@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-to-org-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EACL,aAAa,EAEb,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,WAAW,CAAC;CACnC;AAED,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC,EAC5D,uBAAuB,EAAE,qCAAqC,EACzE,mBAAmB,EAAE,0BAA0B;IAMlH;;;;;;OAMG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2B9G;;;OAGG;YACW,uBAAuB;IAqDrC;;OAEG;YACW,mBAAmB;IAiEjC;;;OAGG;IACI,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,GAAG;QACxD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,IAAI;IAYR;;;;;;;;;;;;;;;;;OAiBG;IACU,mBAAmB,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAuCzC"}
+{"version":3,"file":"domain-to-org-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAGL,aAAa,EAEb,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,WAAW,CAAC;CACnC;AAED,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC,EAC5D,uBAAuB,EAAE,qCAAqC,EACzE,mBAAmB,EAAE,0BAA0B;IAMlH;;;;;;OAMG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2B9G;;;OAGG;YACW,uBAAuB;IAyDrC;;OAEG;YACW,mBAAmB;IAgEjC;;;OAGG;IACI,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,GAAG;QACxD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,IAAI;IAYR;;;;;;;;;;;;;;;;;OAiBG;IACU,mBAAmB,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAuCzC"}

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js

@@ -29,7 +29,7 @@ import { injectable, inject } from 'inversify';
 import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
 import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
 import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
-import { AuthScopeType, CoreResourceType, } from '@wildo-ai/saas-models';
+import { DomainVerificationStatus, isDomainVerified, AuthScopeType, CoreResourceType, } from '@wildo-ai/saas-models';
 let DomainToOrgLookupBackendService = class DomainToOrgLookupBackendService {
     logger;
     orgConfigService;
@@ -99,11 +99,15 @@ let DomainToOrgLookupBackendService = class DomainToOrgLookupBackendService {
                 const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
                 if (!ssoConfig)
                     continue;
-                const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];
-                const isDnsVerified = verificationStatus === 'verified';
-                const domainMatches = isDnsVerified
-                    && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)
-                        || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
+                /*
+                 * The CLAIMED half goes through the one derivation (#457); the `ssoEnabledDomains` half
+                 * keeps its own status gate, because that list is a separate claim channel with the same
+                 * requirement. Exactly equivalent to the hand-written join it replaces — `isDomainVerified`
+                 * already carries the status check for its own list.
+                 */
+                const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;
+                const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)
+                    || (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
                 if (!domainMatches)
                     continue;
                 this.logDebug('Domain matched via indexed query', {
@@ -131,12 +135,11 @@ let DomainToOrgLookupBackendService = class DomainToOrgLookupBackendService {
         const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
         if (!ssoConfig)
             return null;
-        // H4: Only trust domains that have passed DNS verification
-        const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];
-        const isDnsVerified = verificationStatus === 'verified';
-        const domainMatches = isDnsVerified
-            && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)
-                || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
+        // H4: Only trust domains that have passed DNS verification. Same shape as the indexed path
+        // above — the claimed half through the derivation, the ssoEnabled half status-gated (#457).
+        const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;
+        const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)
+            || (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));
         if (!domainMatches)
             return null;
         // Find the matching SSO connection for this domain from SsoConnection resources

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-to-org-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EACL,aAAa,EACb,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAoCxB,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAIY;IAC8B;IACN;IACX;IANlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAC5D,uBAA8D,EACzE,mBAA+C;QAH5D,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACzE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEhF,yEAAyE;QACzE,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,EAAyB,EACzB,SAAwB,EACxB,gBAAwB;QAExB,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE;gBAC/F,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,gBAAgB;aACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YAC3D,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;oBACtD,CAAC,CAAE,IAAgC,CAAC,cAAwB;oBAC5D,CAAC,CAAE,IAAgC,CAAC,aAAuB,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAEzB,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;gBAC1F,MAAM,aAAa,GAAG,kBAAkB,KAAK,UAAU,CAAC;gBACxD,MAAM,aAAa,GAAG,aAAa;uBAC9B,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;2BAC3D,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEvE,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAChD,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACjF,CAAC,CAAC;gBAEH,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS;oBACT,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,gBAAwB;QAExB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,2DAA2D;QAC3D,MAAM,kBAAkB,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC1F,MAAM,aAAa,GAAG,kBAAkB,KAAK,UAAU,CAAC;QAExD,MAAM,aAAa,GAAG,aAAa;eAC9B,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;mBAC3D,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEvE,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,gFAAgF;QAChF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QAEjD,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;aACzG,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YACtK,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnF,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,OAAO;YACP,mBAAmB;YACnB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,UAAU;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,MAA6B;QAMrD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,IAAI,aAAa;YACzD,YAAY,EAAE,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;YAC5C,YAAY,EAAE,MAAM,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,KAAK,EAAE,CAAC,CAAC,mGAAmG;QAC5G,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QACjD,MAAM,WAAW,GAA4B;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACzG,CAAC;QAEF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC7D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACpC,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF,CAAA;AA9PY,+BAA+B;IAD3C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHa,aAAa;QAC2B,oCAAoC;GAL/H,+BAA+B,CA8P3C","sourcesContent":["/**\n * DomainToOrgLookupBackendService\n *\n * Provides domain-based organization lookup for SSO routing.\n * When a user enters their email, this service determines if their domain\n * is claimed by an organization with SSO configured.\n *\n * Step 14: Enterprise SSO — Domain Routing in Auth Flow\n * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)\n *\n * Used by:\n * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check\n * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport {\n  AuthScopeType,\n  CoreResourceType,\n  SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase, SsoConnectionBase } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n/**\n * Result of a domain-based scope lookup.\n * Returns an explicit scope discriminator supporting both organization and application scope.\n *\n * ⚠️ TRUST CONTRACT — `scopeId` is a DOMAIN-OWNERSHIP HINT, NEVER a security key.\n * It is the org that DNS-verified-claims the *login email's domain*, so it is attacker-influenceable\n * (the caller picks the email → the domain → the org). Safe uses: enforcement-TIGHTENING SSO gates\n * (which only ever BLOCK a login — the fail-safe direction) and display/branding. NEVER use it to\n * route data to the org, scope a resource read/query by tenant, derive membership/roles, grant\n * access, or gate features. For a per-user VERIFIED org, resolve active memberships\n * (`resolveActiveMemberOrgIds(userId)` → branded `VerifiedOrgId[]`). Routing the audit trail on this\n * value was the 2026-07-09 cross-tenant leak (see the `session-org-trust-sweep-audit` plan).\n */\nexport interface DomainOrgLookupResult {\n  scopeType: AuthScopeType;\n  /** Domain-ownership hint (DNS-verified). NEVER a routing/scoping/authz key — see the interface JSDoc. */\n  scopeId: string;\n  enforcement?: {\n    requireSSO?: boolean;\n    allowPasswordFallback?: boolean;\n    enforceForAdmins?: boolean;\n    graceLoginAttempts?: number;\n  };\n  ssoConfig: SsoConfigBase;\n  /** The specific SSO provider that matches the domain (OIDC or SAML) */\n  matchedProvider?: SsoConnectionBase;\n  /** Provider type discriminant */\n  matchedProviderType?: SsoProtocol;\n}\n\n@injectable()\nexport class DomainToOrgLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('DomainToOrgLookup');\n    this.logger.setDebugTypeLogging('DomainToOrgLookup', false);\n  }\n\n  /**\n   * Find the scope (organization or application) that claims the given email domain for SSO.\n   *\n   * Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,\n   * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).\n   * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.\n   */\n  public async findOrgByDomain(ec: ExecutionContext<any>, domain: string): Promise<DomainOrgLookupResult | null> {\n    const normalizedDomain = domain.toLowerCase();\n    this.logDebug('Looking up scope by email domain', { domain: normalizedDomain });\n\n    // 1. Fast path: indexed query for connections with explicit domain match\n    for (const scopeType of [AuthScopeType.ORGANIZATION, AuthScopeType.APPLICATION]) {\n      const result = await this._findConnectionByDomain(ec, scopeType, normalizedDomain);\n      if (result) return result;\n    }\n\n    // 2. Fallback: iterate scopes for wildcard connections (empty allowedDomains)\n    const orgIds = this.orgConfigService.getAllOrganizationIds();\n    for (const orgId of orgIds) {\n      const result = await this._matchDomainInScope(ec, AuthScopeType.ORGANIZATION, orgId, normalizedDomain);\n      if (result) return result;\n    }\n\n    const appIds = this.orgConfigService.getAllApplicationIds?.() ?? [];\n    for (const appId of appIds) {\n      const result = await this._matchDomainInScope(ec, AuthScopeType.APPLICATION, appId, normalizedDomain);\n      if (result) return result;\n    }\n\n    this.logDebug('No scope claims this domain', { domain: normalizedDomain });\n    return null;\n  }\n\n  /**\n   * Indexed cross-scope query: find enabled connections that explicitly list this domain\n   * in allowedDomains, then verify DNS status via the SSO config for the matched scope.\n   */\n  private async _findConnectionByDomain(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    normalizedDomain: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n    try {\n      const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, {\n        enabled: true,\n        allowedDomains: normalizedDomain,\n      }, undefined, { paginated: false }) as SsoConnectionBase[];\n      const connectionsList = connections ?? [];\n\n      for (const conn of connectionsList) {\n        const scopeId = scopeType === AuthScopeType.ORGANIZATION\n          ? (conn as Record<string, unknown>).organizationId as string\n          : (conn as Record<string, unknown>).applicationId as string;\n        if (!scopeId) continue;\n\n        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n        if (!ssoConfig) continue;\n\n        const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];\n        const isDnsVerified = verificationStatus === 'verified';\n        const domainMatches = isDnsVerified\n          && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)\n            || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n        if (!domainMatches) continue;\n\n        this.logDebug('Domain matched via indexed query', {\n          domain: normalizedDomain, scopeType, scopeId, matchedProviderType: conn.protocol,\n        });\n\n        return {\n          scopeType,\n          scopeId,\n          enforcement: ssoConfig.enforcement,\n          ssoConfig,\n          matchedProvider: conn,\n          matchedProviderType: conn.protocol,\n        };\n      }\n    } catch {\n      this.logDebug('SsoConnection repository not available for indexed query', { scopeType });\n    }\n\n    return null;\n  }\n\n  /**\n   * Try to match a domain against a specific scope's SSO config.\n   */\n  private async _matchDomainInScope(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    normalizedDomain: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return null;\n\n    // H4: Only trust domains that have passed DNS verification\n    const verificationStatus = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain];\n    const isDnsVerified = verificationStatus === 'verified';\n\n    const domainMatches = isDnsVerified\n      && (ssoConfig.domains.verifiedDomains.includes(normalizedDomain)\n        || ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n    if (!domainMatches) return null;\n\n    // Find the matching SSO connection for this domain from SsoConnection resources\n    let matchedProvider: SsoConnectionBase | undefined;\n    let matchedProviderType: SsoProtocol | undefined;\n\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n    try {\n      const scopeFilter: Record<string, unknown> = {\n        enabled: true,\n        ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n      };\n      const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, scopeFilter, undefined, { paginated: false }) as SsoConnectionBase[];\n      const connectionsList = connections ?? [];\n\n      const match = connectionsList.find(conn =>\n        conn.allowedDomains.length === 0 || conn.allowedDomains.includes(normalizedDomain),\n      );\n\n      if (match) {\n        matchedProvider = match;\n        matchedProviderType = match.protocol;\n      }\n    } catch {\n      this.logDebug('SsoConnection repository not available for scope', { scopeType, scopeId });\n    }\n\n    this.logDebug('Domain matched to scope', {\n      domain: normalizedDomain,\n      scopeType,\n      scopeId,\n      matchedProviderType,\n      requireSSO: ssoConfig.enforcement.requireSSO,\n    });\n\n    return {\n      scopeType,\n      scopeId,\n      enforcement: ssoConfig.enforcement,\n      ssoConfig,\n      matchedProvider,\n      matchedProviderType,\n    };\n  }\n\n  /**\n   * Get the SSO provider info needed for the identification response.\n   * Called by identify() when a domain match is found.\n   */\n  public getSSOProviderInfo(result: DomainOrgLookupResult): {\n    displayName: string;\n    providerRef: string;\n    connectionId: string;\n    providerType: SsoProtocol;\n  } | null {\n    if (!result.matchedProvider || !result.matchedProviderType) return null;\n\n    const provider = result.matchedProvider;\n    return {\n      displayName: provider.displayName,\n      providerRef: provider.externalProviderId || 'custom-oidc',\n      connectionId: provider._id || result.scopeId,\n      providerType: result.matchedProviderType,\n    };\n  }\n\n  /**\n   * Scope-keyed lookup — the domain-INDEPENDENT counterpart of\n   * {@link findOrgByDomain}. Given a KNOWN scope (organization or application) id,\n   * resolve its active SSO connection into a {@link DomainOrgLookupResult}, so a\n   * surface that already knows the scope (notably the public invitation-accept\n   * screen, keyed by the invitation's `organizationId`) can enrich ORG_SAML /\n   * ORG_OPENID_CONNECT methods with the SAME per-connection `ssoIds`/`config` that\n   * `identify()` produces — with no email→domain gate.\n   *\n   * System-access seam: the canonical (and only) caller is the PUBLIC, NON-consuming invitation\n   * discovery endpoint under an UNAUTHENTICATED pre-auth EC. `ssoConfig` is read via\n   * `readSSOConfigIfExists` — a pure READ (through the ACL-independent `readAsSystem` door) that\n   * NEVER lazily creates a default config row, unlike `loadSSOConfig` (read-then-create): a public\n   * GET discovery endpoint must not WRITE. The SSO CONNECTIONS are org-scoped and their plain LIST\n   * door would fail-closed here, so they are listed via `listAsSystem` (the SSO-connection resource\n   * opts into system LIST via `systemAccessPolicy.read = ALLOWED`). Returns `null` when the scope has\n   * no SSO config or no enabled connection (→ caller drops the SSO methods, as today).\n   */\n  public async buildLookupForScope(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    void ec; // read-only (no lazy-create) path below no longer needs the EC; retained for signature continuity.\n    const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n    if (!ssoConfig) return null;\n\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n    const scopeFilter: Record<string, unknown> = {\n      enabled: true,\n      ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n    };\n\n    let matchedProvider: SsoConnectionBase | undefined;\n    let matchedProviderType: SsoProtocol | undefined;\n    try {\n      // System-access LIST (no domain gate): take the scope's active connection.\n      const connections = await this.systemAccessService.listAsSystem<SsoConnectionBase>(\n        resourceType, scopeFilter, undefined, { paginated: false },\n      ) as SsoConnectionBase[];\n      const match = (connections ?? [])[0];\n      if (match) {\n        matchedProvider = match;\n        matchedProviderType = match.protocol;\n      }\n    } catch {\n      this.logDebug('SSO connections not readable for scope via system access', { scopeType, scopeId });\n    }\n    if (!matchedProvider) return null;\n\n    return {\n      scopeType,\n      scopeId,\n      enforcement: ssoConfig.enforcement,\n      ssoConfig,\n      matchedProvider,\n      matchedProviderType,\n    };\n  }\n}\n"]}
+{"version":3,"file":"domain-to-org-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAmCxB,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAIY;IAC8B;IACN;IACX;IANlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAC5D,uBAA8D,EACzE,mBAA+C;QAH5D,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACzE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEhF,yEAAyE;QACzE,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,EAAyB,EACzB,SAAwB,EACxB,gBAAwB;QAExB,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE;gBAC/F,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,gBAAgB;aACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YAC3D,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;oBACtD,CAAC,CAAE,IAAgC,CAAC,cAAwB;oBAC5D,CAAC,CAAE,IAAgC,CAAC,aAAuB,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAEzB;;;;;mBAKG;gBACH,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;gBAC3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;uBACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEvF,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAChD,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACjF,CAAC,CAAC;gBAEH,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS;oBACT,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,gBAAwB;QAExB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,2FAA2F;QAC3F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;QAE3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;eACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,gFAAgF;QAChF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QAEjD,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;aACzG,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YACtK,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnF,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,OAAO;YACP,mBAAmB;YACnB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,UAAU;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,MAA6B;QAMrD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,IAAI,aAAa;YACzD,YAAY,EAAE,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;YAC5C,YAAY,EAAE,MAAM,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,KAAK,EAAE,CAAC,CAAC,mGAAmG;QAC5G,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QACjD,MAAM,WAAW,GAA4B;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACzG,CAAC;QAEF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC7D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACpC,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF,CAAA;AAjQY,+BAA+B;IAD3C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHa,aAAa;QAC2B,oCAAoC;GAL/H,+BAA+B,CAiQ3C","sourcesContent":["/**\n * DomainToOrgLookupBackendService\n *\n * Provides domain-based organization lookup for SSO routing.\n * When a user enters their email, this service determines if their domain\n * is claimed by an organization with SSO configured.\n *\n * Step 14: Enterprise SSO — Domain Routing in Auth Flow\n * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)\n *\n * Used by:\n * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check\n * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport {\n  DomainVerificationStatus,\n  isDomainVerified,\n  AuthScopeType,\n  CoreResourceType,\n  SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase, SsoConnectionBase } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n/**\n * Result of a domain-based scope lookup.\n * Returns an explicit scope discriminator supporting both organization and application scope.\n *\n * ⚠️ TRUST CONTRACT — `scopeId` is a DOMAIN-OWNERSHIP HINT, NEVER a security key.\n * It is the org that DNS-verified-claims the *login email's domain*, so it is attacker-influenceable\n * (the caller picks the email → the domain → the org). Safe uses: enforcement-TIGHTENING SSO gates\n * (which only ever BLOCK a login — the fail-safe direction) and display/branding. NEVER use it to\n * route data to the org, scope a resource read/query by tenant, derive membership/roles, grant\n * access, or gate features. For a per-user VERIFIED org, resolve active memberships\n * (`resolveActiveMemberOrgIds(userId)` → branded `VerifiedOrgId[]`). Routing the audit trail on this\n * value was the 2026-07-09 cross-tenant leak (see the `session-org-trust-sweep-audit` plan).\n */\nexport interface DomainOrgLookupResult {\n  scopeType: AuthScopeType;\n  /** Domain-ownership hint (DNS-verified). NEVER a routing/scoping/authz key — see the interface JSDoc. */\n  scopeId: string;\n  enforcement?: {\n    requireSSO?: boolean;\n    allowPasswordFallback?: boolean;\n    graceLoginAttempts?: number;\n  };\n  ssoConfig: SsoConfigBase;\n  /** The specific SSO provider that matches the domain (OIDC or SAML) */\n  matchedProvider?: SsoConnectionBase;\n  /** Provider type discriminant */\n  matchedProviderType?: SsoProtocol;\n}\n\n@injectable()\nexport class DomainToOrgLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('DomainToOrgLookup');\n    this.logger.setDebugTypeLogging('DomainToOrgLookup', false);\n  }\n\n  /**\n   * Find the scope (organization or application) that claims the given email domain for SSO.\n   *\n   * Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,\n   * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).\n   * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.\n   */\n  public async findOrgByDomain(ec: ExecutionContext<any>, domain: string): Promise<DomainOrgLookupResult | null> {\n    const normalizedDomain = domain.toLowerCase();\n    this.logDebug('Looking up scope by email domain', { domain: normalizedDomain });\n\n    // 1. Fast path: indexed query for connections with explicit domain match\n    for (const scopeType of [AuthScopeType.ORGANIZATION, AuthScopeType.APPLICATION]) {\n      const result = await this._findConnectionByDomain(ec, scopeType, normalizedDomain);\n      if (result) return result;\n    }\n\n    // 2. Fallback: iterate scopes for wildcard connections (empty allowedDomains)\n    const orgIds = this.orgConfigService.getAllOrganizationIds();\n    for (const orgId of orgIds) {\n      const result = await this._matchDomainInScope(ec, AuthScopeType.ORGANIZATION, orgId, normalizedDomain);\n      if (result) return result;\n    }\n\n    const appIds = this.orgConfigService.getAllApplicationIds?.() ?? [];\n    for (const appId of appIds) {\n      const result = await this._matchDomainInScope(ec, AuthScopeType.APPLICATION, appId, normalizedDomain);\n      if (result) return result;\n    }\n\n    this.logDebug('No scope claims this domain', { domain: normalizedDomain });\n    return null;\n  }\n\n  /**\n   * Indexed cross-scope query: find enabled connections that explicitly list this domain\n   * in allowedDomains, then verify DNS status via the SSO config for the matched scope.\n   */\n  private async _findConnectionByDomain(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    normalizedDomain: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n    try {\n      const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, {\n        enabled: true,\n        allowedDomains: normalizedDomain,\n      }, undefined, { paginated: false }) as SsoConnectionBase[];\n      const connectionsList = connections ?? [];\n\n      for (const conn of connectionsList) {\n        const scopeId = scopeType === AuthScopeType.ORGANIZATION\n          ? (conn as Record<string, unknown>).organizationId as string\n          : (conn as Record<string, unknown>).applicationId as string;\n        if (!scopeId) continue;\n\n        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n        if (!ssoConfig) continue;\n\n        /*\n         * The CLAIMED half goes through the one derivation (#457); the `ssoEnabledDomains` half\n         * keeps its own status gate, because that list is a separate claim channel with the same\n         * requirement. Exactly equivalent to the hand-written join it replaces — `isDomainVerified`\n         * already carries the status check for its own list.\n         */\n        const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n        const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n          || (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n        if (!domainMatches) continue;\n\n        this.logDebug('Domain matched via indexed query', {\n          domain: normalizedDomain, scopeType, scopeId, matchedProviderType: conn.protocol,\n        });\n\n        return {\n          scopeType,\n          scopeId,\n          enforcement: ssoConfig.enforcement,\n          ssoConfig,\n          matchedProvider: conn,\n          matchedProviderType: conn.protocol,\n        };\n      }\n    } catch {\n      this.logDebug('SsoConnection repository not available for indexed query', { scopeType });\n    }\n\n    return null;\n  }\n\n  /**\n   * Try to match a domain against a specific scope's SSO config.\n   */\n  private async _matchDomainInScope(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    normalizedDomain: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return null;\n\n    // H4: Only trust domains that have passed DNS verification. Same shape as the indexed path\n    // above — the claimed half through the derivation, the ssoEnabled half status-gated (#457).\n    const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n\n    const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n      || (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n    if (!domainMatches) return null;\n\n    // Find the matching SSO connection for this domain from SsoConnection resources\n    let matchedProvider: SsoConnectionBase | undefined;\n    let matchedProviderType: SsoProtocol | undefined;\n\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n    try {\n      const scopeFilter: Record<string, unknown> = {\n        enabled: true,\n        ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n      };\n      const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, scopeFilter, undefined, { paginated: false }) as SsoConnectionBase[];\n      const connectionsList = connections ?? [];\n\n      const match = connectionsList.find(conn =>\n        conn.allowedDomains.length === 0 || conn.allowedDomains.includes(normalizedDomain),\n      );\n\n      if (match) {\n        matchedProvider = match;\n        matchedProviderType = match.protocol;\n      }\n    } catch {\n      this.logDebug('SsoConnection repository not available for scope', { scopeType, scopeId });\n    }\n\n    this.logDebug('Domain matched to scope', {\n      domain: normalizedDomain,\n      scopeType,\n      scopeId,\n      matchedProviderType,\n      requireSSO: ssoConfig.enforcement.requireSSO,\n    });\n\n    return {\n      scopeType,\n      scopeId,\n      enforcement: ssoConfig.enforcement,\n      ssoConfig,\n      matchedProvider,\n      matchedProviderType,\n    };\n  }\n\n  /**\n   * Get the SSO provider info needed for the identification response.\n   * Called by identify() when a domain match is found.\n   */\n  public getSSOProviderInfo(result: DomainOrgLookupResult): {\n    displayName: string;\n    providerRef: string;\n    connectionId: string;\n    providerType: SsoProtocol;\n  } | null {\n    if (!result.matchedProvider || !result.matchedProviderType) return null;\n\n    const provider = result.matchedProvider;\n    return {\n      displayName: provider.displayName,\n      providerRef: provider.externalProviderId || 'custom-oidc',\n      connectionId: provider._id || result.scopeId,\n      providerType: result.matchedProviderType,\n    };\n  }\n\n  /**\n   * Scope-keyed lookup — the domain-INDEPENDENT counterpart of\n   * {@link findOrgByDomain}. Given a KNOWN scope (organization or application) id,\n   * resolve its active SSO connection into a {@link DomainOrgLookupResult}, so a\n   * surface that already knows the scope (notably the public invitation-accept\n   * screen, keyed by the invitation's `organizationId`) can enrich ORG_SAML /\n   * ORG_OPENID_CONNECT methods with the SAME per-connection `ssoIds`/`config` that\n   * `identify()` produces — with no email→domain gate.\n   *\n   * System-access seam: the canonical (and only) caller is the PUBLIC, NON-consuming invitation\n   * discovery endpoint under an UNAUTHENTICATED pre-auth EC. `ssoConfig` is read via\n   * `readSSOConfigIfExists` — a pure READ (through the ACL-independent `readAsSystem` door) that\n   * NEVER lazily creates a default config row, unlike `loadSSOConfig` (read-then-create): a public\n   * GET discovery endpoint must not WRITE. The SSO CONNECTIONS are org-scoped and their plain LIST\n   * door would fail-closed here, so they are listed via `listAsSystem` (the SSO-connection resource\n   * opts into system LIST via `systemAccessPolicy.read = ALLOWED`). Returns `null` when the scope has\n   * no SSO config or no enabled connection (→ caller drops the SSO methods, as today).\n   */\n  public async buildLookupForScope(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n  ): Promise<DomainOrgLookupResult | null> {\n    void ec; // read-only (no lazy-create) path below no longer needs the EC; retained for signature continuity.\n    const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n    if (!ssoConfig) return null;\n\n    const resourceType = scopeType === AuthScopeType.ORGANIZATION\n      ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n      : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n    const scopeFilter: Record<string, unknown> = {\n      enabled: true,\n      ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n    };\n\n    let matchedProvider: SsoConnectionBase | undefined;\n    let matchedProviderType: SsoProtocol | undefined;\n    try {\n      // System-access LIST (no domain gate): take the scope's active connection.\n      const connections = await this.systemAccessService.listAsSystem<SsoConnectionBase>(\n        resourceType, scopeFilter, undefined, { paginated: false },\n      ) as SsoConnectionBase[];\n      const match = (connections ?? [])[0];\n      if (match) {\n        matchedProvider = match;\n        matchedProviderType = match.protocol;\n      }\n    } catch {\n      this.logDebug('SSO connections not readable for scope via system access', { scopeType, scopeId });\n    }\n    if (!matchedProvider) return null;\n\n    return {\n      scopeType,\n      scopeId,\n      enforcement: ssoConfig.enforcement,\n      ssoConfig,\n      matchedProvider,\n      matchedProviderType,\n    };\n  }\n}\n"]}

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts

@@ -15,6 +15,8 @@ import 'reflect-metadata';
 import { LoggerService } from '../../../../monitoring/logger/services/logger.service';
 import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service';
 import { AuthScopeType } from '@wildo-ai/saas-models';
+import type { SsoConfigBase } from '@wildo-ai/saas-models';
+import type { SystemAccessBackendService } from '../../../../base-classes/services/services/system-access.backend.service';
 import type { ExecutionContext } from '../../../../runtime/models/execution-context.backend.schemas';
 /** Result of a domain verification attempt */
 export interface DomainVerificationResult {
@@ -23,14 +25,122 @@ export interface DomainVerificationResult {
     verificationToken: string;
     dnsRecordsFound: string[];
 }
+/** The `domains` block of an SSO config — the only part of the row these planners touch. */
+export type SsoConfigDomains = SsoConfigBase['domains'];
+/** The scope that already holds a domain VERIFIED, when one does. */
+export interface DomainExclusivityConflict {
+    scopeType: AuthScopeType;
+    scopeId: string;
+}
+/** A minted challenge plus the `domains` block that records it. */
+export interface DomainClaimPlan {
+    domains: SsoConfigDomains;
+    verificationToken: string;
+    dnsName: string;
+    dnsRecordValue: string;
+}
 export declare class DomainVerificationBackendService {
     private readonly logger;
     private readonly orgConfigService;
+    /**
+     * The exclusivity probe reads OTHER scopes' SSO configs, which no tenant-scoped context may do.
+     * `@optional()` so a minimal test container that binds neither still constructs; the probe
+     * itself fails CLOSED when it is absent rather than reporting "no conflict".
+     */
+    private readonly systemAccessService?;
     private readonly logDebug;
-    constructor(logger: LoggerService, orgConfigService: AuthOrganizationConfigurationService);
+    constructor(logger: LoggerService, orgConfigService: AuthOrganizationConfigurationService, 
+    /**
+     * The exclusivity probe reads OTHER scopes' SSO configs, which no tenant-scoped context may do.
+     * `@optional()` so a minimal test container that binds neither still constructs; the probe
+     * itself fails CLOSED when it is absent rather than reporting "no conflict".
+     */
+    systemAccessService?: SystemAccessBackendService);
+    /**
+     * Mint a challenge for `domain` and return the `domains` block that records it as `pending`.
+     *
+     * Re-claiming an already-claimed domain is legal and deliberate: it mints a FRESH nonce and
+     * resets the status to `pending`. The stored nonce is `.isBackendOnly()` and is disclosed exactly
+     * once, in the claim response, so re-claiming is the only way to recover a lost record value —
+     * and it invalidates the previous one, which is the right direction.
+     */
+    planDomainClaim(domains: SsoConfigDomains, domain: string): DomainClaimPlan;
+    /**
+     * Record the outcome of a challenge check. `verified` decides between `verified` and `failed`;
+     * there is no third answer, because a check that could not resolve DNS has already been reported
+     * as not-verified by {@link checkDomainChallenge}.
+     */
+    planVerificationOutcome(domains: SsoConfigDomains, domain: string, verified: boolean): SsoConfigDomains;
+    /**
+     * Remove every trace of a domain from a scope: the claim, its status, its nonce — and its entry
+     * in `ssoEnabledDomains`.
+     *
+     * That last one is the half a revocation forgets. `ssoEnabledDomains` is a SECOND claim channel
+     * that the sign-in router consults with its own status gate
+     * (`domain-to-org-lookup.backend.service.ts`), so leaving the domain there while deleting the
+     * status entry produces a half-revoked domain: harmless today, and one status write away from
+     * routing again under a claim nobody believes they still hold.
+     */
+    planDomainRevocation(domains: SsoConfigDomains, domain: string): SsoConfigDomains;
+    /** The challenge nonce a scope holds for a domain, if it has claimed one. */
+    getVerificationToken(domains: SsoConfigDomains, domain: string): string | undefined;
+    /** The DNS name the operator publishes the TXT record on. */
+    verificationDnsName(domain: string): string;
+    /**
+     * Resolve the challenge record and say whether it carries the expected nonce.
+     *
+     * Public because the operation that verifies a domain must run the check and persist the outcome
+     * as ONE resource UPDATE; a method that did both would have to write on its own.
+     */
+    checkDomainChallenge(domain: string, expectedToken: string): Promise<{
+        verified: boolean;
+        recordsFound: string[];
+    }>;
+    /**
+     * The scope OTHER than `(scopeType, scopeId)` that already holds `domain` VERIFIED, if any.
+     *
+     * ## Why exclusivity is enforced at all
+     *
+     * `DomainToOrgLookupBackendService.findOrgByDomain` returns the FIRST scope whose config matches.
+     * Two scopes holding one domain therefore means a `@customer.com` sign-in routes to whichever the
+     * lookup reaches first — an answer that can change between processes. Nothing prevented that
+     * before, only the fact that reaching the verified state required an out-of-band database write
+     * by two different tenants. A public route makes it reachable.
+     *
+     * ## What this is NOT protecting against
+     *
+     * Worth stating precisely, because it decides how much this check is load-bearing. DNS is already
+     * the defence against TAKEOVER: only whoever controls `customer.com` can publish the nonce, so a
+     * rogue tenant's claim can never be verified. What remains is the real owner verifying the same
+     * domain under two of their own scopes — an ambiguity, not an attack. This check makes that
+     * refuse instead of silently deciding.
+     *
+     * ## Why the scan is exhaustive, and why it is not filtered
+     *
+     * It reads every SSO config row of both scope variants and joins in memory. Two cheaper options
+     * were rejected:
+     *   - `getAllOrganizationIds()` enumerates a warm in-memory cache, so on a cold process it
+     *     reports fewer scopes than exist. An exclusivity check built on it answers "nobody else
+     *     holds it" from an incomplete population;
+     *   - a repository filter on `domains.verifiedDomains` is a nested-array predicate. It works on
+     *     the MongoDB adapter and is not portable to the SQL one, where the block is a JSON column —
+     *     so it would return nothing rather than fail, in the direction that produces a false
+     *     "available".
+     * The cost is bounded by tenant count and paid only on claim and verify, which are rare admin
+     * acts. If it ever stops being cheap, the answer is an indexed projection of the verified set,
+     * not a filter nobody can prove is portable.
+     *
+     * Returns `null` when no other scope holds it. THROWS when it cannot answer — a probe that cannot
+     * read must not be mistaken for a probe that found nothing.
+     */
+    findConflictingScope(scopeType: AuthScopeType, scopeId: string, domain: string): Promise<DomainExclusivityConflict | null>;
     /**
-     * Initiate domain verification: generate a token and store it in the org's SSO config.
+     * Initiate domain verification: generate a token and store it in the scope's SSO config.
      * Returns the token the admin must add as a DNS TXT record.
+     *
+     * Does NOT check exclusivity — see {@link findConflictingScope}, which the public operation calls
+     * before this planner's patch is persisted. A caller reaching this method directly is asserting
+     * it has already answered that question.
      */
     initiateDomainVerification(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, domain: string): Promise<{
         verificationToken: string;
@@ -39,7 +149,7 @@ export declare class DomainVerificationBackendService {
     }>;
     /**
      * Verify domain ownership by checking DNS TXT records.
-     * Updates the domain's verification status in the org's SSO config.
+     * Updates the domain's verification status in the scope's SSO config.
      */
     verifyDomainOwnership(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, domain: string): Promise<DomainVerificationResult>;
     /**

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"domain-verification.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAQD,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAJpG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC;IAM1I;;;OAGG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAiCF;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC;IAkDpC;;OAEG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAOnB;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IASpB;;OAEG;YACW,kBAAkB;CAyBjC"}
+{"version":3,"file":"domain-verification.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACmB,aAAa,EAAgE,MAAM,uBAAuB,CAAC;AACrI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAExD,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAQD,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClG;;;;OAIG;IACyD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAVnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC;IACxI;;;;OAIG;IAC0E,mBAAmB,CAAC,EAAE,0BAA0B;IAoB/H;;;;;;;OAOG;IACI,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe;IAqClF;;;;OAIG;IACI,uBAAuB,CAC5B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAChB,gBAAgB;IAWnB;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAaxF,6EAA6E;IACtE,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1F,6DAA6D;IACtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIlD;;;;;OAKG;IACU,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAChF,QAAQ,EAAE,OAAO,CAAC;QAClB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAQF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACU,oBAAoB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAuC5C;;;;;;;OAOG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAsBF;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC;IAiDpC;;OAEG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAOnB;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;OAEG;YACW,kBAAkB;CAyBjC"}