@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.js

@@ -41,6 +41,7 @@ import { applyInvitationAcceptanceCore } from '../../../../organizations/service
 import { validateOrgMemberRoles } from '../../../../organizations/services/org-member-roles-validation.backend.utils.js';
 import { revokeUserTypesOnOrgLeave } from '../../../../organizations/services/user-type-revocation-on-org-leave.backend.utils.js';
 import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service.js';
+import { isOrgActivelyDirectoryManaged } from '../../../../organizations/services/scim-provisioning-gate.backend.utils.js';
 import { projectCaughtErrorLogFields } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { CoreResourceType, CoreAuditableEventType, ErrorType, ErrorCustomMessageReference, ResourceOperationRiskLevel, CORE_APP_ROLES, SsoConnectionType, UserStatus, OrganizationMemberStatus, AuthScopeType, ExternalIdentitySource, RegistrationAcquisitionChannel, evaluateUserTypeAcquisition, isWildoBackendError, } from '@wildo-ai/saas-models';
 // `EnterpriseProvisioningConfig` now lives in the models layer (sso-connection.backend.schemas) so
@@ -58,8 +59,9 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
     systemAccessService;
     emailVerificationInitiator;
     resourcePersistenceUnitOfWork;
+    featureResolution;
     logDebug;
-    constructor(logger, errorBuilder, servicesRegistryHandler, authEcFactory, tokenIssuer, auditLogsService, appConfigService, userLookup, systemAccessService, emailVerificationInitiator, resourcePersistenceUnitOfWork) {
+    constructor(logger, errorBuilder, servicesRegistryHandler, authEcFactory, tokenIssuer, auditLogsService, appConfigService, userLookup, systemAccessService, emailVerificationInitiator, resourcePersistenceUnitOfWork, featureResolution) {
         this.logger = logger;
         this.errorBuilder = errorBuilder;
         this.servicesRegistryHandler = servicesRegistryHandler;
@@ -71,6 +73,7 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
         this.systemAccessService = systemAccessService;
         this.emailVerificationInitiator = emailVerificationInitiator;
         this.resourcePersistenceUnitOfWork = resourcePersistenceUnitOfWork;
+        this.featureResolution = featureResolution;
         this.logDebug = this.logger.debugByType('EnterpriseUserProvisioning');
         this.logger.setDebugTypeLogging('EnterpriseUserProvisioning', false);
     }
@@ -410,9 +413,62 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
             scopeId: scope.scopeId,
             orgMemberCreated: result.orgMemberCreated,
         });
-        await this._reconcileLocalCredentialsForDirectoryManaged(result.user._id);
+        await this._reconcileLocalCredentialsIfOrgIsDirectoryManaged(scope, result.user._id);
         return result;
     }
+    /**
+     * The population gate in front of the destructive per-user credential clear: reconcile ONLY when
+     * the user was just provisioned into an org that is ACTIVELY directory-managed.
+     *
+     * ### Why the gate exists, measured rather than assumed
+     * `provisionExistingUser` is the shared seam for THREE surfaces — SCIM push, enterprise SAML ACS,
+     * and enterprise OIDC JIT — and until this gate the clear fired on all of them, unconditionally.
+     * So an ordinary enterprise-SSO login into an org with no directory integration at all silently
+     * destroyed that user's password and every enrolled passkey, on every login, while the method's own
+     * docstring described a population ("a user provisioned into a directory-MANAGED org") that no code
+     * anywhere checked. The obligation is real for a managed org and does not exist for an unmanaged
+     * one; the reconciliation sweep this sits beside is only as sound as the rule that says who owes it.
+     *
+     * ### Only an ORGANIZATION scope can be directory-managed
+     * An APPLICATION-scoped enterprise connection has no organization, hence no SCIM token and no
+     * per-org `DIRECTORY_PROVISIONING` feature, hence no directory doing the deprovisioning that makes
+     * a local first factor a bypass. It is skipped, not defaulted.
+     *
+     * ### A failed posture read SKIPS the clear, which is the opposite of the invite-accept gate
+     * `isOrgActivelyDirectoryManaged` deliberately propagates read errors so that its usual caller —
+     * the invite-accept credential BLOCK — fails closed. Here "closed" points the other way: the
+     * dangerous act is the irreversible DESTRUCTION of a live user's only credential, so an
+     * unanswerable posture question must not authorise it. Skipping is safe because nothing is lost by
+     * waiting: the effective policy (`resolveEffectiveAuthPolicy`) already refuses the local method for
+     * a managed user meanwhile, and the clear is retried on this user's next provision and on the org's
+     * next SCIM token mint (see {@link sweepDirectoryManagedCredentialsForOrg}). That is the whole
+     * argument for building the reconciliation first: it is what makes the conservative choice here
+     * affordable.
+     */
+    async _reconcileLocalCredentialsIfOrgIsDirectoryManaged(scope, userId) {
+        const organizationId = getOrganizationIdFromEnterpriseScope(scope);
+        if (!organizationId)
+            return;
+        let orgIsDirectoryManaged;
+        try {
+            orgIsDirectoryManaged = await isOrgActivelyDirectoryManaged({
+                organizationId,
+                featureResolution: this.featureResolution,
+                systemAccessService: this.systemAccessService,
+            });
+        }
+        catch (error) {
+            this.logger.warn('AUTH-24: could not resolve directory-management posture — skipping the local credential clear', {
+                organizationId,
+                userId,
+                ...projectCaughtErrorLogFields(error),
+            });
+            return;
+        }
+        if (!orgIsDirectoryManaged)
+            return;
+        await this._reconcileLocalCredentialsForDirectoryManaged(userId);
+    }
     // ═══════════════════════════════════════════════════════════════
     // Private: Fail-Closed Status Gate (S0.7 — enterprise sibling)
     // ═══════════════════════════════════════════════════════════════
@@ -473,6 +529,22 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
      * renders these methods DORMANT for a managed user (`resolveEffectiveAuthPolicy`); this is the
      * compliance-grade DESTRUCTION on top (chosen over dormant-only). See
      * `.claude/plans/auth-24-credential-lifecycle.md`.
+     *
+     * ### It clears; it does NOT decide who owes the clear
+     * This is a destructive PRIMITIVE. Whether the user's org is actually directory-managed is the
+     * CALLER's question, because only the caller knows the scope the provision happened in — see the
+     * `isOrgActivelyDirectoryManaged` gate at the {@link provisionExistingUser} call site, and
+     * {@link sweepDirectoryManagedCredentialsForOrg} for the bulk one. Naming the population here
+     * would put a feature + token read inside a method that is called in a loop.
+     *
+     * ### Why it still swallows, and what changed
+     * The swallow is right and stays: a failed clear must not fail the SCIM provisioning that added
+     * the user, and the effective policy already refuses the local method meanwhile. What was wrong is
+     * that the failure went nowhere — a warn line, and no second attempt, ever. It now RETURNS its
+     * outcome, so the bulk caller can retry and can say out loud which users are still carrying a
+     * first factor in an org that deprovisions through a directory.
+     *
+     * @returns `true` when the clear landed, `false` when it failed (already logged).
      */
     async _reconcileLocalCredentialsForDirectoryManaged(userId) {
         try {
@@ -480,6 +552,7 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
                 passwordHash: null,
                 passkeyCredentials: [],
             });
+            return true;
         }
         catch (error) {
             // Best-effort reconciliation: never throws. Project the caught value into flat,
@@ -490,6 +563,7 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
                 userId,
                 ...projectCaughtErrorLogFields(error),
             });
+            return false;
         }
     }
     /**
@@ -501,28 +575,97 @@ let EnterpriseUserProvisioningBackendService = class EnterpriseUserProvisioningB
      * and best-effort (logged, never thrown — must not fail the token mint). Part 1 (`resolveEffectiveAuthPolicy`)
      * already renders these members dormant the moment the org is managed; this brings the physical DESTRUCTION
      * forward to activation time. See `.claude/plans/auth-24-credential-lifecycle.md`.
+     *
+     * ### The reconciliation contract (what a partial sweep now does instead of nothing)
+     * A member whose clear fails is a LIVE deprovisioning bypass sitting in a now-managed org, and
+     * until this change the whole record of it was one `warn` per user with no second attempt. The
+     * sweep now:
+     *
+     * 1. **Retries the failed set once, in the same pass.** The dominant failure mode at this seam is
+     *    a transient repository/transaction error, and the clear is idempotent — re-issuing
+     *    `{ passwordHash: null, passkeyCredentials: [] }` against an already-cleared row is a no-op
+     *    write, never a second destruction. One retry is what turns "recorded that it stopped" into
+     *    "finished"; a loop is not, because a persistent failure is a defect and must surface, not spin.
+     * 2. **Reports the residual at ERROR, naming every user.** A `warn` is where a security finding
+     *    goes to die: it is below a level-60 gate and it aggregates nothing. The residual is the whole
+     *    point of the sweep, so it is the loud line, with the ids an operator needs to act.
+     * 3. **Returns a structured result**, so a caller that CAN block on it (a future admin-triggered
+     *    re-sweep) is able to; today's caller deliberately does not.
+     *
+     * ### Rejected: verifying convergence by reading the credential rows back
+     * The honest check would be "re-read each row and count who still carries local first-factor
+     * material". It is not available and must not be made available cheaply: `USER_CREDENTIALS` opts
+     * into `systemAccessPolicy` `create` + `update` ONLY, so `readAsSystem` fails closed by design —
+     * that row holds the password hash, the TOTP secret and the hashed backup codes, and opening a
+     * trusted system READ door onto it for every future caller is a worse trade than living with a
+     * write-outcome-only signal. The write's own success is therefore the observation, and the
+     * re-run below is what covers the case where the write lied.
+     *
+     * ### Rejected: throwing on a non-converged sweep
+     * The caller is the SCIM token mint — the act that MAKES the org directory-managed. Refusing it
+     * because some member's old password could not be destroyed would block the activation whose
+     * safety this exists to improve, and would leave the org unmanaged with every local credential
+     * intact: strictly the worse state. Proceed-and-record is the correct posture, the same shape
+     * `.claude/rules/administrative-continuity-floors.md` prescribes for an acknowledged floor breach —
+     * the RECORD is the control.
+     *
+     * ### Where the re-run comes from
+     * This pass is safe to repeat, so it does not need a scheduler of its own. It re-runs on every
+     * SCIM token mint for the org (rotation included), and each individual member is re-reconciled on
+     * their next enterprise provision through the gated {@link provisionExistingUser} call site. What
+     * remains uncovered is a member who is never re-provisioned and whose org never rotates its token;
+     * for them the effective-policy block (part 1) is the standing control, and the ERROR line above is
+     * the operator's cue.
      */
     async sweepDirectoryManagedCredentialsForOrg(organizationId) {
+        const outcome = { membersExamined: 0, cleared: 0, stillCarryingLocalCredentials: [] };
         try {
             const links = await this.systemAccessService.listAsSystem(CoreResourceType.USER_IDENTITY_LINKS, { organizationId });
             const linkArr = Array.isArray(links) ? links : links.data;
             const userIds = [...new Set(linkArr.map((l) => l.userId).filter((id) => !!id))];
+            outcome.membersExamined = userIds.length;
+            const failedFirstAttempt = [];
             for (const userId of userIds) {
-                await this._reconcileLocalCredentialsForDirectoryManaged(userId);
+                if (await this._reconcileLocalCredentialsForDirectoryManaged(userId))
+                    outcome.cleared++;
+                else
+                    failedFirstAttempt.push(userId);
+            }
+            // The single retry. Idempotent by construction (see the contract above), so this cannot
+            // destroy anything twice; it only finishes the users a transient error dropped.
+            for (const userId of failedFirstAttempt) {
+                if (await this._reconcileLocalCredentialsForDirectoryManaged(userId))
+                    outcome.cleared++;
+                else
+                    outcome.stillCarryingLocalCredentials.push(userId);
+            }
+            if (outcome.stillCarryingLocalCredentials.length > 0) {
+                // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — a member of an actively
+                // directory-managed org whose local first factor could not be destroyed can still
+                // authenticate around IdP deprovisioning at the credential layer. The effective-policy block
+                // is what stops them today; this line is what tells someone the physical destruction is owed.
+                this.logger.error('AUTH-24: local credentials still present after the directory-managed sweep and its retry', {
+                    organizationId,
+                    userIds: outcome.stillCarryingLocalCredentials,
+                    membersExamined: outcome.membersExamined,
+                });
             }
-            if (userIds.length > 0) {
+            else if (userIds.length > 0) {
                 this.logDebug('AUTH-24: swept local credentials on SCIM activation', { organizationId, memberCount: userIds.length });
             }
         }
         catch (error) {
-            // Same best-effort treatment as the per-user path: structured, raw-JSON fields so a
-            // thrown `WildoError_Backend` (a plain object, not an `Error`) keeps its full detail
-            // instead of collapsing to `String(error)` (`'[object Object]'`).
-            this.logger.warn('AUTH-24: bulk credential sweep on SCIM activation failed', {
+            // The LIST (or the container resolution behind it) failed, so not one member was examined —
+            // a materially worse outcome than a per-user failure, and the reason this stays ERROR rather
+            // than the previous `warn`. Still not thrown: see "Rejected: throwing" above. Structured,
+            // raw-JSON fields so a thrown `WildoError_Backend` (a plain object, not an `Error`) keeps its
+            // full detail instead of collapsing to `String(error)` (`'[object Object]'`).
+            this.logger.error('AUTH-24: bulk credential sweep on SCIM activation failed — no member was reconciled', {
                 organizationId,
                 ...projectCaughtErrorLogFields(error),
             });
         }
+        return outcome;
     }
     // ═══════════════════════════════════════════════════════════════
     // Update Org User (used by SCIM Step 20)
@@ -940,8 +1083,9 @@ EnterpriseUserProvisioningBackendService = __decorate([
     __param(8, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
     __param(9, inject(SAAS_SERVICE_TYPES.EmailVerificationInitiatorService)),
     __param(10, inject(SAAS_SERVICE_TYPES.ResourcePersistenceUnitOfWorkService)),
+    __param(11, inject(SAAS_SERVICE_TYPES.FeatureResolutionService)),
     __metadata("design:paramtypes", [LoggerService,
-        ErrorBuilderBackendService, Function, AuthExecutionContextFactoryBackendService, Function, AuditLogsBackendService, Function, Function, Function, Function, Function])
+        ErrorBuilderBackendService, Function, AuthExecutionContextFactoryBackendService, Function, AuditLogsBackendService, Function, Function, Function, Function, Function, Function])
 ], EnterpriseUserProvisioningBackendService);
 export { EnterpriseUserProvisioningBackendService };
 //# sourceMappingURL=enterprise-user-provisioning.backend.service.js.map