@smartytalent/mcp-tools 0.7.3 → 0.7.4

package/dist/tools.json

@@ -1270,7 +1270,7 @@
             "attributes": {
               "title": "TenantSsoAttributesSchema",
               "type": "object",
-              "description": "Enterprise SSO configuration for one tenant. Written only by the /v1/tenants/{tenantId}/sso doors (sysowner); the generic tenant PATCH strips settings.sso.",
+              "description": "Enterprise SSO configuration for one tenant. The connection itself is written only by POST /v1/tenants/{tenantId}/sso (sysowner); the policy subset in TenantSsoPolicySchema is also reachable by the tenant's owner through PATCH. The generic tenant PATCH strips settings.sso.",
               "properties": {
                 "provider": {
                   "type": "string",
@@ -1365,6 +1365,50 @@
       "operationId": "configureTenantSso"
     }
   },
+  {
+    "name": "update_tenant_sso",
+    "description": "Update Tenant Enterprise SSO Policy",
+    "inputSchema": {
+      "type": "object",
+      "properties": {
+        "data": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "tenant-sso"
+              ]
+            },
+            "attributes": {
+              "title": "TenantSsoPolicySchema",
+              "type": "object",
+              "description": "The policy a customer's OWNER may set on top of an existing SSO connection (PATCH /v1/tenants/{tenantId}/sso). Deliberately a subset: these three fields reach nothing outside the tenant, whereas `domains` claims a name in a GLOBAL registry that phase 1 verifies by hand, and `entraTenantId`/`idpName` identify the connection itself - those stay on the sysowner-only POST. Every field is optional; whatever is omitted keeps its stored value.",
+              "properties": {
+                "required": {
+                  "type": "boolean",
+                  "description": "When true, password login is refused for this tenant's users. Owner and sysowner are always exempt (a break-glass account: an outage at the customer's IdP must not lock them out of the product, or out of this door), as is any user carrying meta.ssoExempt. Switching it from false to true also signs every account out - the enforcement trigger never sees a token refresh, and a refresh token lives 30 days."
+                },
+                "autoApprove": {
+                  "type": "boolean",
+                  "description": "When true, a JIT user is activated immediately with defaultRole instead of landing in a pending state. Off by default: domain-gated JIT makes the customer's whole workforce eligible, so this hands an operational role to anyone who can authenticate at their IdP."
+                },
+                "defaultRole": {
+                  "type": "string",
+                  "description": "Role granted when a pending JIT user is APPROVED - never granted by the act of signing in."
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "_meta": {
+      "method": "PATCH",
+      "path": "/v1/tenants/{tenantId}/sso",
+      "operationId": "updateTenantSso"
+    }
+  },
   {
     "name": "delete_tenant_sso",
     "description": "Delete Tenant Enterprise SSO",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartytalent/mcp-tools",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "MCP tool definitions for SmartyTalent API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",