@wildo-ai/saas-backend-lib 1.0.1

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js

@@ -0,0 +1,205 @@
+/**
+ * DomainToOrgLookupBackendService
+ *
+ * Provides domain-based organization lookup for SSO routing.
+ * When a user enters their email, this service determines if their domain
+ * is claimed by an organization with SSO configured.
+ *
+ * Step 14: Enterprise SSO — Domain Routing in Auth Flow
+ * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)
+ *
+ * Used by:
+ * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check
+ * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { CoreResourceType, AuthScopeType } from '@wildo-ai/saas-models';
+let DomainToOrgLookupBackendService = class DomainToOrgLookupBackendService {
+    logger;
+    orgConfigService;
+    servicesRegistryHandler;
+    logDebug;
+    constructor(logger, orgConfigService, servicesRegistryHandler) {
+        this.logger = logger;
+        this.orgConfigService = orgConfigService;
+        this.servicesRegistryHandler = servicesRegistryHandler;
+        this.logDebug = this.logger.debugByType('DomainToOrgLookup');
+        this.logger.setDebugTypeLogging('DomainToOrgLookup', false);
+    }
+    /**
+     * Find the scope (organization or application) that claims the given email domain for SSO.
+     *
+     * Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,
+     * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).
+     * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.
+     */
+    async findOrgByDomain(ec, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        this.logDebug('Looking up scope by email domain', { domain: normalizedDomain });
+        // 1. Fast path: indexed query for connections with explicit domain match
+        for (const scopeType of [AuthScopeType.ORGANIZATION, AuthScopeType.APPLICATION]) {
+            const result = await this._findConnectionByDomain(ec, scopeType, normalizedDomain);
+            if (result)
+                return result;
+        }
+        // 2. Fallback: iterate scopes for wildcard connections (empty allowedDomains)
+        const orgIds = this.orgConfigService.getAllOrganizationIds();
+        for (const orgId of orgIds) {
+            const result = await this._matchDomainInScope(ec, AuthScopeType.ORGANIZATION, orgId, normalizedDomain);
+            if (result)
+                return result;
+        }
+        const appIds = this.orgConfigService.getAllApplicationIds?.() ?? [];
+        for (const appId of appIds) {
+            const result = await this._matchDomainInScope(ec, AuthScopeType.APPLICATION, appId, normalizedDomain);
+            if (result)
+                return result;
+        }
+        this.logDebug('No scope claims this domain', { domain: normalizedDomain });
+        return null;
+    }
+    /**
+     * Indexed cross-scope query: find enabled connections that explicitly list this domain
+     * in allowedDomains, then verify DNS status via the SSO config for the matched scope.
+     */
+    async _findConnectionByDomain(ec, scopeType, normalizedDomain) {
+        const resourceType = scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS
+            : CoreResourceType.APPLICATION_SSO_CONNECTIONS;
+        try {
+            const connections = await this.servicesRegistryHandler.list(resourceType, ec, {
+                enabled: true,
+                allowedDomains: normalizedDomain,
+            }, undefined, { paginated: false });
+            const connectionsList = connections ?? [];
+            for (const conn of connectionsList) {
+                const scopeId = scopeType === AuthScopeType.ORGANIZATION
+                    ? conn.organizationId
+                    : conn.applicationId;
+                if (!scopeId)
+                    continue;
+                const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+                if (!ssoConfig)
+                    continue;
+                const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];
+                const isDnsVerified = verificationStatus === 'verified';
+                const domainMatches = isDnsVerified
+                    && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)
+                        || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
+                if (!domainMatches)
+                    continue;
+                this.logDebug('Domain matched via indexed query', {
+                    domain: normalizedDomain, scopeType, scopeId, matchedProviderType: conn.protocol,
+                });
+                return {
+                    scopeType,
+                    scopeId,
+                    organizationId: scopeId,
+                    enforcement: ssoConfig.enforcement,
+                    ssoConfig,
+                    matchedProvider: conn,
+                    matchedProviderType: conn.protocol,
+                };
+            }
+        }
+        catch {
+            this.logDebug('SsoConnection repository not available for indexed query', { scopeType });
+        }
+        return null;
+    }
+    /**
+     * Try to match a domain against a specific scope's SSO config.
+     */
+    async _matchDomainInScope(ec, scopeType, scopeId, normalizedDomain) {
+        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+        if (!ssoConfig)
+            return null;
+        // H4: Only trust domains that have passed DNS verification
+        const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];
+        const isDnsVerified = verificationStatus === 'verified';
+        const domainMatches = isDnsVerified
+            && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)
+                || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
+        if (!domainMatches)
+            return null;
+        // Find the matching SSO connection for this domain from SsoConnection resources
+        let matchedProvider;
+        let matchedProviderType;
+        const resourceType = scopeType === AuthScopeType.ORGANIZATION
+            ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS
+            : CoreResourceType.APPLICATION_SSO_CONNECTIONS;
+        try {
+            const scopeFilter = {
+                enabled: true,
+                ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),
+            };
+            const connections = await this.servicesRegistryHandler.list(resourceType, ec, scopeFilter, undefined, { paginated: false });
+            const connectionsList = connections ?? [];
+            const match = connectionsList.find(conn => conn.allowedDomains.length === 0 || conn.allowedDomains.includes(normalizedDomain));
+            if (match) {
+                matchedProvider = match;
+                matchedProviderType = match.protocol;
+            }
+        }
+        catch {
+            this.logDebug('SsoConnection repository not available for scope', { scopeType, scopeId });
+        }
+        this.logDebug('Domain matched to scope', {
+            domain: normalizedDomain,
+            scopeType,
+            scopeId,
+            matchedProviderType,
+            requireSSO: ssoConfig.enforcement.requireSSO,
+        });
+        return {
+            scopeType,
+            scopeId,
+            organizationId: scopeId,
+            enforcement: ssoConfig.enforcement,
+            ssoConfig,
+            matchedProvider,
+            matchedProviderType,
+        };
+    }
+    /**
+     * Get the SSO provider info needed for the identification response.
+     * Called by identify() when a domain match is found.
+     */
+    getSSOProviderInfo(result) {
+        if (!result.matchedProvider || !result.matchedProviderType)
+            return null;
+        const provider = result.matchedProvider;
+        return {
+            displayName: provider.displayName,
+            providerRef: provider.externalProviderId || 'custom-oidc',
+            connectionId: provider._id || result.scopeId,
+            providerType: result.matchedProviderType,
+        };
+    }
+};
+DomainToOrgLookupBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService)),
+    __metadata("design:paramtypes", [LoggerService,
+        AuthOrganizationConfigurationService, Function])
+], DomainToOrgLookupBackendService);
+export { DomainToOrgLookupBackendService };
+//# sourceMappingURL=domain-to-org-lookup.backend.service.js.map

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-to-org-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA6BjE,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAIY;IAC8B;IACN;IAL7D,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAC5D,uBAA8D;QAFtF,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QAE1I,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEhF,yEAAyE;QACzE,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,EAAyB,EACzB,SAAwB,EACxB,gBAAwB;QAExB,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE;gBAC/F,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,gBAAgB;aACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YAC3D,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;oBACtD,CAAC,CAAE,IAAgC,CAAC,cAAwB;oBAC5D,CAAC,CAAE,IAAgC,CAAC,aAAuB,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAEzB,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;gBAC1F,MAAM,aAAa,GAAG,kBAAkB,KAAK,UAAU,CAAC;gBACxD,MAAM,aAAa,GAAG,aAAa;uBAC9B,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;2BAC3D,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEvE,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAChD,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACjF,CAAC,CAAC;gBAEH,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,cAAc,EAAE,OAAO;oBACvB,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS;oBACT,eAAe,EAAE,IAA0C;oBAC3D,mBAAmB,EAAE,IAAI,CAAC,QAAuB;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,gBAAwB;QAExB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,kBAAkB,KAAK,UAAU,CAAC;QAExD,MAAM,aAAa,GAAG,aAAa;eAC9B,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;mBAC3D,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEvE,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,gFAAgF;QAChF,IAAI,eAAoD,CAAC;QACzD,IAAI,mBAA4C,CAAC;QAEjD,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;aACzG,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YACtK,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnF,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAA2C,CAAC;gBAC9D,mBAAmB,GAAG,KAAK,CAAC,QAAuB,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,OAAO;YACP,mBAAmB;YACnB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,UAAU;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,OAAO;YACP,cAAc,EAAE,OAAO;YACvB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,MAA6B;QAMrD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAqB;YAC3C,WAAW,EAAG,QAAQ,CAAC,kBAA6B,IAAI,aAAa;YACrE,YAAY,EAAG,QAAQ,CAAC,GAAc,IAAI,MAAM,CAAC,OAAO;YACxD,YAAY,EAAE,MAAM,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;CACF,CAAA;AAjMY,+BAA+B;IAD3C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;qCAFE,aAAa;QAC2B,oCAAoC;GAL/H,+BAA+B,CAiM3C"}

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts

@@ -0,0 +1,59 @@
+/**
+ * DomainVerificationBackendService — H4 fix
+ *
+ * DNS TXT record verification for domain ownership claims.
+ * Prevents domain takeover by requiring orgs to prove they own
+ * domains before those domains are trusted for SSO routing.
+ *
+ * Verification flow:
+ * 1. Admin claims a domain → service generates a unique verification token
+ * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`
+ * 3. Admin triggers verification → service resolves DNS TXT and compares tokens
+ * 4. On match, domain status becomes 'verified'; on failure, 'failed'
+ */
+import 'reflect-metadata';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { AuthScopeType } from '@wildo-ai/saas-models';
+import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas.js';
+/** Result of a domain verification attempt */
+export interface DomainVerificationResult {
+    domain: string;
+    status: 'pending' | 'verified' | 'failed' | 'expired';
+    verificationToken: string;
+    dnsRecordsFound: string[];
+}
+export declare class DomainVerificationBackendService {
+    private readonly logger;
+    private readonly orgConfigService;
+    private readonly logDebug;
+    constructor(logger: LoggerService, orgConfigService: AuthOrganizationConfigurationService);
+    /**
+     * Initiate domain verification: generate a token and store it in the org's SSO config.
+     * Returns the token the admin must add as a DNS TXT record.
+     */
+    initiateDomainVerification(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, domain: string): Promise<{
+        verificationToken: string;
+        dnsRecord: string;
+        dnsName: string;
+    }>;
+    /**
+     * Verify domain ownership by checking DNS TXT records.
+     * Updates the domain's verification status in the org's SSO config.
+     */
+    verifyDomainOwnership(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, domain: string): Promise<DomainVerificationResult>;
+    /**
+     * Check if a domain is verified for the given scope.
+     */
+    isDomainVerified(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, domain: string): Promise<boolean>;
+    /**
+     * Get the list of verified domains for the given scope.
+     * Only returns domains with verificationStatus === 'verified'.
+     */
+    getVerifiedDomains(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<string[]>;
+    /**
+     * Resolve DNS TXT records for the verification subdomain and check for the expected token.
+     */
+    private _checkDnsTxtRecord;
+}
+//# sourceMappingURL=domain-verification.backend.service.d.ts.map

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-verification.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAQD,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAJpG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC;IAM1I;;;OAGG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAiCF;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC;IAkDpC;;OAEG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAOnB;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IASpB;;OAEG;YACW,kBAAkB;CAyBjC"}

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js

@@ -0,0 +1,179 @@
+/**
+ * DomainVerificationBackendService — H4 fix
+ *
+ * DNS TXT record verification for domain ownership claims.
+ * Prevents domain takeover by requiring orgs to prove they own
+ * domains before those domains are trusted for SSO routing.
+ *
+ * Verification flow:
+ * 1. Admin claims a domain → service generates a unique verification token
+ * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`
+ * 3. Admin triggers verification → service resolves DNS TXT and compares tokens
+ * 4. On match, domain status becomes 'verified'; on failure, 'failed'
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import 'reflect-metadata';
+import { injectable, inject } from 'inversify';
+import { randomUUID } from 'crypto';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+/** Expected DNS TXT record prefix */
+const VERIFICATION_PREFIX = 'wildo-domain-verification=';
+/** DNS TXT record subdomain */
+const VERIFICATION_SUBDOMAIN = '_wildo-verification';
+let DomainVerificationBackendService = class DomainVerificationBackendService {
+    logger;
+    orgConfigService;
+    logDebug;
+    constructor(logger, orgConfigService) {
+        this.logger = logger;
+        this.orgConfigService = orgConfigService;
+        this.logDebug = this.logger.debugByType('DomainVerification');
+        this.logger.setDebugTypeLogging('DomainVerification', false);
+    }
+    /**
+     * Initiate domain verification: generate a token and store it in the org's SSO config.
+     * Returns the token the admin must add as a DNS TXT record.
+     */
+    async initiateDomainVerification(ec, scopeType, scopeId, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        const verificationToken = randomUUID();
+        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+        if (!ssoConfig) {
+            const defaultConfig = this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId);
+            defaultConfig.domains.verifiedDomains = [normalizedDomain];
+            defaultConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';
+            defaultConfig.domains.domainVerificationTokens[normalizedDomain] = verificationToken;
+            await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, defaultConfig);
+        }
+        else {
+            if (!ssoConfig.domains.verifiedDomains.includes(normalizedDomain)) {
+                ssoConfig.domains.verifiedDomains.push(normalizedDomain);
+            }
+            ssoConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';
+            ssoConfig.domains.domainVerificationTokens[normalizedDomain] = verificationToken;
+            await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);
+        }
+        this.logDebug('Domain verification initiated', {
+            scopeType,
+            scopeId,
+            domain: normalizedDomain,
+        });
+        return {
+            verificationToken,
+            dnsRecord: `${VERIFICATION_PREFIX}${verificationToken}`,
+            dnsName: `${VERIFICATION_SUBDOMAIN}.${normalizedDomain}`,
+        };
+    }
+    /**
+     * Verify domain ownership by checking DNS TXT records.
+     * Updates the domain's verification status in the org's SSO config.
+     */
+    async verifyDomainOwnership(ec, scopeType, scopeId, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+        if (!ssoConfig) {
+            return {
+                domain: normalizedDomain,
+                status: 'failed',
+                verificationToken: '',
+                dnsRecordsFound: [],
+            };
+        }
+        const expectedToken = ssoConfig.domains.domainVerificationTokens?.[normalizedDomain];
+        if (!expectedToken) {
+            this.logDebug('No verification token found for domain', {
+                scopeType,
+                scopeId,
+                domain: normalizedDomain,
+            });
+            return {
+                domain: normalizedDomain,
+                status: 'failed',
+                verificationToken: '',
+                dnsRecordsFound: [],
+            };
+        }
+        const { verified, recordsFound } = await this._checkDnsTxtRecord(normalizedDomain, expectedToken);
+        const newStatus = verified ? 'verified' : 'failed';
+        ssoConfig.domains.domainVerificationStatus[normalizedDomain] = newStatus;
+        await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);
+        this.logDebug('Domain verification result', {
+            scopeType,
+            scopeId,
+            domain: normalizedDomain,
+            status: newStatus,
+            recordsFound: recordsFound.length,
+        });
+        return {
+            domain: normalizedDomain,
+            status: newStatus,
+            verificationToken: expectedToken,
+            dnsRecordsFound: recordsFound,
+        };
+    }
+    /**
+     * Check if a domain is verified for the given scope.
+     */
+    async isDomainVerified(ec, scopeType, scopeId, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+        if (!ssoConfig)
+            return false;
+        return ssoConfig.domains.domainVerificationStatus[normalizedDomain] === 'verified';
+    }
+    /**
+     * Get the list of verified domains for the given scope.
+     * Only returns domains with verificationStatus === 'verified'.
+     */
+    async getVerifiedDomains(ec, scopeType, scopeId) {
+        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
+        if (!ssoConfig)
+            return [];
+        return ssoConfig.domains.verifiedDomains.filter(d => ssoConfig.domains.domainVerificationStatus[d] === 'verified');
+    }
+    /**
+     * Resolve DNS TXT records for the verification subdomain and check for the expected token.
+     */
+    async _checkDnsTxtRecord(domain, expectedToken) {
+        try {
+            const { Resolver } = await import('node:dns/promises');
+            const resolver = new Resolver();
+            resolver.setServers(['8.8.8.8', '1.1.1.1']);
+            const lookupHost = `${VERIFICATION_SUBDOMAIN}.${domain}`;
+            const records = await resolver.resolveTxt(lookupHost);
+            const flat = records.map(r => r.join(''));
+            const expectedValue = `${VERIFICATION_PREFIX}${expectedToken}`;
+            const verified = flat.some(r => r === expectedValue);
+            return { verified, recordsFound: flat };
+        }
+        catch (error) {
+            this.logDebug('DNS TXT record lookup failed', {
+                domain,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return { verified: false, recordsFound: [] };
+        }
+    }
+};
+DomainVerificationBackendService = __decorate([
+    injectable(),
+    __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
+    __param(1, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
+    __metadata("design:paramtypes", [LoggerService,
+        AuthOrganizationConfigurationService])
+], DomainVerificationBackendService);
+export { DomainVerificationBackendService };
+//# sourceMappingURL=domain-verification.backend.service.js.map

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-verification.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAYjK,qCAAqC;AACrC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAG9C,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAIW;IAC8B;IAJnE,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD;QADpF,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAExI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAMd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAQ,CAAC;YAC9F,aAAa,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,aAAa,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;YAC7E,aAAa,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;YACrF,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;YACxE,SAAS,CAAC,OAAe,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;YAC1F,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB;YACjB,SAAS,EAAE,GAAG,mBAAmB,GAAG,iBAAiB,EAAE;YACvD,OAAO,EAAE,GAAG,sBAAsB,IAAI,gBAAgB,EAAE;SACzD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAI,SAAS,CAAC,OAAe,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC9F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAElG,MAAM,SAAS,GAAkD,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClG,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;IACrF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,UAAU,CAClE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAIpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,aAAa,GAAG,GAAG,mBAAmB,GAAG,aAAa,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAErD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;gBAC5C,MAAM;gBACN,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAA;AAhLY,gCAAgC;IAD5C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCADJ,aAAa;QAC2B,oCAAoC;GAL/H,gCAAgC,CAgL5C"}

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts

@@ -0,0 +1,116 @@
+/**
+ * EnterpriseUserProvisioningBackendService
+ *
+ * Handles enterprise user lifecycle operations: creation, update, deactivation,
+ * and IdP role → org role mapping. Reusable by both SSO JIT provisioning (Step 15)
+ * and SCIM directory provisioning (Step 20).
+ *
+ * Step 15: Enterprise SSO — Org OIDC Connection Resolver & Provisioning
+ * DI Symbol: EnterpriseUserProvisioningService
+ *
+ * Design (Decision 13):
+ * - All methods use INTERNALLY_INITIATED_REQUEST execution context
+ * - All methods emit audit events via AuditLogsBackendService
+ * - createOrgUser() handles: User creation, UserProfile creation, OrganizationMember creation,
+ *   and UserIdentityLink creation — all transactional
+ *
+ * FUTURE (SCIM Step 20): SCIM controller will call these same methods.
+ */
+import 'reflect-metadata';
+import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
+import { ErrorBuilderBackendService } from '../../../../errors/services/error-builder.backend.service.js';
+import type { ServicesRegistryHandlerBackendService } from '../../../../base-classes/services/services/services-registry-handler.backend.service.js';
+import { AuthExecutionContextFactoryBackendService } from '../../../../security/authentications/services/auth-execution-context-factory.backend.service.js';
+import type { AuthTokenIssuerBackendService } from '../../../../security/authentications/services/auth-token-issuer.backend.service.js';
+import type { AuthUserLookupBackendService } from '../../../../security/authentications/services/utils/auth-user-lookup.backend.service.js';
+import type { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service.js';
+import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { User } from '@wildo-ai/saas-models';
+import type { NormalizedUserProfile, ProvisioningConnectionContext } from '../../../../security/authentications/models/sso-connection.backend.schemas.js';
+/** Configuration for enterprise user provisioning operations */
+export interface EnterpriseProvisioningConfig {
+    organizationId: string;
+    autoCreateUsers: boolean;
+    autoVerifyEmail: boolean;
+    defaultRole?: string;
+    roleMapping?: Record<string, string>;
+    groupMapping?: Record<string, string[]>;
+    allowedDomains: string[];
+    /** L9: Allowlist of valid org roles. Mapped roles not in this list are silently dropped. */
+    allowedOrgRoles?: string[];
+}
+/** Result of an enterprise user provisioning operation */
+export interface EnterpriseProvisionResult {
+    user: User;
+    isNew: boolean;
+    orgMemberCreated: boolean;
+    mappedRoles: string[];
+}
+export declare class EnterpriseUserProvisioningBackendService {
+    private readonly logger;
+    private readonly errorBuilder;
+    private readonly servicesRegistryHandler;
+    private readonly authEcFactory;
+    private readonly tokenIssuer;
+    private readonly auditLogsService;
+    private readonly appConfigService;
+    private readonly userLookup;
+    private readonly logDebug;
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, tokenIssuer: AuthTokenIssuerBackendService, auditLogsService: AuditLogsBackendService, appConfigService: AppConfigurationService, userLookup: AuthUserLookupBackendService);
+    /**
+     * Create or link a user within an organization from an IdP profile.
+     *
+     * Flow:
+     * 1. Verify email domain is in allowedDomains (if any)
+     * 2. Check if user already exists by email
+     *    - If exists: verify/add org membership
+     *    - If not exists: check autoCreateUsers, create user + profile + org member
+     * 3. Map IdP roles → org roles
+     * 4. Create identity link
+     */
+    createOrgUser(profile: NormalizedUserProfile, connection: ProvisioningConnectionContext, orgConfig: EnterpriseProvisioningConfig): Promise<EnterpriseProvisionResult>;
+    /**
+     * Update an existing org user's profile attributes.
+     * FUTURE: Called by SCIM PATCH/PUT handlers (Step 20).
+     */
+    updateOrgUser(userId: string, attrs: Partial<{
+        firstName: string;
+        lastName: string;
+        displayName: string;
+        avatarUrl: string;
+    }>, _orgConfig: EnterpriseProvisioningConfig): Promise<void>;
+    /**
+     * Deactivate an org user (set status to INACTIVE).
+     * FUTURE: Called by SCIM DELETE or status-change handlers (Step 20).
+     */
+    deactivateOrgUser(userId: string, orgConfig: EnterpriseProvisioningConfig): Promise<void>;
+    /**
+     * Map IdP role claims to organization roles using the org's roleMapping configuration.
+     *
+     * L9 fix: Added optional `allowedOrgRoles` parameter. When provided, mapped roles
+     * that are not in the allowed list are silently dropped and logged. This prevents
+     * a misconfigured role mapping from assigning arbitrary role identifiers (e.g., SUPER_ADMIN).
+     *
+     * @param idpRoles - Roles from the IdP claims (OIDC roles claim or SAML attribute)
+     * @param roleMapping - Org's IdP role → org role mapping (e.g., { "admin": "ORG_ADMIN", "viewer": "VIEWER" })
+     * @param allowedOrgRoles - Optional allowlist of valid org roles. If provided, mapped roles not in this list are rejected.
+     * @returns Mapped org role identifiers
+     */
+    mapRoles(idpRoles: string[], roleMapping: Record<string, string>, allowedOrgRoles?: string[]): string[];
+    /**
+     * Ensure the user is a member of the organization.
+     * If they're already a member, no-op. If not, create the membership.
+     *
+     * @returns true if a new membership was created
+     */
+    private ensureOrgMembership;
+    private createIdentityLink;
+    /**
+     * System-level EC for enterprise user provisioning (SCIM/JIT).
+     * Uses INTERNALLY_INITIATED_REQUEST with APP_ADMIN_SUPER_ADMIN —
+     * these operations act on behalf of the system, not a specific user.
+     * Primary intent: user creation/provisioning from enterprise IdP.
+     */
+    private getInternalExecutionContext;
+}
+//# sourceMappingURL=enterprise-user-provisioning.backend.service.d.ts.map

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enterprise-user-provisioning.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAChJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAIpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAQL,IAAI,EAGL,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,qBAAqB,EAAE,6BAA6B,EAAE,MAAM,mFAAmF,CAAC;AAE9J,gEAAgE;AAChE,MAAM,WAAW,4BAA4B;IAC3C,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,OAAO,CAAC;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,4FAA4F;IAC5F,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAV/E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EACpE,WAAW,EAAE,6BAA6B,EACzC,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACpC,UAAU,EAAE,4BAA4B;IAU7G;;;;;;;;;;OAUG;IACU,aAAa,CACxB,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,6BAA6B,EACzC,SAAS,EAAE,4BAA4B,GACtC,OAAO,CAAC,yBAAyB,CAAC;IAyIrC;;;OAGG;IACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EAC/F,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,IAAI,CAAC;IAkBhB;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,4BAA4B,GACtC,OAAO,CAAC,IAAI,CAAC;IAgDhB;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAqB9G;;;;;OAKG;YACW,mBAAmB;YAwEnB,kBAAkB;IA+DhC;;;;;OAKG;YACW,2BAA2B;CAG1C"}