@wildo-ai/saas-backend-lib 1.1.1 → 1.1.3

package/dist/esm/security/oauth-clients/oauth-clients.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAE5F,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA+F,CAAC;AAExI,mFAAmF;AACnF,IAAK,sBAGJ;AAHD,WAAK,sBAAsB;IACzB,2CAAiB,CAAA;IACjB,mDAAyB,CAAA;AAC3B,CAAC,EAHI,sBAAsB,KAAtB,sBAAsB,QAG1B;AAyBD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAqC;IAC7D;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;QACxD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CACvC,sBAAqF,EACrF,WAAyF;IAEzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,6EAA6E;gBAC7E,+DAA+D;gBAC/D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,4BAA4B,CAAC,KAAkB,EAAE,qBAA4C;IAC3G,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,gFAAgF;YAChF,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,+FAA+F;YAC/F,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC1D,iFAAiF;YACjF,mFAAmF;YACnF,kEAAkE;YAClE,OAAO,EAAE,GAAI,KAAiC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAC/E,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YAC5F,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACjE,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,aAAa,CAAC;YACvC,OAAO,EAAE,GAAI,aAAyC,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,KAAkB,EAAE,IAA4B;IACvF,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,2EAA2E;YAC3E,iBAAiB;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAkD,CAAC;YAEzE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qDAAqD,OAAO,CAAC,MAAM,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChI,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,8BAA8B,GAAG,IAAI,KAAK,sBAAsB,CAAC,MAAM;gBAC3E,CAAC,CAAC,CAAE,KAA8C,CAAC,yBAAyB,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAE5F,OAAO;gBACL,GAAI,KAAiC;gBACrC,YAAY;gBACZ,YAAY;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,8BAA8B;aAC/B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,eAAe,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/G,IAAI,IAAI,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;gBAC3C,gFAAgF;gBAChF,+EAA+E;gBAC/E,OAAO,EAAE,GAAG,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,yBAAyB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACtH,CAAC;YACD,4DAA4D;YAC5D,OAAO,eAAe,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oCAAoC;IAClD,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAC7F,CAAC;AACJ,CAAC","sourcesContent":["/**\n * OAuth Clients Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application OAuth-client\n * resources (`organizationOAuthClients`, `applicationOAuthClients`) that the schema\n * alone cannot express. FAITHFUL MIRROR of the api-keys mint pipeline\n * (`api-keys.custom-impl.backend.service.ts`), FOCUSED to the trunk operation set:\n *\n *   CREATE      → mint fresh secret material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldSecretInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *\n * (api-keys' DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS impls are deferred to the\n * OIDC branch alongside their resource-config ops.)\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `secretPrefix` + `hashedSecret`, but\n * both are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply\n * them) and `plainSecret` is an ephemeral response-only field. Nothing generated them,\n * so a bare create/update persisted a row missing the required fields. These impls are\n * the single server-side choke point that mints secret material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `secretPrefix` +\n *                           `hashedSecret` (and, for rotate/regenerate, the previous-\n *                           secret grace-window fields) into the payload. Those fields\n *                           are `.excludeFrom{Create,Update}()`, so returning them from\n *                           the prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainSecret` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainSecret` (+ rotate's `oldClientId` /\n *                           `oldSecretInvalidationDate`) to the response so the\n *                           operation's ephemeral `plainSecret` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org clients only) needs its own registration or it runs the bare core op and fails.\n * `OAUTH_CLIENT_TARGETS` enumerates every (resource × variant) each op exposes. Minting\n * is org-agnostic — the target `organizationId` rides in the payload / pre-fetched\n * record, never from these handlers — so the admin variant reuses the identical handlers\n * and (per the user security decision) also receives the tenant's one-time `plainSecret`.\n */\n\nimport {\n  ApiKeyScope,\n  AppOAuthClients_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OAuthClientStatus,\n  OrgOAuthClients_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateOAuthClientSecretMaterial } from './oauth-client-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext secret between the CREATE prefix (which mints it)\n * and the postfix (which returns it), keyed by the per-operation `ExecutionContext`\n * INSTANCE. The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedSecret`\n * / `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainSecret` is\n * never persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_SECRET_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_SECRET_BY_EC}). Carries the one-time `plainSecret` AND\n * the applied `previousSecretInvalidationDate`, so the postfix builds ROTATE's\n * `oldSecretInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainSecret: string; previousSecretInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum OAuthClientReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched client fields the reissue prefix reads. `hashedSecret`/`secretPrefix`\n * are present on every persisted client of either scope.\n */\ntype ReissuableOAuthClient = Pick<OAuthClientBase, 'status'> & { hashedSecret: string; secretPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgOAuthClients_Operations` and\n * `AppOAuthClients_Operations` satisfy it (identical string values).\n */\ntype OAuthClientCustomOps = { ROTATE: string; REGENERATE: string };\n\ntype OAuthClientTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: OAuthClientCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type OAuthClientImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The OAuth-client resources, their scope (drives the `oc_org_` / `oc_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG clients expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP clients are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst OAUTH_CLIENT_TARGETS: ReadonlyArray<OAuthClientTarget> = [\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every OAuth-client op is API_CALL and needs a distinct registration per variant\n * identity (see the module header) — this centralizes that fan-out.\n */\nfunction oauthClientFactoriesForOperation(\n  operationIdentifierFor: (target: OAuthClientTarget) => string | CoreResourceOperation,\n  handlersFor: (target: OAuthClientTarget, container: Container) => OAuthClientImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and OAuth-client ops\n            // are dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — enforce the role-ceiling, then mint material; surface `plainSecret` once. Exported for focused create-pipeline unit tests. */\nexport function buildOAuthClientMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint a client carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a client carrying the roles\n      // its own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_SECRET_BY_EC.set(executionContext, plainSecret);\n      // secretPrefix + hashedSecret are `.excludeFromCreate()`; returning them injects\n      // them into the create payload (preserveServerInjectedFields re-attaches them past\n      // the strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), secretPrefix, hashedSecret };\n    },\n    postfixCoreOperations: async (_id, createdClient, executionContext, _operationPath, _utils) => {\n      if (!createdClient || typeof createdClient !== 'object') return createdClient;\n      const plainSecret = PLAINTEXT_SECRET_BY_EC.get(executionContext);\n      PLAINTEXT_SECRET_BY_EC.delete(executionContext);\n      if (!plainSecret) return createdClient;\n      return { ...(createdClient as Record<string, unknown>), plainSecret };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The client-credentials exchange keeps honoring the prior\n * secret until `previousSecretInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildOAuthClientReissueHandlers(scope: ApiKeyScope, kind: OAuthClientReissueKind): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedSecret`/`secretPrefix` we move into the\n      // previous slot.\n      const current = utils.currentObject as ReissuableOAuthClient | undefined;\n\n      // Only an ACTIVE client can be reissued (409 for a revoked/expired client —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `OAuth client secret cannot be reissued in status '${current.status}'`, oauthClientStatus: current.status },\n        });\n      }\n\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      const previousSecretInvalidationDate = kind === OAuthClientReissueKind.ROTATE\n        ? ((input as { oldSecretInvalidationDate?: Date }).oldSecretInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainSecret, previousSecretInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedSecret,\n        secretPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedSecret: current?.hashedSecret,\n        previousSecretPrefix: current?.secretPrefix,\n        previousSecretInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainSecret = bridged?.plainSecret ? { ...record, plainSecret: bridged.plainSecret } : { ...record };\n      if (kind === OAuthClientReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldClientId` is its own `_id`.\n        return { ...withPlainSecret, oldClientId: _id, oldSecretInvalidationDate: bridged?.previousSecretInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainSecret only.\n      return withPlainSecret;\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\nexport function createOAuthClientCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildOAuthClientMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createOAuthClientRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createOAuthClientRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.REGENERATE),\n  );\n}\n"]}
+{"version":3,"file":"oauth-clients.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/oauth-clients/oauth-clients.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACL,WAAW,EACX,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,EAChB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,OAAO,EAAE,iCAAiC,EAAE,MAAM,yCAAyC,CAAC;AAE5F,OAAO,EAAE,uCAAuC,EAAE,2BAA2B,EAAE,MAAM,uEAAuE,CAAC;AAG7J;;;;;;;;;;;;;GAaG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE5E;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA+F,CAAC;AAExI,mFAAmF;AACnF,IAAK,sBAGJ;AAHD,WAAK,sBAAsB;IACzB,2CAAiB,CAAA;IACjB,mDAAyB,CAAA;AAC3B,CAAC,EAHI,sBAAsB,KAAtB,sBAAsB,QAG1B;AAyBD;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAqC;IAC7D;QACE,YAAY,EAAE,gBAAgB,CAAC,0BAA0B;QACzD,KAAK,EAAE,WAAW,CAAC,YAAY;QAC/B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;YAC5B,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE;SACnD;KACF;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,yBAAyB;QACxD,KAAK,EAAE,WAAW,CAAC,WAAW;QAC9B,GAAG,EAAE,0BAA0B;QAC/B,QAAQ,EAAE;YACR,EAAE,kBAAkB,EAAE,IAAI,EAAE;SAC7B;KACF;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CACvC,sBAAqF,EACrF,WAAyF;IAEzF,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,kBAAkB,EAAE,UAAU,EAAE,EAAE,EAAE;QACzD,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,6EAA6E;gBAC7E,6EAA6E;gBAC7E,+DAA+D;gBAC/D,mBAAmB,EAAE,sBAAsB,CAAC,MAAM,CAAC;gBACnD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;gBAClD,kBAAkB;gBAClB,UAAU;aACX;YACD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC;SACzC,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,0IAA0I;AAC1I,MAAM,UAAU,4BAA4B,CAAC,KAAkB,EAAE,qBAA4C;IAC3G,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8FAA8F;YAC9F,gGAAgG;YAChG,gGAAgG;YAChG,gFAAgF;YAChF,mGAAmG;YACnG,uCAAuC,CAAC,gBAAgB,EAAG,KAA8B,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;YAC5I,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,+FAA+F;YAC/F,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;YAC1D,iFAAiF;YACjF,mFAAmF;YACnF,kEAAkE;YAClE,OAAO,EAAE,GAAI,KAAiC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;QAC/E,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YAC5F,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC9E,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YACjE,sBAAsB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,aAAa,CAAC;YACvC,OAAO,EAAE,GAAI,aAAyC,EAAE,WAAW,EAAE,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,KAAkB,EAAE,IAA4B;IACvF,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YAClF,8EAA8E;YAC9E,2EAA2E;YAC3E,iBAAiB;YACjB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAkD,CAAC;YAEzE,4EAA4E;YAC5E,sEAAsE;YACtE,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE,EAAE,OAAO,EAAE,qDAAqD,OAAO,CAAC,MAAM,GAAG,EAAE,iBAAiB,EAAE,OAAO,CAAC,MAAM,EAAE;iBAChI,CAAC,CAAC;YACL,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,GAAG,iCAAiC,CAAC,KAAK,CAAC,CAAC;YAC7F,MAAM,8BAA8B,GAAG,IAAI,KAAK,sBAAsB,CAAC,MAAM;gBAC3E,CAAC,CAAC,CAAE,KAA8C,CAAC,yBAAyB,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC3F,CAAC,CAAC,IAAI,CAAC;YACT,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAE5F,OAAO;gBACL,GAAI,KAAiC;gBACrC,YAAY;gBACZ,YAAY;gBACZ,uEAAuE;gBACvE,yEAAyE;gBACzE,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,oBAAoB,EAAE,OAAO,EAAE,YAAY;gBAC3C,8BAA8B;aAC/B,CAAC;QACJ,CAAC;QACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE;YACtF,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC;YAC5D,MAAM,MAAM,GAAG,OAAkC,CAAC;YAClD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAE9C,MAAM,eAAe,GAAG,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;YAC/G,IAAI,IAAI,KAAK,sBAAsB,CAAC,MAAM,EAAE,CAAC;gBAC3C,gFAAgF;gBAChF,+EAA+E;gBAC/E,OAAO,EAAE,GAAG,eAAe,EAAE,WAAW,EAAE,GAAG,EAAE,yBAAyB,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACtH,CAAC;YACD,4DAA4D;YAC5D,OAAO,eAAe,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D;;;;;;;;;;GAUG;AACH,SAAS,8BAA8B;IACrC,OAAO;QACL,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;YACnF,MAAM,OAAO,GAAG,KAAK,CAAC,aAA2D,CAAC;YAElF,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBAC3D,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;oBACxE,sBAAsB,EAAE,2BAA2B,CAAC,QAAQ;oBAC5D,OAAO,EAAE;wBACP,OAAO,EAAE,gCAAgC,iBAAiB,CAAC,OAAO,kBAAkB,OAAO,CAAC,MAAM,GAAG;wBACrG,iBAAiB,EAAE,OAAO,CAAC,MAAM;qBAClC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gCAAgC;IAC9C,OAAO,oBAAoB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QACzC,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,UAAqB,EAAE,EAAE,CACpG,yCAAyC,CAAC;YACxC,aAAa,EAAE;gBACb,kBAAkB,EAAE,MAAM,CAAC,YAAY;gBACvC,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;gBACtC,WAAW,EAAE,4BAA4B,CAAC,aAAa;gBACvD,kBAAkB,EAAE,IAAI;aACzB;YACD,QAAQ,EAAE,8BAA8B,EAAE;SAC3C,CAAC,CAAC;QACL,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,GAAG,EAAE,CAAC,qBAAqB,CAAC,MAAM,EAClC,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,CAAC,CAC1G,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,gCAAgC;IAC9C,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAC7B,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,CACzF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,oCAAoC;IAClD,OAAO,gCAAgC,CACrC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,EACjC,CAAC,MAAM,EAAE,EAAE,CAAC,+BAA+B,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAC7F,CAAC;AACJ,CAAC","sourcesContent":["/**\n * OAuth Clients Custom Implementations\n *\n * Implements the server-side behaviour for the organization + application OAuth-client\n * resources (`organizationOAuthClients`, `applicationOAuthClients`) that the schema\n * alone cannot express. FAITHFUL MIRROR of the api-keys mint pipeline\n * (`api-keys.custom-impl.backend.service.ts`), FOCUSED to the trunk operation set:\n *\n *   CREATE      → mint fresh secret material (the client must never supply it).\n *   ROTATE      → reissue the secret; retain the prior secret in a grace window that\n *                 stops authenticating at the caller-chosen `oldSecretInvalidationDate`.\n *   REGENERATE  → reissue the secret; keep the prior secret valid open-endedly (until\n *                 the next rotation) for a zero-downtime overlap.\n *\n * (api-keys' DEACTIVATE/REACTIVATE/EXTEND_EXPIRY/USAGE_STATS impls are deferred to the\n * OIDC branch alongside their resource-config ops.)\n *\n * WHY MINTING NEEDS AN IMPL: the schema requires `secretPrefix` + `hashedSecret`, but\n * both are `.excludeFromCreate().excludeFromUpdate()` (the client must never supply\n * them) and `plainSecret` is an ephemeral response-only field. Nothing generated them,\n * so a bare create/update persisted a row missing the required fields. These impls are\n * the single server-side choke point that mints secret material.\n *\n * PATTERN (CREATE / ROTATE / REGENERATE — all \"mint a secret\" ops):\n *   prefixCoreOperations  → mint material; inject the persisted `secretPrefix` +\n *                           `hashedSecret` (and, for rotate/regenerate, the previous-\n *                           secret grace-window fields) into the payload. Those fields\n *                           are `.excludeFrom{Create,Update}()`, so returning them from\n *                           the prefix is what carries them into the core write — the\n *                           orchestration diffs the prefix-added keys and forwards them\n *                           to the repository's `preserveServerInjectedFields` allowlist\n *                           so the final strict parse re-attaches (rather than strips)\n *                           them. Stash the one-time `plainSecret` for the postfix.\n *   postfixCoreOperations → attach the one-time `plainSecret` (+ rotate's `oldClientId` /\n *                           `oldSecretInvalidationDate`) to the response so the\n *                           operation's ephemeral `plainSecret` field surfaces it.\n * The core write still runs, so notifications / websocket events fire normally — which\n * is why this is prefix+postfix rather than `replaceCoreOperations`.\n *\n * VARIANT COVERAGE: a custom impl is matched to a running op by its FULL operation-path\n * identity — `isOperationDefault` (the `isDefault` sentinel) vs `variantKey` produce\n * DISTINCT keys (`createOperationPathKey`). So a single default registration only\n * intercepts the default variant; the cross-tenant app-super-admin `admin` variant\n * (org clients only) needs its own registration or it runs the bare core op and fails.\n * `OAUTH_CLIENT_TARGETS` enumerates every (resource × variant) each op exposes. Minting\n * is org-agnostic — the target `organizationId` rides in the payload / pre-fetched\n * record, never from these handlers — so the admin variant reuses the identical handlers\n * and (per the user security decision) also receives the tenant's one-time `plainSecret`.\n */\n\nimport {\n  ApiKeyScope,\n  AppOAuthClients_Operations,\n  CoreResourceOperation,\n  CoreResourceType,\n  ErrorCustomMessageReference,\n  ErrorType,\n  OAuthClientStatus,\n  OrgOAuthClients_Operations,\n  ResourceOperationVariantType,\n} from '@wildo-ai/saas-models';\nimport type { OAuthClientBase } from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { generateOAuthClientSecretMaterial } from './oauth-client-generation.backend.utils';\nimport type { Container } from 'inversify';\nimport { assertRequestedRolesWithinCallerCeiling, createRoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\nimport type { RoleHierarchyResolver } from '~wildo-backend-lib/security/authorizations/role-ceiling.backend.utils';\n\n/**\n * Bridge for the one-time plaintext secret between the CREATE prefix (which mints it)\n * and the postfix (which returns it), keyed by the per-operation `ExecutionContext`\n * INSTANCE. The orchestration threads the SAME `executionContext` through both handlers\n * (`services-registry-handler.backend.service.ts` prefix + postfix calls), so it is a\n * stable, per-invocation correlation key.\n *\n * A `WeakMap` keyed by the EC is deliberately chosen over a `Map` keyed by `hashedSecret`\n * / `_id`: (1) NO LEAK — the entry is reclaimed by GC when the request's EC becomes\n * unreachable, so a core-write failure between prefix and postfix cannot strand the\n * plaintext in memory; (2) NO RACE — concurrent operations run on DISTINCT EC instances,\n * so two simultaneous mints/reissues never collide on a shared key. `plainSecret` is\n * never persisted; the postfix also deletes the entry for promptness.\n */\nconst PLAINTEXT_SECRET_BY_EC = new WeakMap<ExecutionContext<any>, string>();\n\n/**\n * Bridge for ROTATE / REGENERATE, keyed by the same per-operation `ExecutionContext`\n * instance (see {@link PLAINTEXT_SECRET_BY_EC}). Carries the one-time `plainSecret` AND\n * the applied `previousSecretInvalidationDate`, so the postfix builds ROTATE's\n * `oldSecretInvalidationDate` from the value the prefix actually applied — independent of\n * whether the update result round-trips that field.\n */\nconst REISSUE_BRIDGE_BY_EC = new WeakMap<ExecutionContext<any>, { plainSecret: string; previousSecretInvalidationDate: Date | null }>();\n\n/** ROTATE keeps a bounded grace window; REGENERATE keeps an open-ended overlap. */\nenum OAuthClientReissueKind {\n  ROTATE = 'rotate',\n  REGENERATE = 'regenerate',\n}\n\n/**\n * The pre-fetched client fields the reissue prefix reads. `hashedSecret`/`secretPrefix`\n * are present on every persisted client of either scope.\n */\ntype ReissuableOAuthClient = Pick<OAuthClientBase, 'status'> & { hashedSecret: string; secretPrefix: string };\n\n/**\n * Structural view of a per-resource custom-operation enum — the members that have a\n * backend impl in this file. Both `OrgOAuthClients_Operations` and\n * `AppOAuthClients_Operations` satisfy it (identical string values).\n */\ntype OAuthClientCustomOps = { ROTATE: string; REGENERATE: string; EXPIRE: string };\n\ntype OAuthClientTarget = {\n  resourceType: CoreResourceType;\n  scope: ApiKeyScope;\n  ops: OAuthClientCustomOps;\n  variants: ReadonlyArray<{ isOperationDefault: boolean; variantKey?: string }>;\n};\n\n/** The handler-object shape accepted by `createResourceCustomServiceImplementation`. */\nexport type OAuthClientImplHandlers = Parameters<typeof createResourceCustomServiceImplementation>[0]['handlers'];\n\n/**\n * The OAuth-client resources, their scope (drives the `oc_org_` / `oc_app_` prefix), the\n * per-resource custom-op enum, and every op VARIANT each resource exposes.\n *\n * - ORG clients expose an org-admin DEFAULT + a cross-tenant app-super-admin `admin`\n *   variant → both registered.\n * - APP clients are single-variant (APP_ADMIN-scoped) → default only.\n */\nconst OAUTH_CLIENT_TARGETS: ReadonlyArray<OAuthClientTarget> = [\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_ORGANIZATION,\n    scope: ApiKeyScope.ORGANIZATION,\n    ops: OrgOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n      { isOperationDefault: false, variantKey: 'admin' },\n    ],\n  },\n  {\n    resourceType: CoreResourceType.OAUTH_CLIENTS_APPLICATION,\n    scope: ApiKeyScope.APPLICATION,\n    ops: AppOAuthClients_Operations,\n    variants: [\n      { isOperationDefault: true },\n    ],\n  },\n];\n\n/**\n * Register one custom-impl factory per (target × variant) for a single operation.\n * Every OAuth-client op is API_CALL and needs a distinct registration per variant\n * identity (see the module header) — this centralizes that fan-out.\n */\nfunction oauthClientFactoriesForOperation(\n  operationIdentifierFor: (target: OAuthClientTarget) => string | CoreResourceOperation,\n  handlersFor: (target: OAuthClientTarget, container: Container) => OAuthClientImplHandlers,\n): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.flatMap((target) =>\n    target.variants.map(({ isOperationDefault, variantKey }) => {\n      const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n        createResourceCustomServiceImplementation({\n          operationPath: {\n            resourceIdentifier: target.resourceType,\n            // API_CALL: the lookup key is built from the RUNNING operation's variantType\n            // (`extractOperationPath` passes it through unchanged), and OAuth-client ops\n            // are dispatched as direct HTTP API_CALLs. Must match exactly.\n            operationIdentifier: operationIdentifierFor(target),\n            variantType: ResourceOperationVariantType.API_CALL,\n            isOperationDefault,\n            variantKey,\n          },\n          handlers: handlersFor(target, container),\n        });\n      return factory as unknown as ResourceCustomServiceImplementationFactory;\n    }),\n  );\n}\n\n/** CREATE — enforce the role-ceiling, then mint material; surface `plainSecret` once. Exported for focused create-pipeline unit tests. */\nexport function buildOAuthClientMintHandlers(scope: ApiKeyScope, roleHierarchyResolver: RoleHierarchyResolver): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // Role-ceiling gate — a principal cannot mint a client carrying roles it does not itself hold\n      // (self-service privilege-escalation prevention; APPLICATION-scoped super-admin + system writes\n      // bypass). The ceiling is hierarchy-aware, so an ORG_ADMIN may mint a client carrying the roles\n      // its own role confers (ORG_MANAGER/ORG_MEMBER/…) but never ORG_OWNER above it.\n      // assurance-control: WILDO.ACCESS.LEAST_PRIVILEGE — least-privilege on machine-credential minting.\n      assertRequestedRolesWithinCallerCeiling(executionContext, (input as { roles?: string[] }).roles, utils.errorBuilder, roleHierarchyResolver);\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      // Bridge the one-time secret to the postfix, keyed by the per-op EC instance; never persisted.\n      PLAINTEXT_SECRET_BY_EC.set(executionContext, plainSecret);\n      // secretPrefix + hashedSecret are `.excludeFromCreate()`; returning them injects\n      // them into the create payload (preserveServerInjectedFields re-attaches them past\n      // the strict parse) so the row persists with the required fields.\n      return { ...(input as Record<string, unknown>), secretPrefix, hashedSecret };\n    },\n    postfixCoreOperations: async (_id, createdClient, executionContext, _operationPath, _utils) => {\n      if (!createdClient || typeof createdClient !== 'object') return createdClient;\n      const plainSecret = PLAINTEXT_SECRET_BY_EC.get(executionContext);\n      PLAINTEXT_SECRET_BY_EC.delete(executionContext);\n      if (!plainSecret) return createdClient;\n      return { ...(createdClient as Record<string, unknown>), plainSecret };\n    },\n  };\n}\n\n/**\n * ROTATE / REGENERATE — reissue the secret on the SAME record, moving the prior secret\n * into the grace-window slot. The client-credentials exchange keeps honoring the prior\n * secret until `previousSecretInvalidationDate` (ROTATE: the caller-chosen instant,\n * defaulting to now = immediate cutover; REGENERATE: `null` = open-ended overlap).\n */\nfunction buildOAuthClientReissueHandlers(scope: ApiKeyScope, kind: OAuthClientReissueKind): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n      // `currentObject` is the pre-fetched DB record for this UPDATE-borrow op — it\n      // includes the backend-only `hashedSecret`/`secretPrefix` we move into the\n      // previous slot.\n      const current = utils.currentObject as ReissuableOAuthClient | undefined;\n\n      // Only an ACTIVE client can be reissued (409 for a revoked/expired client —\n      // otherwise rotation would silently re-arm a deactivated credential).\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: { message: `OAuth client secret cannot be reissued in status '${current.status}'`, oauthClientStatus: current.status },\n        });\n      }\n\n      const { plainSecret, secretPrefix, hashedSecret } = generateOAuthClientSecretMaterial(scope);\n      const previousSecretInvalidationDate = kind === OAuthClientReissueKind.ROTATE\n        ? ((input as { oldSecretInvalidationDate?: Date }).oldSecretInvalidationDate ?? new Date())\n        : null;\n      REISSUE_BRIDGE_BY_EC.set(executionContext, { plainSecret, previousSecretInvalidationDate });\n\n      return {\n        ...(input as Record<string, unknown>),\n        hashedSecret,\n        secretPrefix,\n        // Move the outgoing secret into the grace-window slot (server-managed,\n        // excludeFrom{Create,Update} → carried by preserveServerInjectedFields).\n        previousHashedSecret: current?.hashedSecret,\n        previousSecretPrefix: current?.secretPrefix,\n        previousSecretInvalidationDate,\n      };\n    },\n    postfixCoreOperations: async (_id, updated, executionContext, _operationPath, _utils) => {\n      if (!updated || typeof updated !== 'object') return updated;\n      const record = updated as Record<string, unknown>;\n      const bridged = REISSUE_BRIDGE_BY_EC.get(executionContext);\n      REISSUE_BRIDGE_BY_EC.delete(executionContext);\n\n      const withPlainSecret = bridged?.plainSecret ? { ...record, plainSecret: bridged.plainSecret } : { ...record };\n      if (kind === OAuthClientReissueKind.ROTATE) {\n        // ROTATE's response DTO additionally carries the rotated record's id + when the\n        // prior secret is invalidated. Same record, so `oldClientId` is its own `_id`.\n        return { ...withPlainSecret, oldClientId: _id, oldSecretInvalidationDate: bridged?.previousSecretInvalidationDate };\n      }\n      // REGENERATE's response DTO is resource + plainSecret only.\n      return withPlainSecret;\n    },\n  };\n}\n\n/** CREATE impls — org default + org `admin` + app default. */\n/**\n * ACTIVE → EXPIRED, forced — the transition the credential-expiry sweep dispatches (#413).\n *\n * The FIRST status-transition handler on this resource: OAuth clients ship ROTATE and REGENERATE\n * and no deactivate/reactivate pair, so unlike api-keys there was no generic transition helper to\n * reuse. The 409 is the whole reason the sweep goes through a verb — an INACTIVE client was retired\n * by an administrator, and relabelling it EXPIRED would erase who ended it.\n *\n * assurance-control: WILDO.IDENTITY.CREDENTIAL_LIFECYCLE — credential state transitions are\n * explicit and validated, never inferred from a caller-supplied field.\n */\nfunction buildOAuthClientExpireHandlers(): OAuthClientImplHandlers {\n  return {\n    prefixCoreOperations: async (_id, _input, executionContext, _operationPath, utils) => {\n      const current = utils.currentObject as { status?: OAuthClientStatus } | undefined;\n\n      if (current && current.status !== OAuthClientStatus.ACTIVE) {\n        throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n          customMessageReference: ErrorCustomMessageReference.CONFLICT,\n          context: {\n            message: `OAuth client cannot move to '${OAuthClientStatus.EXPIRED}' from status '${current.status}'`,\n            oauthClientStatus: current.status,\n          },\n        });\n      }\n\n      return { status: OAuthClientStatus.EXPIRED };\n    },\n  };\n}\n\n/**\n * EXPIRE impls — registered separately from the other ops rather than through\n * `oauthClientFactoriesForOperation`, because that helper hardcodes `variantType: API_CALL` and\n * fans out over each resource's HTTP variants. EXPIRE is INTERNAL_CALL with a single default\n * variant, so it needs its own registration or the lookup key would never match and the guard above\n * would be silently unreachable.\n */\nexport function createOAuthClientExpireFactories(): ResourceCustomServiceImplementationFactory[] {\n  return OAUTH_CLIENT_TARGETS.map((target) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, _container: Container) =>\n      createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: target.resourceType,\n          operationIdentifier: target.ops.EXPIRE,\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: buildOAuthClientExpireHandlers(),\n      });\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n\nexport function createOAuthClientCreateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    () => CoreResourceOperation.CREATE,\n    (target, container) => buildOAuthClientMintHandlers(target.scope, createRoleHierarchyResolver(container)),\n  );\n}\n\n/** ROTATE impls — bounded grace window. */\nexport function createOAuthClientRotateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.ROTATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.ROTATE),\n  );\n}\n\n/** REGENERATE impls — open-ended overlap. */\nexport function createOAuthClientRegenerateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return oauthClientFactoriesForOperation(\n    (target) => target.ops.REGENERATE,\n    (target) => buildOAuthClientReissueHandlers(target.scope, OAuthClientReissueKind.REGENERATE),\n  );\n}\n"]}

package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAsC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAI5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAwCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}
+{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAuC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAgB5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAuCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}

package/dist/esm/security/scim/controllers/scim.backend.controller.js

@@ -42,9 +42,9 @@ import { EnterpriseUserProvisioningBackendService } from '../../../security/auth
 import { buildEnterpriseConnectionScope } from '../../../security/authentications/models/sso-connection.backend.schemas.js';
 import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
 import { AbstractControllerBackendService } from '../../../base-classes/services/controllers/abstract-controller.backend.service.js';
-import { CoreResourceType, UserStatus, ErrorType, isWildoBackendError, AuthScopeType, ExternalIdentitySource, SsoConnectionType, WildoHeaderKeys, } from '@wildo-ai/saas-models';
+import { resolveVerifiedDomains, CoreResourceType, UserStatus, ErrorType, isWildoBackendError, AuthScopeType, ExternalIdentitySource, SsoConnectionType, WildoHeaderKeys, } from '@wildo-ai/saas-models';
 import { resolveScimAttributePath } from '../../../security/scim/utils/scim-attribute-path-resolver.backend.utils.js';
-import { SCIM_USER_ATTRIBUTE_MAP, SCIM_SCHEMAS, SCIM_CONTENT_TYPE, SCIM_SERVICE_PROVIDER_CONFIG, SCIM_USER_SCHEMA_DEFINITION, SCIM_RESOURCE_TYPES, extractScimDirectoryUnitValue, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+import { SCIM_USER_ATTRIBUTE_MAP, SCIM_SCHEMAS, SCIM_CONTENT_TYPE, buildScimServiceProviderConfig, SCIM_USER_SCHEMA_DEFINITION, SCIM_RESOURCE_TYPES, extractScimDirectoryUnitValue, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
 import { isScimOrganizationUnitManagementEnabled, resolveScimOrganizationUnitId, resolveScimOrganizationUnitReconciliation, } from '@wildo-ai/saas-models';
 import { parseSCIMFilter } from '../../../security/scim/utils/scim-filter-parser.js';
 import { formatUserAsSCIM, formatListAsSCIM, formatSCIMError } from '../../../security/scim/utils/scim-response-formatter.js';
@@ -202,7 +202,18 @@ let SCIMControllerBackendService = class SCIMControllerBackendService extends Ab
     // Discovery Endpoints
     // ═══════════════════════════════════════════════════════════════
     async _handleServiceProviderConfig(_req, res) {
-        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(SCIM_SERVICE_PROVIDER_CONFIG);
+        /*
+         * The two documentation URLs come from the application (`auth.scimDocumentation`) and are
+         * OMITTED when it declares none — see `buildScimServiceProviderConfig`. Read through
+         * `isInitialized()` because this is a public discovery endpoint: it must answer with the
+         * implementation's own facts even on a runtime whose configuration has not landed, rather than
+         * throw and leave a directory administrator with a 500 where the RFC promises a document.
+         */
+        const scimDocumentation = this.appConfigService.isInitialized()
+            ? this.appConfigService.config.auth?.scimDocumentation
+            : undefined;
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE)
+            .json(buildScimServiceProviderConfig(scimDocumentation));
     }
     async _handleSchemas(_req, res) {
         res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({
@@ -835,8 +846,9 @@ let SCIMControllerBackendService = class SCIMControllerBackendService extends Ab
         try {
             const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, AuthScopeType.ORGANIZATION, organizationId);
             if (ssoConfig) {
-                // Only include domains that have passed DNS verification (H4)
-                allowedDomains = ssoConfig.domains.verifiedDomains.filter(d => ssoConfig.domains.domainVerificationStatus[d] === 'verified');
+                // Only include domains that have passed DNS verification (H4). Through the one derivation
+                // (#457) rather than a fifth hand-written join — the stored list holds CLAIMED domains.
+                allowedDomains = resolveVerifiedDomains(ssoConfig.domains);
             }
         }
         catch {