@smartytalent/mcp-tools 0.7.2 → 0.7.4

package/dist/tools.json

@@ -1270,7 +1270,7 @@
             "attributes": {
               "title": "TenantSsoAttributesSchema",
               "type": "object",
-              "description": "Enterprise SSO configuration for one tenant. Written only by the /v1/tenants/{tenantId}/sso doors (sysowner); the generic tenant PATCH strips settings.sso.",
+              "description": "Enterprise SSO configuration for one tenant. The connection itself is written only by POST /v1/tenants/{tenantId}/sso (sysowner); the policy subset in TenantSsoPolicySchema is also reachable by the tenant's owner through PATCH. The generic tenant PATCH strips settings.sso.",
               "properties": {
                 "provider": {
                   "type": "string",
@@ -1330,6 +1330,14 @@
                   "type": "string",
                   "description": "The admin-consent link an operator sends to the customer's IT. Built server-side so the app registration id is never hardcoded in a client. Absent if the platform Microsoft provider cannot be read."
                 },
+                "sessionsRevoked": {
+                  "type": "integer",
+                  "description": "POST response, present ONLY on the transition to required=true: how many accounts were signed out everywhere. The PreAuthentication gate stops new password sign-ins but never fires on token refresh, and a refresh token lives 30 days - so without this sweep the switch would take a month to take effect for anyone already signed in. Nobody is exempt, including the break-glass roles: they keep their password and simply sign in again."
+                },
+                "sessionsFailed": {
+                  "type": "integer",
+                  "description": "POST response, alongside sessionsRevoked: accounts the sweep could not sign out. Non-zero means the door is partially open - those sessions keep working until their refresh token expires - and the operator is the only one positioned to see it, which is why it is returned rather than only logged."
+                },
                 "idpDeleted": {
                   "type": "boolean",
                   "description": "DELETE response only: whether the customer's Cognito identity provider was actually removed. False when it was already gone, so a retry of the teardown reads as success rather than an error."
@@ -1357,6 +1365,50 @@
       "operationId": "configureTenantSso"
     }
   },
+  {
+    "name": "update_tenant_sso",
+    "description": "Update Tenant Enterprise SSO Policy",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "data": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "tenant-sso"
+              ]
+            },
+            "attributes": {
+              "title": "TenantSsoPolicySchema",
+              "type": "object",
+              "description": "The policy a customer's OWNER may set on top of an existing SSO connection (PATCH /v1/tenants/{tenantId}/sso). Deliberately a subset: these three fields reach nothing outside the tenant, whereas `domains` claims a name in a GLOBAL registry that phase 1 verifies by hand, and `entraTenantId`/`idpName` identify the connection itself - those stay on the sysowner-only POST. Every field is optional; whatever is omitted keeps its stored value.",
+              "properties": {
+                "required": {
+                  "type": "boolean",
+                  "description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt (a break-glass account: an outage at the customer's IdP must not lock them out of the product, or out of this door), as is any user carrying meta.ssoExempt. Switching it from false to true also signs every account out - the enforcement trigger never sees a token refresh, and a refresh token lives 30 days."
+                },
+                "autoApprove": {
+                  "type": "boolean",
+                  "description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default: domain-gated JIT makes the customer's whole workforce eligible, so this hands an operational role to anyone who can authenticate at their IdP."
+                },
+                "defaultRole": {
+                  "type": "string",
+                  "description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in."
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "_meta": {
+      "method": "PATCH",
+      "path": "/v1/tenants/{tenantId}/sso",
+      "operationId": "updateTenantSso"
+    }
+  },
   {
     "name": "delete_tenant_sso",
     "description": "Delete Tenant Enterprise SSO",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartytalent/mcp-tools",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "MCP tool definitions for SmartyTalent API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",