@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js

@@ -0,0 +1,283 @@
+/**
+ * SSO Config — domain-ownership operations (#424)
+ *
+ * Three public operations that turn enterprise domain routing from an out-of-band database write
+ * into a self-service admin flow:
+ *
+ *   claimDomain   → mints a DNS-TXT challenge, records the domain as `pending`, returns the record
+ *   verifyDomain  → resolves the record, records `verified` or `failed`
+ *   revokeDomain  → removes the claim, its status, its nonce and its `ssoEnabledDomains` entry
+ *
+ * ## Why PREFIX, and not OVERRIDE_ALL
+ *
+ * Each handler computes the new `domains` block and returns it; the framework's own core UPDATE
+ * persists it. `OVERRIDE_ALL` returns before the post-operation lane, so it emits NO
+ * `RESOURCE_OPERATION_PERFORMED` audit event — and the audit row is the control that makes a
+ * privileged configuration change with cross-tenant reach accountable. An operation that granted a
+ * tenant SSO routing authority and left no trail would be strictly worse than the database write it
+ * replaces, which at least happens where a DBA can see it.
+ *
+ * ## Where the domain-ownership rules live
+ *
+ * In `DomainVerificationBackendService`, as pure planners. This file is the door: it resolves the
+ * scope, enforces the refusals, and hands the plan to the framework. Nothing here re-implements
+ * what a claim or a revocation means.
+ */
+import { AuthScopeType, CoreResourceType, DomainVerificationStatus, ErrorType, ResourceOperationVariantType, SsoConfig_Operations, } from '@wildo-ai/saas-models';
+import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
+import { createResourceCustomServiceImplementation, } from '../../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';
+const SSO_CONFIG_SCOPE_VARIANTS = [
+    {
+        resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,
+        scopeType: AuthScopeType.ORGANIZATION,
+        scopeField: 'organizationId',
+    },
+    {
+        resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,
+        scopeType: AuthScopeType.APPLICATION,
+        scopeField: 'applicationId',
+    },
+];
+/**
+ * Carries the two values a response needs that the persisted row does not hold, from the PREFIX
+ * that computed them to the POSTFIX that shapes the reply.
+ *
+ * Bounded on purpose. The precedent bridges in this tree (`ROTATE_BRIDGE_BY_TARGET_ID`) delete
+ * their entry in the postfix and rely on the postfix always running; a core UPDATE that throws
+ * between the two leaks one entry forever. Expiring on write costs one `Date.now()` per call and
+ * removes the question.
+ */
+const RESPONSE_BRIDGE_TTL_MS = 60_000;
+const RESPONSE_BRIDGE = new Map();
+/**
+ * Keyed on the REQUEST, not on the row.
+ *
+ * The postfix receives the persisted row and the execution context — never the request body — so it
+ * cannot re-derive which domain the call was about. `correlationId` is minted per request and is
+ * the same value in both handlers, which makes the hand-off exact: two admins claiming two domains
+ * on the same configuration row at the same instant cannot read each other's response.
+ */
+function bridgeKey(resourceType, operation, executionContext) {
+    return `${resourceType}|${operation}|${executionContext.correlationId}`;
+}
+function putBridged(key, value) {
+    const now = Date.now();
+    for (const [existingKey, entry] of RESPONSE_BRIDGE) {
+        if (entry.expiresAt <= now)
+            RESPONSE_BRIDGE.delete(existingKey);
+    }
+    RESPONSE_BRIDGE.set(key, { value, expiresAt: now + RESPONSE_BRIDGE_TTL_MS });
+}
+function takeBridged(key) {
+    const entry = RESPONSE_BRIDGE.get(key);
+    RESPONSE_BRIDGE.delete(key);
+    if (!entry || entry.expiresAt <= Date.now())
+        return undefined;
+    return entry.value;
+}
+/**
+ * The row being updated, its scope id, and the normalised domain.
+ *
+ * `utils.currentObject` is the pre-image the framework already fetched for this UPDATE, so nothing
+ * here re-reads the config. The domain is lowercased HERE, once, because every stored map is keyed
+ * on the lowercase form and a second normalisation site is a second place for the two to disagree.
+ */
+function resolveDomainRequest(variant, input, executionContext, utils) {
+    const rawDomain = input?.domain;
+    if (typeof rawDomain !== 'string' || rawDomain.trim().length === 0) {
+        throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {
+            context: {
+                code: 'SSO_DOMAIN_REQUIRED',
+                reason: 'sso_domain_required',
+                message: 'Provide `domain`: the DNS hostname this scope is claiming.',
+            },
+        });
+    }
+    const currentObject = utils.currentObject;
+    const scopeId = currentObject?.[variant.scopeField];
+    if (!currentObject?.domains || typeof scopeId !== 'string' || scopeId.length === 0) {
+        // The row is addressed by its scope (a one-to-one composition), so a missing scope id means the
+        // framework could not resolve the singleton — never that the caller addressed someone else.
+        throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {
+            context: {
+                code: 'SSO_CONFIG_SCOPE_UNRESOLVED',
+                reason: 'sso_config_scope_unresolved',
+                message: 'The SSO configuration row for this scope could not be resolved.',
+                resourceType: variant.resourceType,
+            },
+        });
+    }
+    return { domain: rawDomain.trim().toLowerCase(), scopeId, domains: currentObject.domains };
+}
+function getDomainVerificationService(container) {
+    return container.get(SAAS_SERVICE_TYPES.DomainVerificationService);
+}
+/**
+ * Refuse when another scope already holds this domain VERIFIED.
+ *
+ * Run at CLAIM as a helpful early refusal, and again at VERIFY because that is the gate that
+ * matters: a claim is not a lock, so another scope can complete its own verification in between.
+ *
+ * **The holder is deliberately not named.** Telling one tenant which other tenant holds a domain
+ * discloses a customer's configuration to a stranger who supplied nothing but a hostname. The
+ * message says what to do instead — the current holder revokes, and then the claim succeeds — which
+ * is the only remedy anyway.
+ */
+async function assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils) {
+    const conflict = await getDomainVerificationService(container)
+        .findConflictingScope(variant.scopeType, scopeId, domain);
+    if (!conflict)
+        return;
+    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
+        context: {
+            code: 'SSO_DOMAIN_VERIFIED_ELSEWHERE',
+            reason: 'sso_domain_verified_elsewhere',
+            message: 'This domain is already verified for another scope. A domain routes sign-ins to exactly one '
+                + 'identity provider, so it must be revoked where it is held before it can be claimed here.',
+            domain,
+        },
+    });
+}
+// ════════════════════════════════════════════════════════════════════
+// claimDomain
+// ════════════════════════════════════════════════════════════════════
+function createClaimDomainFactory(variant) {
+    const factory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: variant.resourceType,
+            operationIdentifier: SsoConfig_Operations.CLAIM_DOMAIN,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: `${variant.resourceType}.claimDomain`,
+        handlers: {
+            prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);
+                await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);
+                const plan = getDomainVerificationService(container).planDomainClaim(domains, domain);
+                putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext), {
+                    domain,
+                    status: DomainVerificationStatus.PENDING,
+                    dnsName: plan.dnsName,
+                    dnsRecordValue: plan.dnsRecordValue,
+                });
+                // The ONLY key returned. The core UPDATE `$set`s what it is given, so returning the whole
+                // row here would re-write every other block from a pre-image this handler never validated.
+                return { domains: plan.domains };
+            },
+            postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) => takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext)) ?? updatedRow,
+        },
+    });
+    return factory;
+}
+// ════════════════════════════════════════════════════════════════════
+// verifyDomain
+// ════════════════════════════════════════════════════════════════════
+function createVerifyDomainFactory(variant) {
+    const factory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: variant.resourceType,
+            operationIdentifier: SsoConfig_Operations.VERIFY_DOMAIN,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: `${variant.resourceType}.verifyDomain`,
+        handlers: {
+            prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);
+                const service = getDomainVerificationService(container);
+                const expectedToken = service.getVerificationToken(domains, domain);
+                if (!expectedToken) {
+                    // A claim mints the nonce, so verifying without one is not a failed check — it is a
+                    // request for a challenge that was never raised. Saying so is what stops an operator
+                    // publishing a record and waiting for a verification that can never pass.
+                    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
+                        context: {
+                            code: 'SSO_DOMAIN_NOT_CLAIMED',
+                            reason: 'sso_domain_not_claimed',
+                            message: 'No verification challenge exists for this domain in this scope. Claim it first.',
+                            domain,
+                        },
+                    });
+                }
+                // Re-checked HERE, not only at claim: a claim takes no lock, so another scope may have
+                // completed its own verification since. This is the write that confers routing authority
+                // and therefore the one that must be exclusive.
+                await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);
+                const { verified, recordsFound } = await service.checkDomainChallenge(domain, expectedToken);
+                putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext), {
+                    domain,
+                    status: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,
+                    dnsName: service.verificationDnsName(domain),
+                    dnsRecordsFound: recordsFound,
+                });
+                return { domains: service.planVerificationOutcome(domains, domain, verified) };
+            },
+            postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) => takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext)) ?? updatedRow,
+        },
+    });
+    return factory;
+}
+// ════════════════════════════════════════════════════════════════════
+// revokeDomain
+// ════════════════════════════════════════════════════════════════════
+function createRevokeDomainFactory(variant) {
+    const factory = (_resourcesRegistryService, container) => createResourceCustomServiceImplementation({
+        operationPath: {
+            resourceIdentifier: variant.resourceType,
+            operationIdentifier: SsoConfig_Operations.REVOKE_DOMAIN,
+            variantType: ResourceOperationVariantType.API_CALL,
+            isOperationDefault: true,
+        },
+        debugLabel: `${variant.resourceType}.revokeDomain`,
+        handlers: {
+            prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
+                const { domain, domains } = resolveDomainRequest(variant, input, executionContext, utils);
+                const isClaimed = domains.verifiedDomains.includes(domain)
+                    || domains.domainVerificationStatus?.[domain] !== undefined
+                    || domains.ssoEnabledDomains.includes(domain);
+                if (!isClaimed) {
+                    throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+                        context: {
+                            code: 'SSO_DOMAIN_NOT_CLAIMED',
+                            reason: 'sso_domain_not_claimed',
+                            message: 'This scope holds no claim on that domain, so there is nothing to revoke.',
+                            domain,
+                        },
+                    });
+                }
+                putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext), {
+                    domain,
+                    revoked: true,
+                });
+                /*
+                 * ─── Sessions already routed by this domain are NOT terminated, and that is a decision ──
+                 *
+                 * "Revoke the domain" reads like "cut the sessions", and it must not mean that. Domain
+                 * routing decides where a NEW sign-in is sent; it is not a credential and confers no
+                 * standing — `DomainOrgLookupResult` says so explicitly, and every reader treats the
+                 * scope it returns as a hint that may only TIGHTEN an enforcement decision. So a session
+                 * established while the domain was verified was established by an identity provider that
+                 * really did authenticate that person; nothing about it becomes false when the routing
+                 * hint is withdrawn.
+                 *
+                 * Ending sessions is a different control with its own doors (member suspension, user
+                 * deactivation, the session-version fence). Folding it in here would make revocation —
+                 * the ordinary step in handing a domain to another scope — a mass logout of people whose
+                 * standing has not changed.
+                 */
+                return { domains: getDomainVerificationService(container).planDomainRevocation(domains, domain) };
+            },
+            postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) => takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext)) ?? updatedRow,
+        },
+    });
+    return factory;
+}
+export function createSsoConfigDomainVerificationFactories() {
+    return SSO_CONFIG_SCOPE_VARIANTS.flatMap((variant) => [
+        createClaimDomainFactory(variant),
+        createVerifyDomainFactory(variant),
+        createRevokeDomainFactory(variant),
+    ]);
+}
+//# sourceMappingURL=sso-config-domain-verification.custom-impl.backend.service.js.map

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAiBpH,MAAM,yBAAyB,GAAqC;IAClE;QACE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;QACtD,SAAS,EAAE,aAAa,CAAC,YAAY;QACrC,UAAU,EAAE,gBAAgB;KAC7B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;QACrD,SAAS,EAAE,aAAa,CAAC,WAAW;QACpC,UAAU,EAAE,eAAe;KAC5B;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiE,CAAC;AAEjG;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,YAA8B,EAAE,SAAiB,EAAE,gBAAuC;IAC3G,OAAO,GAAG,YAAY,IAAI,SAAS,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAA8B;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,sBAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,OAA8B,EAC9B,KAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,SAAS,GAAI,KAA0C,EAAE,MAAM,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,4DAA4D;aACtE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAsE,CAAC;IACnG,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,iEAAiE;gBAC1E,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,4BAA4B,CAAC,SAAoB;IACxD,OAAO,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,4BAA4B,CACzC,SAAoB,EACpB,OAA8B,EAC9B,OAAe,EACf,MAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,SAAS,CAAC;SAC3D,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QACxE,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,+BAA+B;YACvC,OAAO,EACL,6FAA6F;kBAC3F,0FAA0F;YAC9F,MAAM;SACP;KACF,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,cAAc;AACd,uEAAuE;AAEvE,SAAS,wBAAwB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,YAAY;YACtD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,cAAc;QACjD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,IAAI,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAEtF,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE;oBAC/F,MAAM;oBACN,MAAM,EAAE,wBAAwB,CAAC,OAAO;oBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC,CAAC,CAAC;gBAEH,0FAA0F;gBAC1F,2FAA2F;gBAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SAClH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;gBAExD,MAAM,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACpE,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,oFAAoF;oBACpF,qFAAqF;oBACrF,0EAA0E;oBAC1E,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;wBACxE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,iFAAiF;4BAC1F,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,uFAAuF;gBACvF,yFAAyF;gBACzF,gDAAgD;gBAChD,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAE7F,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;oBACtF,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAC5C,eAAe,EAAE,YAAY;iBAC9B,CAAC,CAAC;gBAEH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;uBACrD,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS;uBACxD,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACzE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,0EAA0E;4BACnF,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBAEH;;;;;;;;;;;;;;;mBAeG;gBACH,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpG,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,0CAA0C;IACxD,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,wBAAwB,CAAC,OAAO,CAAC;QACjC,yBAAyB,CAAC,OAAO,CAAC;QAClC,yBAAyB,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SSO Config — domain-ownership operations (#424)\n *\n * Three public operations that turn enterprise domain routing from an out-of-band database write\n * into a self-service admin flow:\n *\n *   claimDomain   → mints a DNS-TXT challenge, records the domain as `pending`, returns the record\n *   verifyDomain  → resolves the record, records `verified` or `failed`\n *   revokeDomain  → removes the claim, its status, its nonce and its `ssoEnabledDomains` entry\n *\n * ## Why PREFIX, and not OVERRIDE_ALL\n *\n * Each handler computes the new `domains` block and returns it; the framework's own core UPDATE\n * persists it. `OVERRIDE_ALL` returns before the post-operation lane, so it emits NO\n * `RESOURCE_OPERATION_PERFORMED` audit event — and the audit row is the control that makes a\n * privileged configuration change with cross-tenant reach accountable. An operation that granted a\n * tenant SSO routing authority and left no trail would be strictly worse than the database write it\n * replaces, which at least happens where a DBA can see it.\n *\n * ## Where the domain-ownership rules live\n *\n * In `DomainVerificationBackendService`, as pure planners. This file is the door: it resolves the\n * scope, enforces the refusals, and hands the plan to the framework. Nothing here re-implements\n * what a claim or a revocation means.\n */\n\nimport {\n  AuthScopeType,\n  CoreResourceType,\n  DomainVerificationStatus,\n  ErrorType,\n  ResourceOperationVariantType,\n  SsoConfig_Operations,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type {\n  DomainVerificationBackendService,\n  SsoConfigDomains,\n} from '~wildo-backend-lib/security/authentications/services/admin-config/domain-verification.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n// ── The two scope variants, and how each names its scope ─────────────\n\ninterface SsoConfigScopeVariant {\n  readonly resourceType: CoreResourceType;\n  readonly scopeType: AuthScopeType;\n  readonly scopeField: 'organizationId' | 'applicationId';\n}\n\nconst SSO_CONFIG_SCOPE_VARIANTS: readonly SsoConfigScopeVariant[] = [\n  {\n    resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n    scopeType: AuthScopeType.ORGANIZATION,\n    scopeField: 'organizationId',\n  },\n  {\n    resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,\n    scopeType: AuthScopeType.APPLICATION,\n    scopeField: 'applicationId',\n  },\n];\n\n/**\n * Carries the two values a response needs that the persisted row does not hold, from the PREFIX\n * that computed them to the POSTFIX that shapes the reply.\n *\n * Bounded on purpose. The precedent bridges in this tree (`ROTATE_BRIDGE_BY_TARGET_ID`) delete\n * their entry in the postfix and rely on the postfix always running; a core UPDATE that throws\n * between the two leaks one entry forever. Expiring on write costs one `Date.now()` per call and\n * removes the question.\n */\nconst RESPONSE_BRIDGE_TTL_MS = 60_000;\nconst RESPONSE_BRIDGE = new Map<string, { value: Record<string, unknown>; expiresAt: number }>();\n\n/**\n * Keyed on the REQUEST, not on the row.\n *\n * The postfix receives the persisted row and the execution context — never the request body — so it\n * cannot re-derive which domain the call was about. `correlationId` is minted per request and is\n * the same value in both handlers, which makes the hand-off exact: two admins claiming two domains\n * on the same configuration row at the same instant cannot read each other's response.\n */\nfunction bridgeKey(resourceType: CoreResourceType, operation: string, executionContext: ExecutionContext<any>): string {\n  return `${resourceType}|${operation}|${executionContext.correlationId}`;\n}\n\nfunction putBridged(key: string, value: Record<string, unknown>): void {\n  const now = Date.now();\n  for (const [existingKey, entry] of RESPONSE_BRIDGE) {\n    if (entry.expiresAt <= now) RESPONSE_BRIDGE.delete(existingKey);\n  }\n  RESPONSE_BRIDGE.set(key, { value, expiresAt: now + RESPONSE_BRIDGE_TTL_MS });\n}\n\nfunction takeBridged(key: string): Record<string, unknown> | undefined {\n  const entry = RESPONSE_BRIDGE.get(key);\n  RESPONSE_BRIDGE.delete(key);\n  if (!entry || entry.expiresAt <= Date.now()) return undefined;\n  return entry.value;\n}\n\n// ── Shared request resolution ────────────────────────────────────────\n\ninterface ResolvedDomainRequest {\n  readonly domain: string;\n  readonly scopeId: string;\n  readonly domains: SsoConfigDomains;\n}\n\n/**\n * The row being updated, its scope id, and the normalised domain.\n *\n * `utils.currentObject` is the pre-image the framework already fetched for this UPDATE, so nothing\n * here re-reads the config. The domain is lowercased HERE, once, because every stored map is keyed\n * on the lowercase form and a second normalisation site is a second place for the two to disagree.\n */\nfunction resolveDomainRequest(\n  variant: SsoConfigScopeVariant,\n  input: unknown,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): ResolvedDomainRequest {\n  const rawDomain = (input as { domain?: unknown } | undefined)?.domain;\n  if (typeof rawDomain !== 'string' || rawDomain.trim().length === 0) {\n    throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n      context: {\n        code: 'SSO_DOMAIN_REQUIRED',\n        reason: 'sso_domain_required',\n        message: 'Provide `domain`: the DNS hostname this scope is claiming.',\n      },\n    });\n  }\n\n  const currentObject = utils.currentObject as (SsoConfigBase & Record<string, unknown>) | undefined;\n  const scopeId = currentObject?.[variant.scopeField];\n  if (!currentObject?.domains || typeof scopeId !== 'string' || scopeId.length === 0) {\n    // The row is addressed by its scope (a one-to-one composition), so a missing scope id means the\n    // framework could not resolve the singleton — never that the caller addressed someone else.\n    throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n      context: {\n        code: 'SSO_CONFIG_SCOPE_UNRESOLVED',\n        reason: 'sso_config_scope_unresolved',\n        message: 'The SSO configuration row for this scope could not be resolved.',\n        resourceType: variant.resourceType,\n      },\n    });\n  }\n\n  return { domain: rawDomain.trim().toLowerCase(), scopeId, domains: currentObject.domains };\n}\n\nfunction getDomainVerificationService(container: Container): DomainVerificationBackendService {\n  return container.get<DomainVerificationBackendService>(SAAS_SERVICE_TYPES.DomainVerificationService);\n}\n\n/**\n * Refuse when another scope already holds this domain VERIFIED.\n *\n * Run at CLAIM as a helpful early refusal, and again at VERIFY because that is the gate that\n * matters: a claim is not a lock, so another scope can complete its own verification in between.\n *\n * **The holder is deliberately not named.** Telling one tenant which other tenant holds a domain\n * discloses a customer's configuration to a stranger who supplied nothing but a hostname. The\n * message says what to do instead — the current holder revokes, and then the claim succeeds — which\n * is the only remedy anyway.\n */\nasync function assertDomainNotHeldElsewhere(\n  container: Container,\n  variant: SsoConfigScopeVariant,\n  scopeId: string,\n  domain: string,\n  executionContext: ExecutionContext<any>,\n  utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<void> {\n  const conflict = await getDomainVerificationService(container)\n    .findConflictingScope(variant.scopeType, scopeId, domain);\n  if (!conflict) return;\n\n  throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n    context: {\n      code: 'SSO_DOMAIN_VERIFIED_ELSEWHERE',\n      reason: 'sso_domain_verified_elsewhere',\n      message:\n        'This domain is already verified for another scope. A domain routes sign-ins to exactly one '\n        + 'identity provider, so it must be revoked where it is held before it can be claimed here.',\n      domain,\n    },\n  });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// claimDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createClaimDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: variant.resourceType,\n        operationIdentifier: SsoConfig_Operations.CLAIM_DOMAIN,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: `${variant.resourceType}.claimDomain`,\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n          await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n          const plan = getDomainVerificationService(container).planDomainClaim(domains, domain);\n\n          putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext), {\n            domain,\n            status: DomainVerificationStatus.PENDING,\n            dnsName: plan.dnsName,\n            dnsRecordValue: plan.dnsRecordValue,\n          });\n\n          // The ONLY key returned. The core UPDATE `$set`s what it is given, so returning the whole\n          // row here would re-write every other block from a pre-image this handler never validated.\n          return { domains: plan.domains };\n        },\n        postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n          takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext)) ?? updatedRow,\n      },\n    });\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// verifyDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createVerifyDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: variant.resourceType,\n        operationIdentifier: SsoConfig_Operations.VERIFY_DOMAIN,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: `${variant.resourceType}.verifyDomain`,\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n          const service = getDomainVerificationService(container);\n\n          const expectedToken = service.getVerificationToken(domains, domain);\n          if (!expectedToken) {\n            // A claim mints the nonce, so verifying without one is not a failed check — it is a\n            // request for a challenge that was never raised. Saying so is what stops an operator\n            // publishing a record and waiting for a verification that can never pass.\n            throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n              context: {\n                code: 'SSO_DOMAIN_NOT_CLAIMED',\n                reason: 'sso_domain_not_claimed',\n                message: 'No verification challenge exists for this domain in this scope. Claim it first.',\n                domain,\n              },\n            });\n          }\n\n          // Re-checked HERE, not only at claim: a claim takes no lock, so another scope may have\n          // completed its own verification since. This is the write that confers routing authority\n          // and therefore the one that must be exclusive.\n          await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n          const { verified, recordsFound } = await service.checkDomainChallenge(domain, expectedToken);\n\n          putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext), {\n            domain,\n            status: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n            dnsName: service.verificationDnsName(domain),\n            dnsRecordsFound: recordsFound,\n          });\n\n          return { domains: service.planVerificationOutcome(domains, domain, verified) };\n        },\n        postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n          takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext)) ?? updatedRow,\n      },\n    });\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// revokeDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createRevokeDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n  const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n    createResourceCustomServiceImplementation({\n      operationPath: {\n        resourceIdentifier: variant.resourceType,\n        operationIdentifier: SsoConfig_Operations.REVOKE_DOMAIN,\n        variantType: ResourceOperationVariantType.API_CALL,\n        isOperationDefault: true,\n      },\n      debugLabel: `${variant.resourceType}.revokeDomain`,\n      handlers: {\n        prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n          const { domain, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n\n          const isClaimed = domains.verifiedDomains.includes(domain)\n            || domains.domainVerificationStatus?.[domain] !== undefined\n            || domains.ssoEnabledDomains.includes(domain);\n          if (!isClaimed) {\n            throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n              context: {\n                code: 'SSO_DOMAIN_NOT_CLAIMED',\n                reason: 'sso_domain_not_claimed',\n                message: 'This scope holds no claim on that domain, so there is nothing to revoke.',\n                domain,\n              },\n            });\n          }\n\n          putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext), {\n            domain,\n            revoked: true,\n          });\n\n          /*\n           * ─── Sessions already routed by this domain are NOT terminated, and that is a decision ──\n           *\n           * \"Revoke the domain\" reads like \"cut the sessions\", and it must not mean that. Domain\n           * routing decides where a NEW sign-in is sent; it is not a credential and confers no\n           * standing — `DomainOrgLookupResult` says so explicitly, and every reader treats the\n           * scope it returns as a hint that may only TIGHTEN an enforcement decision. So a session\n           * established while the domain was verified was established by an identity provider that\n           * really did authenticate that person; nothing about it becomes false when the routing\n           * hint is withdrawn.\n           *\n           * Ending sessions is a different control with its own doors (member suspension, user\n           * deactivation, the session-version fence). Folding it in here would make revocation —\n           * the ordinary step in handing a domain to another scope — a mass logout of people whose\n           * standing has not changed.\n           */\n          return { domains: getDomainVerificationService(container).planDomainRevocation(domains, domain) };\n        },\n        postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n          takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext)) ?? updatedRow,\n      },\n    });\n\n  return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\nexport function createSsoConfigDomainVerificationFactories(): ResourceCustomServiceImplementationFactory[] {\n  return SSO_CONFIG_SCOPE_VARIANTS.flatMap((variant) => [\n    createClaimDomainFactory(variant),\n    createVerifyDomainFactory(variant),\n    createRevokeDomainFactory(variant),\n  ]);\n}\n"]}

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts

@@ -9,9 +9,10 @@
  *                   socialCredentialOverrides (P3): the `.isWriteOnlySecret()`
  *                   clientSecret (round-tripped as the `••••••••` mask) and the
  *                   `.isBackendOnly()` signedJwt* ids (never sent to the frontend)
- * Domain add/verify/remove operations are deliberately absent until a real
- * DomainVerificationBackendService-backed public workflow exists. Placeholder
- * 200 responses must never be registered as externally usable operations.
+ * Domain claim / verify / revoke now EXIST, backed by `DomainVerificationBackendService`, and live
+ * in `sso-config-domain-verification.custom-impl.backend.service.ts` (#424). The rule that kept them
+ * out of this file still stands and is what they were held to: a placeholder 200 must never be
+ * registered as an externally usable operation.
  */
 import { type ResourceCustomServiceImplementationFactory } from '../../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend';
 export declare function createSsoConfigUpdateFactories(): ResourceCustomServiceImplementationFactory[];

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAQH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAcpH,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAiE7F"}
+{"version":3,"file":"sso-config.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAcpH,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAiE7F"}

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js

@@ -9,9 +9,10 @@
  *                   socialCredentialOverrides (P3): the `.isWriteOnlySecret()`
  *                   clientSecret (round-tripped as the `••••••••` mask) and the
  *                   `.isBackendOnly()` signedJwt* ids (never sent to the frontend)
- * Domain add/verify/remove operations are deliberately absent until a real
- * DomainVerificationBackendService-backed public workflow exists. Placeholder
- * 200 responses must never be registered as externally usable operations.
+ * Domain claim / verify / revoke now EXIST, backed by `DomainVerificationBackendService`, and live
+ * in `sso-config-domain-verification.custom-impl.backend.service.ts` (#424). The rule that kept them
+ * out of this file still stands and is what they were held to: a placeholder 200 must never be
+ * registered as an externally usable operation.
  */
 import { CoreResourceOperation, CoreResourceType, ResourceOperationVariantType, WRITE_ONLY_SECRET_MASK, } from '@wildo-ai/saas-models';
 import { createResourceCustomServiceImplementation, } from '../../../../base-classes/services/services/resource-operation-custom-implementation.factory.backend.js';

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,yEAAyE;AAEzE,MAAM,6BAA6B,GAAG;IACpC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,sBAAsB;CAC/B,CAAC;AAEX,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,8DAA8D;oBAC9D,iFAAiF;oBACjF,8EAA8E;oBAC9E,8EAA8E;oBAC9E,kEAAkE;oBAClE,mFAAmF;oBACnF,6EAA6E;oBAC7E,mFAAmF;oBACnF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,mFAAmF;wBACnF,EAAE;wBACF,8EAA8E;wBAC9E,+EAA+E;wBAC/E,mEAAmE;wBACnE,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gFAAgF;wBAChF,2EAA2E;wBAC3E,6EAA6E;wBAC7E,wCAAwC;wBACxC,EAAE;wBACF,+EAA+E;wBAC/E,iFAAiF;wBACjF,mCAAmC;wBACnC,IAAI,KAAK,EAAE,yBAAyB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;4BACvF,MAAM,QAAQ,GAAI,KAAK,CAAC,aAAqB,EAAE,yBAAyB,IAAI,EAAE,CAAC;4BAC/E,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CACnE,CAAC,QAAa,EAAE,EAAE;gCAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACnD,CAAC;gCACF,IAAI,CAAC,KAAK;oCAAE,OAAO,QAAQ,CAAC;gCAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,sBAAsB,EAAE,CAAC;oCAC3E,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gCAC3C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oCACnD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gCAC/C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;oCACrD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;gCACjD,CAAC;gCACD,OAAO,MAAM,CAAC;4BAChB,CAAC,CACF,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SSO Config Custom Implementations\n *\n * Implements the internal UPDATE path on SSO config polymorphic variants\n * (ORG + APP).\n *\n * Patterns:\n *   UPDATE        → PREFIX_CORE_OPERATIONS  — preserves per-override secret fields in\n *                   socialCredentialOverrides (P3): the `.isWriteOnlySecret()`\n *                   clientSecret (round-tripped as the `••••••••` mask) and the\n *                   `.isBackendOnly()` signedJwt* ids (never sent to the frontend)\n * Domain add/verify/remove operations are deliberately absent until a real\n * DomainVerificationBackendService-backed public workflow exists. Placeholder\n * 200 responses must never be registered as externally usable operations.\n */\n\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n  WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n// ── SSO config polymorphic variant types ──────────────────────────────\n\nconst AUTH_SSO_CONFIG_VARIANT_TYPES = [\n  CoreResourceType.ORGANIZATION_SSO_CONFIG,\n  CoreResourceType.APPLICATION_SSO_CONFIG,\n] as const;\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConfigUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONFIG_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.UPDATE,\n          // INTERNAL_CALL — MUST match the SSO-config UPDATE variant in\n          // `sso-config.shared.resources-config.schemas.ts`. The custom-impl registry keys\n          // registrations on the FULL operation path (variantType included), so if this\n          // drifts from the config variant the dispatch never finds this PREFIX and the\n          // per-override write-only secrets (`clientSecret` / signedJwt* on\n          // socialCredentialOverrides) are wiped on every update. Moved from REPOSITORY_ONLY\n          // in lockstep with the config change that made `saveSSOConfig`'s `.update()`\n          // resolvable via `getServiceOperationPathDefault` (which rejects REPOSITORY_ONLY).\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n            // P3: Preserve per-override secret fields for socialCredentialOverrides on UPDATE.\n            //\n            // Problem: the secret fields never round-trip a usable value from the client.\n            // `clientSecret` is `.isWriteOnlySecret()` — the client renders the `••••••••`\n            // mask and saves it back; `signedJwtKeyId` / `signedJwtTeamId` are\n            // `.isBackendOnly()` — stripped from READ responses entirely, so the client\n            // sends them absent. Either way, the repository UPDATE replaces the WHOLE\n            // `socialCredentialOverrides` array via `$set` (no deep merge), so without this\n            // handler the stored secrets are permanently lost. The framework's central\n            // write-only-secret sentinel-strip cannot rescue them either — it only helps\n            // TOP-LEVEL fields, not array elements.\n            //\n            // Solution: match each incoming override to the existing record by providerRef\n            // and re-inject any secret that arrived absent or as the `••••••••` mask, BEFORE\n            // the central sentinel-strip runs.\n            if (input?.socialCredentialOverrides && Array.isArray(input.socialCredentialOverrides)) {\n              const existing = (utils.currentObject as any)?.socialCredentialOverrides || [];\n              input.socialCredentialOverrides = input.socialCredentialOverrides.map(\n                (override: any) => {\n                  const match = existing.find(\n                    (e: any) => e.providerRef === override.providerRef,\n                  );\n                  if (!match) return override;\n                  const merged = { ...override };\n                  if (!merged.clientSecret || merged.clientSecret === WRITE_ONLY_SECRET_MASK) {\n                    merged.clientSecret = match.clientSecret;\n                  }\n                  if (!merged.signedJwtKeyId && match.signedJwtKeyId) {\n                    merged.signedJwtKeyId = match.signedJwtKeyId;\n                  }\n                  if (!merged.signedJwtTeamId && match.signedJwtTeamId) {\n                    merged.signedJwtTeamId = match.signedJwtTeamId;\n                  }\n                  return merged;\n                },\n              );\n            }\n            return input;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n"]}
+{"version":3,"file":"sso-config.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,yEAAyE;AAEzE,MAAM,6BAA6B,GAAG;IACpC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,sBAAsB;CAC/B,CAAC;AAEX,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,8DAA8D;oBAC9D,iFAAiF;oBACjF,8EAA8E;oBAC9E,8EAA8E;oBAC9E,kEAAkE;oBAClE,mFAAmF;oBACnF,6EAA6E;oBAC7E,mFAAmF;oBACnF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,mFAAmF;wBACnF,EAAE;wBACF,8EAA8E;wBAC9E,+EAA+E;wBAC/E,mEAAmE;wBACnE,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gFAAgF;wBAChF,2EAA2E;wBAC3E,6EAA6E;wBAC7E,wCAAwC;wBACxC,EAAE;wBACF,+EAA+E;wBAC/E,iFAAiF;wBACjF,mCAAmC;wBACnC,IAAI,KAAK,EAAE,yBAAyB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;4BACvF,MAAM,QAAQ,GAAI,KAAK,CAAC,aAAqB,EAAE,yBAAyB,IAAI,EAAE,CAAC;4BAC/E,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CACnE,CAAC,QAAa,EAAE,EAAE;gCAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACnD,CAAC;gCACF,IAAI,CAAC,KAAK;oCAAE,OAAO,QAAQ,CAAC;gCAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,sBAAsB,EAAE,CAAC;oCAC3E,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gCAC3C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oCACnD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gCAC/C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;oCACrD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;gCACjD,CAAC;gCACD,OAAO,MAAM,CAAC;4BAChB,CAAC,CACF,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * SSO Config Custom Implementations\n *\n * Implements the internal UPDATE path on SSO config polymorphic variants\n * (ORG + APP).\n *\n * Patterns:\n *   UPDATE        → PREFIX_CORE_OPERATIONS  — preserves per-override secret fields in\n *                   socialCredentialOverrides (P3): the `.isWriteOnlySecret()`\n *                   clientSecret (round-tripped as the `••••••••` mask) and the\n *                   `.isBackendOnly()` signedJwt* ids (never sent to the frontend)\n * Domain claim / verify / revoke now EXIST, backed by `DomainVerificationBackendService`, and live\n * in `sso-config-domain-verification.custom-impl.backend.service.ts` (#424). The rule that kept them\n * out of this file still stands and is what they were held to: a placeholder 200 must never be\n * registered as an externally usable operation.\n */\n\nimport {\n  CoreResourceOperation,\n  CoreResourceType,\n  ResourceOperationVariantType,\n  WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport {\n  createResourceCustomServiceImplementation,\n  type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n// ── SSO config polymorphic variant types ──────────────────────────────\n\nconst AUTH_SSO_CONFIG_VARIANT_TYPES = [\n  CoreResourceType.ORGANIZATION_SSO_CONFIG,\n  CoreResourceType.APPLICATION_SSO_CONFIG,\n] as const;\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConfigUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n  return AUTH_SSO_CONFIG_VARIANT_TYPES.map((variantResourceType) => {\n    const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n      return createResourceCustomServiceImplementation({\n        operationPath: {\n          resourceIdentifier: variantResourceType,\n          operationIdentifier: CoreResourceOperation.UPDATE,\n          // INTERNAL_CALL — MUST match the SSO-config UPDATE variant in\n          // `sso-config.shared.resources-config.schemas.ts`. The custom-impl registry keys\n          // registrations on the FULL operation path (variantType included), so if this\n          // drifts from the config variant the dispatch never finds this PREFIX and the\n          // per-override write-only secrets (`clientSecret` / signedJwt* on\n          // socialCredentialOverrides) are wiped on every update. Moved from REPOSITORY_ONLY\n          // in lockstep with the config change that made `saveSSOConfig`'s `.update()`\n          // resolvable via `getServiceOperationPathDefault` (which rejects REPOSITORY_ONLY).\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isOperationDefault: true,\n        },\n        handlers: {\n          prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n            // P3: Preserve per-override secret fields for socialCredentialOverrides on UPDATE.\n            //\n            // Problem: the secret fields never round-trip a usable value from the client.\n            // `clientSecret` is `.isWriteOnlySecret()` — the client renders the `••••••••`\n            // mask and saves it back; `signedJwtKeyId` / `signedJwtTeamId` are\n            // `.isBackendOnly()` — stripped from READ responses entirely, so the client\n            // sends them absent. Either way, the repository UPDATE replaces the WHOLE\n            // `socialCredentialOverrides` array via `$set` (no deep merge), so without this\n            // handler the stored secrets are permanently lost. The framework's central\n            // write-only-secret sentinel-strip cannot rescue them either — it only helps\n            // TOP-LEVEL fields, not array elements.\n            //\n            // Solution: match each incoming override to the existing record by providerRef\n            // and re-inject any secret that arrived absent or as the `••••••••` mask, BEFORE\n            // the central sentinel-strip runs.\n            if (input?.socialCredentialOverrides && Array.isArray(input.socialCredentialOverrides)) {\n              const existing = (utils.currentObject as any)?.socialCredentialOverrides || [];\n              input.socialCredentialOverrides = input.socialCredentialOverrides.map(\n                (override: any) => {\n                  const match = existing.find(\n                    (e: any) => e.providerRef === override.providerRef,\n                  );\n                  if (!match) return override;\n                  const merged = { ...override };\n                  if (!merged.clientSecret || merged.clientSecret === WRITE_ONLY_SECRET_MASK) {\n                    merged.clientSecret = match.clientSecret;\n                  }\n                  if (!merged.signedJwtKeyId && match.signedJwtKeyId) {\n                    merged.signedJwtKeyId = match.signedJwtKeyId;\n                  }\n                  if (!merged.signedJwtTeamId && match.signedJwtTeamId) {\n                    merged.signedJwtTeamId = match.signedJwtTeamId;\n                  }\n                  return merged;\n                },\n              );\n            }\n            return input;\n          },\n        },\n      });\n    };\n\n    return factory as unknown as ResourceCustomServiceImplementationFactory;\n  });\n}\n"]}

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts

@@ -136,6 +136,41 @@ export declare class OAuthProviderTokenBackendService {
      * throws for a bad token — only unexpected infra failures propagate.
      */
     revokeRefreshToken(refreshToken: string): Promise<void>;
+    /**
+     * F4 per-org SIEM routing for a provider event whose only trustworthy tenant anchor is the
+     * TOKEN-BOUND SUBJECT.
+     *
+     * Every emit on this service happens at a token MINT or ROTATION, where there is no authenticated
+     * request execution context — the caller has just presented a credential, and the token it is about
+     * to receive is not itself an authenticated request. So the routing org can never come from the
+     * request, and passing nothing left the provider's most sensitive events (a delegated grant, a
+     * detected credential theft) reaching the DB store and the app-level sinks but never a customer's
+     * own security sink.
+     *
+     * The subject is the answer, and only because of WHERE it comes from: each caller passes a user id
+     * the SERVER resolved — off the stored authorization code, off the stored refresh-token family, or
+     * off a token this process just minted and verified — never a value the caller wrote down.
+     * `resolveActiveMemberOrgIds` then reads the ORGANIZATION_MEMBERS junction as SYSTEM with a filter
+     * built entirely from that id plus a constant status, and brands the result `VerifiedOrgId[]`, so no
+     * caller input reaches the routing decision at any point in the chain. That provenance is the whole
+     * requirement — routing on an unverified org is the 2026-07-09 cross-tenant leak, and misrouting a
+     * delegated grant is strictly worse than not routing it.
+     *
+     * Resolved through the container rather than the constructor to match this service's lazy-dependency
+     * posture (the OAuth provider graph is reachable during startup; see the class JSDoc).
+     *
+     * NEVER-THROW, for a reason worth stating: each caller now resolves this BEFORE its emit, so a
+     * throw here would suppress the audit event entirely — turning a per-org DISPATCH failure into the
+     * loss of the authoritative record, which is the opposite of the fail-closed posture. Routing is
+     * best-effort; the DB store and the Layer-2 sink are not. `resolveActiveMemberOrgIds` is itself
+     * never-throw, so the only failure this adds is an unresolvable `SystemAccessService` binding.
+     *
+     * Returns `[]` when there is no subject to route on or when resolution failed. `[]` and `undefined`
+     * are equivalent at the sink boundary here because the request-EC argument is always `undefined` at
+     * these emit sites, so there is no EC org for `undefined` to fall back to; `[]` is passed because it
+     * states that the question WAS asked and the answer was empty.
+     */
+    private _resolveSubjectRoutingOrgIds;
     /**
      * Build a typed backend error carrying the precise OAuth 2.0 error code in `context.oauthError`
      * so the token-endpoint controller can render the RFC 6749 §5.2 error response body.

package/dist/esm/security/authentications/services/oauth-provider-token.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AA4C7I;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,gCAAgC;IAEH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC;IAGzG,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA+HzH;;;;;;;;OAQG;IACU,2BAA2B,CAAC,OAAO,EAAE;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAiJrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACU,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAsFvL;;;;OAIG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE;;;OAGG;IACH,OAAO,CAAC,WAAW;CAMpB"}
+{"version":3,"file":"oauth-provider-token.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/oauth-provider-token.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAE9G,OAAO,EAAE,gCAAgC,EAAE,MAAM,2FAA2F,CAAC;AA8C7I;;;;;GAKG;AACH,MAAM,WAAW,kCAAkC;IACjD,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,6FAA6F;AAC7F,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,wBAAyB,SAAQ,yBAAyB;IACzE,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBACa,gCAAgC;IAEH,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAJ3B,SAAS,EAAE,SAAS,EACvB,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB,EACtC,YAAY,EAAE,0BAA0B,EACzC,kBAAkB,EAAE,gCAAgC;IAGzG,2BAA2B,CAAC,OAAO,EAAE,kCAAkC,GAAG,OAAO,CAAC,yBAAyB,CAAC;IA+HzH;;;;;;;;OAQG;IACU,2BAA2B,CAAC,OAAO,EAAE;QAChD,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB;;;;;WAKG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAmKrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAwCG;IACU,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA+GvL;;;;OAIG;IACU,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,4BAA4B;IAY1C;;;OAGG;IACH,OAAO,CAAC,WAAW;CAMpB"}