRecord2
 } from "./chunk-s3csryxe.js";

package/dist/{chunk-jhyc777j.js → chunk-q3grgzp1.js}

@@ -7,13 +7,13 @@ import {
   ConnectorError2,
   createConnectorCodedError,
   getConnectorExecutionSourceResolver
-} from "./chunk-cbn96bve.js";
+} from "./chunk-r5sc1d2b.js";
 import {
   isDatasetDefinition2
 } from "./chunk-cd234ba4.js";
 import {
   SyncValidationError2
-} from "./chunk-a69fkrtr.js";
+} from "./chunk-y0zmae99.js";
 import {
   isOAuthConnectorAdapter,
   isConnectorDefinition

package/dist/{chunk-9pfw47qx.js → chunk-qne45xqq.js}

@@ -5,7 +5,7 @@ import {
   canAccessApplication2,
   resolveRoleGrants2,
   resolveAuthorizationContext2
-} from "./chunk-rzcjp5m2.js";
+} from "./chunk-8fjmqjyx.js";
 import {
   AuthRuntimeError2,
   DEFAULT_AUTH_SESSION_AUDIENCE2,
@@ -17,7 +17,7 @@ import {
   assertNonEmpty3,
   normalizePagination,
   isInvitationDeliveryAuthStrategy2
-} from "./chunk-0321g649.js";
+} from "./chunk-2jntasmh.js";
 import {
   normalizeParams,
   coerceParamsToTyped
@@ -2375,15 +2375,6 @@ class InMemoryAuthStorage2 {
       });
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
-      consumeMagicLinkRecord(this.state, {
-        projectId,
-        id: input.magicLinkId,
-        tokenHash: input.tokenHash,
-        consumedAt: completedAt
-      });
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] Magic link '${input.magicLinkId}' cannot create a user for project '${projectId}'.`);
-    }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience);
     let newUserId;
@@ -2419,8 +2410,9 @@ class InMemoryAuthStorage2 {
       projectId,
       user
     });
-    const memberships = this.applyManualGroups({
+    const memberships = this.applyGroups({
       completedAt,
+      source: "manual",
       groupIds: manualGroupIds,
       projectId,
       userId: user.id,
@@ -2464,26 +2456,14 @@ class InMemoryAuthStorage2 {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("missing_user", `[Sixb] User '${identity.userId}' not found for linked OIDC identity.`);
     }
-    if (!identity && user && (!input.autoLinkByVerifiedEmail || !input.emailVerified)) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("email_link_not_allowed", `[Sixb] OIDC identity cannot auto-link to user '${user.id}' for project '${projectId}'.`);
-    }
     if (user?.status === "suspended") {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("suspended_user", `[Sixb] User '${user.id}' is suspended for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !input.emailVerified) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
-    }
     if (shouldCreateUser && !activeInvitation && !input.allowUserCreationWithoutInvitation) {
       this.consumeOidcAttempt(input, completedAt, projectId);
       throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
     }
-    if (shouldCreateUser && !activeInvitation && input.allowUserCreationWithoutInvitation && input.requireNoActiveUsersForUserCreation && hasActiveUsers(this.state, projectId)) {
-      this.consumeOidcAttempt(input, completedAt, projectId);
-      throw new AuthStorageError2("user_creation_not_allowed", `[Sixb] OIDC authorization attempt '${input.oidcAuthorizationAttemptId}' cannot create a user for project '${projectId}'.`);
-    }
     validateCompleteSessionInput(this.state, projectId, input.session);
     assertSignInSessionAudience(projectId, input.session.audience, attempt.audience);
     let newUserId;
@@ -2513,12 +2493,19 @@ class InMemoryAuthStorage2 {
       projectId,
       user
     });
-    const memberships = this.applyManualGroups({
+    const memberships = this.syncDirectoryGroups({
       completedAt,
-      groupIds: manualGroupIds,
+      groupIds: input.directoryGroupIds,
       projectId,
       userId: user.id,
-      existing: invitation.memberships
+      existing: this.applyGroups({
+        completedAt,
+        source: "manual",
+        groupIds: manualGroupIds,
+        projectId,
+        userId: user.id,
+        existing: invitation.memberships
+      })
     });
     const nextIdentity = {
       projectId,
@@ -2579,19 +2566,30 @@ class InMemoryAuthStorage2 {
     }));
     return { invitation, memberships };
   }
-  applyManualGroups(input) {
+  applyGroups(input) {
     const memberships = [...input.existing];
     for (const groupId of input.groupIds) {
       memberships.push(upsertGroupMembershipRecord(this.state, {
         projectId: input.projectId,
         userId: input.userId,
         groupId,
-        source: "manual",
+        source: input.source,
         createdAt: input.completedAt
       }));
     }
     return memberships;
   }
+  syncDirectoryGroups(input) {
+    if (!input.groupIds) {
+      return input.existing;
+    }
+    const groupIds = normalizeGroupIds(input.groupIds);
+    const stale = [...this.state.groupMemberships.values()].filter((membership) => membership.projectId === input.projectId && membership.userId === input.userId && membership.source === "directory" && !groupIds.includes(membership.groupId));
+    for (const membership of stale) {
+      removeGroupMembershipRecord(this.state, membership);
+    }
+    return this.applyGroups({ ...input, groupIds, source: "directory" });
+  }
   createSignInSession(input) {
     return createSessionRecord(this.state, {
       id: input.session.id,
@@ -2622,14 +2620,6 @@ function restoreMap(target, snapshot) {
     target.set(key, value);
   }
 }
-function hasActiveUsers(state, projectId) {
-  for (const user of state.users.values()) {
-    if (user.projectId === projectId && user.status === "active") {
-      return true;
-    }
-  }
-  return false;
-}
 function assertSignInSessionAudience(projectId, sessionAudience, storedAudience) {
   if (sessionAudience === storedAudience) {
     return;
@@ -3298,7 +3288,7 @@ class AuthRuntime2 {
     const result = await storage.users.list({ projectId: this.projectId, order: input.order });
     const members = [];
     for (const user of result.users) {
-      const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
+      const { groupIds, managedGroupIds } = memberGroups(await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id }));
       const canAssignGroups = canPerformMembershipOperation(scope, "assignGroups", groupIds);
       const canSuspendScope = canPerformMembershipOperation(scope, "suspend", groupIds);
       if (!canAssignGroups && !canSuspendScope) {
@@ -3308,6 +3298,7 @@ class AuthRuntime2 {
       members.push({
         user,
         groupIds,
+        managedGroupIds,
         capabilities: {
           assignGroups: canAssignGroups,
           suspend: canSuspendScope && !isSelf && user.status === "active",
@@ -3322,7 +3313,11 @@ class AuthRuntime2 {
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds: currentGroupIds } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
+    const {
+      user,
+      groupIds: currentGroupIds,
+      managedGroupIds: currentManagedGroupIds
+    } = await this.requireManageableMember(storage, scope, "assignGroups", userId);
     const requestedGroupIds = this.resolveMemberGroupIds(input.groupIds);
     const missing = missingMembershipGroupIds(scope, "assignGroups", requestedGroupIds);
     if (missing.length > 0) {
@@ -3332,6 +3327,10 @@ class AuthRuntime2 {
     const requested = new Set(requestedGroupIds);
     const additions = requestedGroupIds.filter((groupId) => !current.has(groupId));
     const removals = currentGroupIds.filter((groupId) => !requested.has(groupId));
+    const managedRemovals = removals.filter((groupId) => currentManagedGroupIds.includes(groupId));
+    if (managedRemovals.length > 0) {
+      throw new AuthRuntimeError2("invalid_auth_input", `[Sixb] Group(s) ${managedRemovals.join(", ")} are managed by the identity provider. Change them there; they sync at the user's next sign-in.`);
+    }
     if (user.id === caller.user.id && removals.length > 0) {
       throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot remove their own groups.");
     }
@@ -3353,14 +3352,14 @@ class AuthRuntime2 {
       });
     }
     this.sessionCache?.invalidateUser(user.id);
-    const groupIds = (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id })).map((membership) => membership.groupId);
-    return { user, groupIds };
+    const { groupIds, managedGroupIds } = memberGroups(await storage.groupMemberships.listForUser({ projectId: this.projectId, userId: user.id }));
+    return { user, groupIds, managedGroupIds };
   }
   async suspendMember(caller, input) {
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     if (user.id === caller.user.id) {
       throw new AuthRuntimeError2("authorization_denied", "[Sixb] The current user cannot suspend themselves.");
     }
@@ -3370,20 +3369,20 @@ class AuthRuntime2 {
       suspendedAt: new Date
     });
     this.sessionCache?.invalidateUser(user.id);
-    return { user: suspended, groupIds };
+    return { user: suspended, groupIds, managedGroupIds };
   }
   async reactivateMember(caller, input) {
     const storage = this.requireAuthStorage();
     const scope = this.resolveMembershipPolicyScopeForUser(caller.groupIds);
     const userId = assertNonEmpty3(input.userId, "User id");
-    const { user, groupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
+    const { user, groupIds, managedGroupIds } = await this.requireManageableMember(storage, scope, "suspend", userId);
     const reactivated = await storage.users.updateStatus({
       projectId: this.projectId,
       id: user.id,
       status: "active",
       updatedAt: new Date
     });
-    return { user: reactivated, groupIds };
+    return { user: reactivated, groupIds, managedGroupIds };
   }
   async listSessions(caller) {
     return this.requireAuthStorage().sessions.listActiveByUserId({
@@ -3426,11 +3425,11 @@ class AuthRuntime2 {
   }
   async requireManageableMember(storage, scope, operation, userId) {
     const user = await storage.users.getById({ projectId: this.projectId, id: userId });
-    const groupIds = user ? (await storage.groupMemberships.listForUser({ projectId: this.projectId, userId })).map((membership) => membership.groupId) : [];
+    const { groupIds, managedGroupIds } = memberGroups(user ? await storage.groupMemberships.listForUser({ projectId: this.projectId, userId }) : []);
     if (!user || !canPerformMembershipOperation(scope, operation, groupIds)) {
       throw new AuthStorageError2("missing_user", `[Sixb] User '${userId}' not found for project '${this.projectId}'.`);
     }
-    return { user, groupIds };
+    return { user, groupIds, managedGroupIds };
   }
   resolveMemberGroupIds(input) {
     const groupIds = [...new Set(input.map((groupId) => assertNonEmpty3(groupId, "Group id")))];
@@ -3617,6 +3616,12 @@ class AuthRuntime2 {
     throw new AuthRuntimeError2("authorization_denied", `[Sixb] The current user is not allowed to create or manage invitations for group(s): ${missing.join(", ")}.`);
   }
 }
+function memberGroups(memberships) {
+  return {
+    groupIds: memberships.map((membership) => membership.groupId),
+    managedGroupIds: memberships.filter((membership) => membership.source === "directory").map((membership) => membership.groupId)
+  };
+}
 function callerSessionId(caller) {
   return caller.credentialSource === "session" ? caller.session.id : undefined;
 }
@@ -3696,4 +3701,4 @@ function principalsEqual2(left, right) {
 }
 export { ActionDefinitionError2, ActionEditCommitError2, missingActionMutationMessage, effectsWithoutEditsMessage, assertNonEmpty2, isActionDefinition2, isGlobalActionDefinition2, isObjectActionDefinition2, normalizeActionParams, coerceActionParamsToTyped2, validateActionSubject, resolveObjectActionSubject, PERSONAL_ACCESS_TOKEN_PREFIX2, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX2, generateAccessTokenSecret2, hashAccessTokenSecret2, formatAccessTokenValue2, parseAccessTokenValue2, getBearerAccessTokenValue2, createAccessTokenCredential2, setRequestClientAddress2, getRequestClientAddress2, CSRF_HEADER_NAME2, generateCsrfToken2, isCsrfExemptMethod2, verifyDoubleSubmitCsrf2, verifyCsrfToken2, applications2, SecurityValidationError2, isGroupDefinition, isMembershipPolicyDefinition, isRoleDefinition, defineGroup2, defineRole2, defineMembershipPolicy2, every2, ShareDefinitionError2, defineShare2, isShareDefinition, snapshotShareDefinition, can2, SecurityRegistry, AuthStorageError2, MAX_PENDING_DEVICE_AUTHORIZATIONS2, paginate, InMemoryAuthStorage2, generateSessionSecret2, hashSessionSecret2, formatSessionCookieValue2, parseSessionCookieValue2, createSessionCredential2, AuthRuntime2, SYSTEM_PRINCIPAL2, principalsEqual2 };
 
-//# debugId=934CBDB22AF498A264756E2164756E21
+//# debugId=73464FD9FDE5971364756E2164756E21