@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js

@@ -0,0 +1,379 @@
+/**
+ * Organization Configuration Service
+ *
+ * Scope-aware service for managing SSO enforcement, authentication policies,
+ * SIEM export, and SCIM provisioning configuration.
+ * Supports both organization-level and application-level scopes.
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Container, injectable, inject } from 'inversify';
+import { CoreResourceType, AuthScopeType, SsoConfigBaseSchema, } from '@wildo-ai/saas-models';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+let AuthOrganizationConfigurationService = class AuthOrganizationConfigurationService {
+    logger;
+    container;
+    ssoConfigs = new Map();
+    siemExportConfigs = new Map();
+    configChangeListeners = [];
+    logDebug;
+    constructor(logger, container) {
+        this.logger = logger;
+        this.container = container;
+        this.logDebug = this.logger.debugByType('AuthOrganizationConfigurationService');
+        this.logger.setDebugTypeLogging('AuthOrganizationConfigurationService', false);
+    }
+    /**
+     * Organization auth configuration is consulted by services that are themselves
+     * created through the services registry, so we resolve the registry lazily to
+     * avoid re-entering the same singleton graph during backend startup.
+     */
+    getServicesRegistryHandler() {
+        return this.container.get(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService);
+    }
+    // ── Scope resolution helpers ──
+    _cacheKey(scopeType, scopeId) {
+        return `${scopeType}:${scopeId}`;
+    }
+    _scopeFilter(scopeType, scopeId) {
+        return { [scopeType === AuthScopeType.ORGANIZATION ? 'organizationId' : 'applicationId']: scopeId };
+    }
+    _resolveSsoResourceType(scopeType) {
+        return scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SSO_CONFIG
+            : CoreResourceType.APPLICATION_SSO_CONFIG;
+    }
+    _resolveSiemResourceType(scopeType) {
+        return scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG
+            : CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG;
+    }
+    _resolveScimConfigResourceType(scopeType) {
+        return scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG
+            : CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG;
+    }
+    _resolveScimTokensResourceType(scopeType) {
+        return scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SCIM_TOKENS
+            : CoreResourceType.APPLICATION_SCIM_TOKENS;
+    }
+    /**
+     * Get all organization IDs that have SSO configurations loaded.
+     * Filters to organization-scoped entries only, returning plain IDs.
+     */
+    getAllOrganizationIds() {
+        const orgIds = [];
+        for (const key of this.ssoConfigs.keys()) {
+            if (key.startsWith('organization:')) {
+                orgIds.push(key.slice('organization:'.length));
+            }
+        }
+        return orgIds;
+    }
+    /**
+     * Get all application IDs that have SSO configurations loaded.
+     * Filters to application-scoped entries only, returning plain IDs.
+     */
+    getAllApplicationIds() {
+        const appIds = [];
+        for (const key of this.ssoConfigs.keys()) {
+            if (key.startsWith('application:')) {
+                appIds.push(key.slice('application:'.length));
+            }
+        }
+        return appIds;
+    }
+    // ===============================
+    // SSO CONFIGURATION
+    // ===============================
+    async loadSSOConfig(ec, scopeType, scopeId) {
+        const cacheKey = this._cacheKey(scopeType, scopeId);
+        try {
+            const resourceType = this._resolveSsoResourceType(scopeType);
+            const config = await this.getServicesRegistryHandler().read(resourceType, ec, this._scopeFilter(scopeType, scopeId));
+            if (config) {
+                this.ssoConfigs.set(cacheKey, config);
+                return config;
+            }
+            const defaultConfig = this.createDefaultSSOConfig(scopeType, scopeId);
+            const created = await this.getServicesRegistryHandler().create(resourceType, ec, defaultConfig);
+            this.ssoConfigs.set(cacheKey, created);
+            return created;
+        }
+        catch (error) {
+            this.logger.error('Failed to load SSO configuration', { scopeType, scopeId, error });
+            return this.ssoConfigs.get(cacheKey) || null;
+        }
+    }
+    async saveSSOConfig(ec, scopeType, scopeId, config) {
+        const cacheKey = this._cacheKey(scopeType, scopeId);
+        try {
+            const resourceType = this._resolveSsoResourceType(scopeType);
+            const filter = this._scopeFilter(scopeType, scopeId);
+            const existing = await this.getServicesRegistryHandler().read(resourceType, ec, filter);
+            if (existing) {
+                await this.getServicesRegistryHandler().update(resourceType, ec, existing._id, config);
+            }
+            else {
+                await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });
+            }
+            const merged = { ...(existing || {}), ...config };
+            this.ssoConfigs.set(cacheKey, merged);
+            this.logDebug('SSO configuration saved', { scopeType, scopeId });
+            this.notifyConfigChange(scopeType, scopeId, merged);
+        }
+        catch (error) {
+            this.logger.error('Failed to save SSO configuration', { scopeType, scopeId, error });
+            throw error;
+        }
+    }
+    // ===============================
+    // LEGACY PROVIDER METHODS (Block 2B migration target)
+    // ===============================
+    /** @legacy — Will be refactored to use SsoConnection resources */
+    async getSAMLProviders(organizationId) {
+        const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));
+        return config?.samlProviders || [];
+    }
+    /** @legacy — Will be refactored to use SsoConnection resources */
+    async getOpenIDConnectProviders(organizationId) {
+        const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));
+        return config?.openidConnectProviders || [];
+    }
+    /** @legacy — Will be refactored to use SsoConnection resources */
+    async getDefaultSSOProvider(organizationId) {
+        const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));
+        if (!config)
+            return null;
+        const defaultSAML = config.samlProviders?.find((p) => p.isDefault && p.enabled);
+        if (defaultSAML)
+            return defaultSAML;
+        const defaultOIDC = config.openidConnectProviders?.find((p) => p.isDefault && p.enabled);
+        if (defaultOIDC)
+            return defaultOIDC;
+        const firstEnabled = config.samlProviders?.find((p) => p.enabled)
+            || config.openidConnectProviders?.find((p) => p.enabled);
+        return firstEnabled || null;
+    }
+    /** @legacy — Will be refactored to use SsoConnection resources */
+    async getSSOProviderByDomain(organizationId, emailDomain) {
+        const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));
+        if (!config || !config.domains?.domainHinting)
+            return null;
+        if (!config.domains.ssoEnabledDomains?.includes(emailDomain))
+            return null;
+        const samlProvider = config.samlProviders?.find((p) => p.enabled && p.allowedDomains?.includes(emailDomain));
+        if (samlProvider)
+            return samlProvider;
+        const oidcProvider = config.openidConnectProviders?.find((p) => p.enabled && p.allowedDomains?.includes(emailDomain));
+        return oidcProvider || null;
+    }
+    // ===============================
+    // CONVENIENCE METHODS
+    // ===============================
+    async isSSORequired(ec, scopeType, scopeId) {
+        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
+        return config?.enforcement.requireSSO || false;
+    }
+    async isPasswordFallbackAllowed(ec, scopeType, scopeId) {
+        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
+        return config?.enforcement.allowPasswordFallback ?? true;
+    }
+    async getDomains(ec, scopeType, scopeId) {
+        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
+        return {
+            verified: config?.domains.verifiedDomains || [],
+            ssoEnabled: config?.domains.ssoEnabledDomains || [],
+            allowExternal: config?.domains.allowExternalDomains || false,
+        };
+    }
+    async isEmergencyAccessEnabled(ec, scopeType, scopeId) {
+        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
+        return config?.emergencyAccess.enabled || false;
+    }
+    async getEmergencyAccessAccounts(ec, scopeType, scopeId) {
+        const config = await this.loadSSOConfig(ec, scopeType, scopeId);
+        return config?.emergencyAccess.breakGlassAccounts || [];
+    }
+    validateSSOConfig(config) {
+        const result = SsoConfigBaseSchema.safeParse(config);
+        if (result.success) {
+            return { isValid: true, errors: [] };
+        }
+        else {
+            const zodError = result.error;
+            const errors = zodError.issues.map(issue => issue.message);
+            return { isValid: false, errors };
+        }
+    }
+    // ===============================
+    // CONFIG CHANGE LISTENERS
+    // ===============================
+    onConfigChange(callback) {
+        this.configChangeListeners.push(callback);
+    }
+    notifyConfigChange(scopeType, scopeId, config) {
+        this.configChangeListeners.forEach(callback => {
+            try {
+                callback(scopeType, scopeId, config);
+            }
+            catch (error) {
+                this.logger.error('Error in configuration change listener', { scopeType, scopeId, error });
+            }
+        });
+    }
+    // ===============================
+    // DEFAULT SSO CONFIG
+    // ===============================
+    createDefaultSSOConfig(scopeType, scopeId) {
+        return {
+            ...this._scopeFilter(scopeType, scopeId),
+            enforcement: {
+                requireSSO: false,
+                allowPasswordFallback: true,
+                enforceForAdmins: true,
+                graceLoginAttempts: 3,
+            },
+            domains: {
+                verifiedDomains: [],
+                ssoEnabledDomains: [],
+                domainHinting: true,
+                allowExternalDomains: false,
+                domainVerificationStatus: {},
+                domainVerificationTokens: {},
+            },
+            provisioning: {
+                autoCreateUsers: true,
+                autoUpdateUsers: true,
+                autoDeactivateUsers: false,
+                requiredAttributes: ['email'],
+                syncFrequencyHours: 24,
+            },
+            sessionSettings: {
+                ssoSessionDurationMinutes: 480,
+                requireReauthForSensitive: true,
+                singleLogoutEnabled: true,
+                maxConcurrentSessions: 5,
+            },
+            auditConfig: {
+                logAllSSOEvents: true,
+                logProviderSwitching: true,
+                logRoleMapping: true,
+                complianceReporting: false,
+                retentionDays: 365,
+            },
+            emergencyAccess: {
+                enabled: true,
+                breakGlassAccounts: [],
+                requireApproval: true,
+                maxDurationHours: 24,
+                auditLevel: 'verbose',
+            },
+            oauth2ProviderRestrictions: {
+                allowedProviders: [],
+                blockedProviders: [],
+                requireEnterpriseSSOOnly: false,
+            },
+        };
+    }
+    // ===============================
+    // SIEM EXPORT CONFIGURATION
+    // ===============================
+    async loadSiemExportConfig(ec, scopeType, scopeId) {
+        const cacheKey = this._cacheKey(scopeType, scopeId);
+        try {
+            const resourceType = this._resolveSiemResourceType(scopeType);
+            const config = await this.getServicesRegistryHandler().read(resourceType, ec, this._scopeFilter(scopeType, scopeId));
+            if (config) {
+                this.siemExportConfigs.set(cacheKey, config);
+                return config;
+            }
+            const defaultConfig = { ...this._scopeFilter(scopeType, scopeId) };
+            const created = await this.getServicesRegistryHandler().create(resourceType, ec, defaultConfig);
+            this.siemExportConfigs.set(cacheKey, created);
+            return created;
+        }
+        catch (error) {
+            this.logger.error('Failed to load SIEM export configuration', { scopeType, scopeId, error });
+            return this.siemExportConfigs.get(cacheKey) || null;
+        }
+    }
+    async saveSiemExportConfig(ec, scopeType, scopeId, config) {
+        const cacheKey = this._cacheKey(scopeType, scopeId);
+        try {
+            const resourceType = this._resolveSiemResourceType(scopeType);
+            const filter = this._scopeFilter(scopeType, scopeId);
+            const existing = await this.getServicesRegistryHandler().read(resourceType, ec, filter);
+            if (existing) {
+                await this.getServicesRegistryHandler().update(resourceType, ec, existing._id, config);
+            }
+            else {
+                await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });
+            }
+            const merged = { ...(existing || {}), ...config };
+            this.siemExportConfigs.set(cacheKey, merged);
+            this.logDebug('SIEM export configuration saved', { scopeType, scopeId, enabled: merged.enabled });
+        }
+        catch (error) {
+            this.logger.error('Failed to save SIEM export configuration', { scopeType, scopeId, error });
+            throw error;
+        }
+    }
+    async isSecurityExportEnabled(ec, scopeType, scopeId) {
+        const config = await this.loadSiemExportConfig(ec, scopeType, scopeId);
+        return config?.enabled || false;
+    }
+    // ===============================
+    // SCIM PROVISIONING CONFIGURATION
+    // ===============================
+    async loadScimProvisioningConfig(ec, scopeType, scopeId) {
+        try {
+            const resourceType = this._resolveScimConfigResourceType(scopeType);
+            const config = await this.getServicesRegistryHandler().read(resourceType, ec, this._scopeFilter(scopeType, scopeId));
+            if (config)
+                return config;
+            let scimEnabled = false;
+            try {
+                const tokensResourceType = this._resolveScimTokensResourceType(scopeType);
+                const tokens = await this.getServicesRegistryHandler().list(tokensResourceType, ec, { ...this._scopeFilter(scopeType, scopeId), isActive: true }, undefined, { paginated: false });
+                scimEnabled = (tokens?.length || 0) > 0;
+            }
+            catch {
+                // If token repo not available, default to false
+            }
+            const defaultConfig = {
+                ...this._scopeFilter(scopeType, scopeId),
+                scimEnabled,
+                defaultOrgRole: 'ORG_MEMBER',
+                deprovisioningBehavior: 'deactivate',
+            };
+            const created = await this.getServicesRegistryHandler().create(resourceType, ec, defaultConfig);
+            return created;
+        }
+        catch (error) {
+            this.logger.error('Failed to load SCIM provisioning configuration', { scopeType, scopeId, error });
+            return null;
+        }
+    }
+};
+AuthOrganizationConfigurationService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.Container)),
+    __metadata("design:paramtypes", [LoggerService,
+        Container])
+], AuthOrganizationConfigurationService);
+export { AuthOrganizationConfigurationService };
+//# sourceMappingURL=auth-organization-configuration.service.js.map

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-organization-configuration.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/auth-organization-configuration.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;;;;;;;;;;;;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,mBAAmB,GAGpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAmBtF,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAOF;IACY;IAPjD,UAAU,GAA+B,IAAI,GAAG,EAAE,CAAC;IACnD,iBAAiB,GAAsC,IAAI,GAAG,EAAE,CAAC;IACjE,qBAAqB,GAAsF,EAAE,CAAC;IAC5G,QAAQ,CAA+D;IAEjF,YAC6C,MAAqB,EACT,SAAoB;QADhC,WAAM,GAAN,MAAM,CAAe;QACT,cAAS,GAAT,SAAS,CAAW;QAE3E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;OAIG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACtH,CAAC;IAED,iCAAiC;IAEzB,SAAS,CAAC,SAAwB,EAAE,OAAe;QACzD,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,SAAwB,EAAE,OAAe;QAC5D,OAAO,EAAE,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IACtG,CAAC;IAEO,uBAAuB,CAAC,SAAwB;QACtD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,uBAAuB;YAC1C,CAAC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IAEO,wBAAwB,CAAC,SAAwB;QACvD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,+BAA+B;YAClD,CAAC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IACtD,CAAC;IAEO,8BAA8B,CAAC,SAAwB;QAC7D,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,qCAAqC;YACxD,CAAC,CAAC,gBAAgB,CAAC,oCAAoC,CAAC;IAC5D,CAAC;IAEO,8BAA8B,CAAC,SAAwB;QAC7D,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,wBAAwB;YAC3C,CAAC,CAAC,gBAAgB,CAAC,uBAAuB,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACI,qBAAqB;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,oBAAoB;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kCAAkC;IAClC,oBAAoB;IACpB,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAgB,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACpI,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAgB,YAAY,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAC/G,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAA8B;QAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAgB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACvG,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAAmB,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,sDAAsD;IACtD,kCAAkC;IAElC,kEAAkE;IAC3D,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,aAAa,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,yBAAyB,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,sBAAsB,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,qBAAqB,CAAC,cAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACrF,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;eACjE,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,sBAAsB,CACjC,cAAsB,EACtB,WAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1E,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACzD,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAClE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,sBAAsB;IACtB,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,UAAU,IAAI,KAAK,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAK1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO;YACL,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,EAAE;YAC/C,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YACnD,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,KAAK;SAC7D,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,wBAAwB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACxG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,eAAe,CAAC,OAAO,IAAI,KAAK,CAAC;IAClD,CAAC;IAEM,KAAK,CAAC,0BAA0B,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC1G,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,eAAe,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC1D,CAAC;IAEM,iBAAiB,CAAC,MAA8B;QACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAI,MAAoD,CAAC,KAAK,CAAC;YAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAE3B,cAAc,CAAC,QAAoF;QACxG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,SAAwB,EAAE,OAAe,EAAE,MAAqB;QACzF,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC5C,IAAI,CAAC;gBACH,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,qBAAqB;IACrB,kCAAkC;IAE3B,sBAAsB,CAAC,SAAwB,EAAE,OAAe;QACrE,OAAO;YACL,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;YACxC,WAAW,EAAE;gBACX,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,IAAI;gBAC3B,gBAAgB,EAAE,IAAI;gBACtB,kBAAkB,EAAE,CAAC;aACtB;YACD,OAAO,EAAE;gBACP,eAAe,EAAE,EAAE;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,aAAa,EAAE,IAAI;gBACnB,oBAAoB,EAAE,KAAK;gBAC3B,wBAAwB,EAAE,EAAE;gBAC5B,wBAAwB,EAAE,EAAE;aAC7B;YACD,YAAY,EAAE;gBACZ,eAAe,EAAE,IAAI;gBACrB,eAAe,EAAE,IAAI;gBACrB,mBAAmB,EAAE,KAAK;gBAC1B,kBAAkB,EAAE,CAAC,OAAO,CAAC;gBAC7B,kBAAkB,EAAE,EAAE;aACvB;YACD,eAAe,EAAE;gBACf,yBAAyB,EAAE,GAAG;gBAC9B,yBAAyB,EAAE,IAAI;gBAC/B,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,CAAC;aACzB;YACD,WAAW,EAAE;gBACX,eAAe,EAAE,IAAI;gBACrB,oBAAoB,EAAE,IAAI;gBAC1B,cAAc,EAAE,IAAI;gBACpB,mBAAmB,EAAE,KAAK;gBAC1B,aAAa,EAAE,GAAG;aACnB;YACD,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,EAAE;gBACtB,eAAe,EAAE,IAAI;gBACrB,gBAAgB,EAAE,EAAE;gBACpB,UAAU,EAAE,SAAS;aACtB;YACD,0BAA0B,EAAE;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,wBAAwB,EAAE,KAAK;aAChC;SACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAE3B,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACpG,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAuB,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC3I,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAuB,YAAY,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YACtH,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAAqC;QAC3I,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAuB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9G,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAA0B,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAClC,CAAC;IAED,kCAAkC;IAClC,kCAAkC;IAClC,kCAAkC;IAE3B,KAAK,CAAC,0BAA0B,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC1G,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAA6B,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACjJ,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAM,kBAAkB,EAAE,EAAE,EACrF,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAC5D,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACvB,CAAC;gBACX,WAAW,GAAG,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;YAED,MAAM,aAAa,GAAG;gBACpB,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;gBACxC,WAAW;gBACX,cAAc,EAAE,YAAY;gBAC5B,sBAAsB,EAAE,YAAY;aACrC,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAA6B,YAAY,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;YAC5H,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAnYY,oCAAoC;IADhD,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;qCADc,aAAa;QACE,SAAS;GARlE,oCAAoC,CAmYhD"}

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts

@@ -0,0 +1,79 @@
+/**
+ * DomainToOrgLookupBackendService
+ *
+ * Provides domain-based organization lookup for SSO routing.
+ * When a user enters their email, this service determines if their domain
+ * is claimed by an organization with SSO configured.
+ *
+ * Step 14: Enterprise SSO — Domain Routing in Auth Flow
+ * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)
+ *
+ * Used by:
+ * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check
+ * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing
+ */
+import 'reflect-metadata';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import type { ServicesRegistryHandlerBackendService } from '../../../../base-classes/services/services/services-registry-handler.backend.service.js';
+import { AuthScopeType } from '@wildo-ai/saas-models';
+import type { SsoConfigBase } from '@wildo-ai/saas-models';
+import { SsoProtocol } from '../../../../security/authentications/models/auth-constants.backend.js';
+import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas.js';
+/**
+ * Result of a domain-based scope lookup.
+ * Returns scope discriminator instead of bare organizationId — supports both ORG and APP scope.
+ * organizationId is an alias for scopeId (backward compat for config objects).
+ */
+export interface DomainOrgLookupResult {
+    scopeType: AuthScopeType;
+    scopeId: string;
+    /** Alias for scopeId — backward compat for config.organizationId */
+    organizationId: string;
+    enforcement?: {
+        requireSSO?: boolean;
+        allowPasswordFallback?: boolean;
+        enforceForAdmins?: boolean;
+        graceLoginAttempts?: number;
+    };
+    ssoConfig: SsoConfigBase;
+    /** The specific SSO provider that matches the domain (OIDC or SAML) */
+    matchedProvider?: Record<string, unknown>;
+    /** Provider type discriminant */
+    matchedProviderType?: SsoProtocol;
+}
+export declare class DomainToOrgLookupBackendService {
+    private readonly logger;
+    private readonly orgConfigService;
+    private readonly servicesRegistryHandler;
+    private readonly logDebug;
+    constructor(logger: LoggerService, orgConfigService: AuthOrganizationConfigurationService, servicesRegistryHandler: ServicesRegistryHandlerBackendService);
+    /**
+     * Find the scope (organization or application) that claims the given email domain for SSO.
+     *
+     * Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,
+     * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).
+     * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.
+     */
+    findOrgByDomain(ec: ExecutionContext<any>, domain: string): Promise<DomainOrgLookupResult | null>;
+    /**
+     * Indexed cross-scope query: find enabled connections that explicitly list this domain
+     * in allowedDomains, then verify DNS status via the SSO config for the matched scope.
+     */
+    private _findConnectionByDomain;
+    /**
+     * Try to match a domain against a specific scope's SSO config.
+     */
+    private _matchDomainInScope;
+    /**
+     * Get the SSO provider info needed for the identification response.
+     * Called by identify() when a domain match is found.
+     */
+    getSSOProviderInfo(result: DomainOrgLookupResult): {
+        displayName: string;
+        providerRef: string;
+        connectionId: string;
+        providerType: SsoProtocol;
+    } | null;
+}
+//# sourceMappingURL=domain-to-org-lookup.backend.service.d.ts.map

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-to-org-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAoB,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAqB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,2EAA2E,CAAC;AACxG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,WAAW,CAAC;CACnC;AAED,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IALrG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC,EAC5D,uBAAuB,EAAE,qCAAqC;IAM5I;;;;;;OAMG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2B9G;;;OAGG;YACW,uBAAuB;IAsDrC;;OAEG;YACW,mBAAmB;IAkEjC;;;OAGG;IACI,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,GAAG;QACxD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,IAAI;CAWT"}