@wildo-ai/saas-backend-lib 1.1.2 → 1.1.3

package/dist/esm/security/authentications/services/utils/auth-user-lookup.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-user-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE7H,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAK1I,OAAO,EACL,oCAAoC,GACrC,MAAM,wCAAwC,CAAC;AAEhD;;;;GAIG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAIe;IACwB;IACd;IAGQ;IACL;IATlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACG,uBAA8D,EAC5E,gBAAyC,EAGjC,iBAAkD,EACvD,mBAA+C;QAN5D,WAAM,GAAN,MAAM,CAAe;QACG,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACvD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,KAAa;QAC5D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,KAAa,EACb,cAA+B;QAE/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAC9B,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAiC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,EAAyB,EAAE,MAAc;QACzE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAkB,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,GAA0B,EAC1B,MAAc,EACd,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,wGAAwG;YACxG,yGAAyG;YACzG,wGAAwG;YACxG,0GAA0G;YAC1G,0GAA0G;YAC1G,wGAAwG;YACxG,sGAAsG;YACtG,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAEvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC/E,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,2FAA2F;YAC3F,gGAAgG;YAChG,kFAAkF;YAClF,+EAA+E;YAC/E,qGAAqG;YACrG,gGAAgG;YAChG,4EAA4E;YAC5E,mDAAmD;YACnD,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAEhC,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,+FAA+F;oBAC/F,yFAAyF;oBACzF,mGAAmG;oBACnG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9E,CAAC;oBACF,IAAI,GAAG,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;wBAC5D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAc,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;4BACvD,cAAc;4BACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;4BACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;yBAC9C,CAAC,CAAC;wBACH,6FAA6F;wBAC7F,kGAAkG;wBAClG,kGAAkG;wBAClG,mGAAmG;wBACnG,oFAAoF;wBACpF,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAChG,CAAC;4BACF,IAAI,YAAY;gCAAE,mBAAmB,GAAG,IAAI,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,+FAA+F;wBAC/F,gGAAgG;wBAChG,6FAA6F;oBAC/F,CAAC;gBACH,CAAC;YACH,CAAC;YAED,6FAA6F;YAC7F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAExE,kGAAkG;YAClG,IAAI,gBAAgC,CAAC;YACrC,IAAI,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;YACvC,IAAI,iBAAiB,GAAG,SAAS,CAAC,cAAc,CAAC;YACjD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;oBACjC,YAAY,EAAE,SAAS;oBACvB,YAAY;oBACZ,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;iBACtD,CAAC,CAAC;gBACH,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;gBAC/C,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAClC,iBAAiB,GAAG,QAAQ,CAAC,cAAc,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,SAAS,CAAC,kBAAoC,CAAC;YACpE,CAAC;YAED,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,mBAAmB;gBAC5C,CAAC,CAAC,mCAAmC,CAAC,gBAAgB,CAAC;gBACvD,CAAC,CAAC,gBAAgB,CAAC;YAErB,OAAO;gBACL,GAAG,SAAS;gBACZ,kBAAkB,EAAE,kBAA8D;gBAClF,SAAS,EAAE,YAAY;gBACvB,cAAc,EAAE,iBAAiB;aAClC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;gBAC7F,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACtC,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAgB,EAChB,OAA2B;QAE3B,OAAO,oCAAoC,CACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAhOY,4BAA4B;IADxC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAG3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCANa,aAAa,YAEO,uBAAuB;GAN9F,4BAA4B,CAgOxC","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { CoreResourceType, UserStatus, resolveAuthConfig, disableDirectoryIncompatibleMethods } from '@wildo-ai/saas-models';\nimport type { User, UserPreferences, UserTypeAuthPolicy, OrgTypeAuthOverrides, AuthMethodsMap } from '@wildo-ai/saas-models';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport {\n  resolveAuthPolicyForOrganizationType,\n} from './auth-policy-resolution.backend.utils';\n\n/**\n * User lookup helpers extracted from controller private methods.\n * Provides email-based lookups for Users and effective auth policy resolution\n * with org override merging (W5.8 / AUTH-14).\n */\n@injectable()\nexport class AuthUserLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    // AUTH-24: resolve per-org directory-management posture (DIRECTORY_PROVISIONING feature + a live SCIM\n    // token) to derive local first-factor credential methods OFF the effective policy for a managed user.\n    @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthUserLookup');\n    this.logger.setDebugTypeLogging('AuthUserLookup', false);\n  }\n\n  /**\n   * Find a user by email address (ACTIVE only).\n   * Returns null if not found — used by password reset which must not leak info.\n   */\n  async findUserByEmail(ec: ExecutionContext<any>, email: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: email.toLowerCase(), status: UserStatus.ACTIVE });\n  }\n\n  /**\n   * Find a user by email address (any status).\n   * Used by registration to check email uniqueness across ALL statuses.\n   */\n  async findAnyUserByEmail(\n    ec: ExecutionContext<any>,\n    email: string,\n    serviceOptions?: ServiceOptions,\n  ): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { email: email.toLowerCase() },\n      serviceOptions,\n    );\n  }\n\n  /**\n   * Look up a user's email for audit/display purposes.\n   * Returns empty string if not found.\n   */\n  async getUserEmail(ec: ExecutionContext<any>, userId: string): Promise<string> {\n    const user = await this.servicesRegistryHandler.read<{ _id: string; email: string }>(CoreResourceType.USERS, ec, { _id: userId });\n    return user?.email ?? '';\n  }\n\n  async findUserById(ec: ExecutionContext<any>, userId: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n  }\n\n  async findUserPreferencesByUserId(ec: ExecutionContext<any>, userId: string): Promise<UserPreferences | null> {\n    return this.servicesRegistryHandler.read<UserPreferences>(CoreResourceType.USER_PREFERENCES, ec, { userId });\n  }\n\n  /**\n   * AUTH-14 / W5.8: Resolve effective auth policy with org override merging.\n   *\n   * 1. Gets the raw UserTypeAuthPolicy from config\n   * 2. Fetches user's active org memberships\n   * 3. For each org, reads the org to get its type\n   * 4. Collects authOverrides from organizationTypes[orgType]\n   * 5. Calls resolveAuthConfig to merge (most-restrictive-wins)\n   * 6. Returns the full UserTypeAuthPolicy with overridable fields merged\n   *\n   * Fields affected by org overrides: authMethodsEnabled, mfaPolicy, passwordPolicy.\n   * All other fields (sessionDurationMinutes, lockoutPolicy, registration, etc.)\n   * come from the raw user-type policy unchanged.\n   */\n  async resolveEffectiveAuthPolicy(\n    // `_ec` is intentionally unused: AUTH-24 moved membership/org/link resolution to the SYSTEM door\n    // (see the body), which builds its own context — a login/session EC carries no trusted org scope.\n    // Kept in the signature for call-site stability and parity with the other lookups on this service.\n    _ec: ExecutionContext<any>,\n    userId: string,\n    userType: string,\n  ): Promise<UserTypeAuthPolicy | null> {\n    const rawPolicy = this.appConfigService.getUserTypeAuthPolicy(userType);\n    if (!rawPolicy) return null;\n\n    try {\n      // Resolve the user's ACTIVE org memberships via the SYSTEM door, NOT an ec-scoped read. A login/session\n      // is globally org-agnostic and its EC carries NO trusted org scope, so an ec-scoped ORGANIZATION_MEMBERS\n      // list surfaces only the user's PRIMARY-org membership and silently MISSES a CROSS-org membership (e.g.\n      // one a SCIM push just added) — which would defeat the user-global closure below (a user password-logs-in\n      // fine because the resolver never sees the managed org they were just provisioned into). See the incident\n      // note in `resolveActiveMemberOrgIds` — the same reason per-org audit routing must read the junction as\n      // system. That canonical resolver (`listAsSystem`, self-referential audit suppressed) is reused here.\n      const activeOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n\n      if (activeOrgIds.length === 0) return rawPolicy;\n\n      const organizationTypes = this.appConfigService.config.organizationTypes ?? {};\n      const orgOverrides: OrgTypeAuthOverrides[] = [];\n      // AUTH-24: also detect whether ANY of the user's ACTIVE orgs is ACTIVELY directory-managed\n      // (DIRECTORY_PROVISIONING feature + a live SCIM token). If so, the effective policy must forbid\n      // local first-factor credentials (PASSWORD / PASSKEY / MAGIC_LINK / SMS_OTP — see\n      // `DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS`) — they bypass the IdP and would\n      // survive deprovisioning. Because this resolves across ALL the user's orgs, ONE managed org disables\n      // them GLOBALLY for the user (the user-global closure); keying on CURRENT posture also covers a\n      // credential set before the org became managed (the activation window). See\n      // `.claude/plans/auth-24-credential-lifecycle.md`.\n      let anyDirectoryManaged = false;\n\n      for (const organizationId of activeOrgIds) {\n        try {\n          // System read: the org is one of the user's memberships resolved as system above, and may be a\n          // CROSS-org the login EC cannot see — so read it the same way. `ORGANIZATIONS` opts into\n          // `systemAccessPolicy.read`; the self-referential auth-policy resolution suppresses its own audit.\n          const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string }>(\n            CoreResourceType.ORGANIZATIONS, organizationId, { suppressSystemAudit: true },\n          );\n          if (org?.type && organizationTypes[org.type]?.authOverrides) {\n            orgOverrides.push(organizationTypes[org.type].authOverrides!);\n          }\n        } catch {\n          // Org read failure is non-fatal — skip this org's overrides\n        }\n        if (!anyDirectoryManaged) {\n          try {\n            const orgIsManaged = await isOrgActivelyDirectoryManaged({\n              organizationId,\n              featureResolution: this.featureResolution,\n              systemAccessService: this.systemAccessService,\n            });\n            // PROVISIONED-ONLY (user decision 2026-07-21): the derivation applies only to a user the IdP\n            // actually PROVISIONED — evidenced by a USER_IDENTITY_LINKS row for THIS org (written by the SCIM\n            // push / SSO-JIT). The owner/admin who joined via local registration/invite has NO link and keeps\n            // a break-glass credential. Aligns Part 1 with Part 3 (reconciliation only fires on the SCIM push,\n            // which also writes the link). See `.claude/plans/auth-24-credential-lifecycle.md`.\n            if (orgIsManaged) {\n              const identityLink = await this.systemAccessService.readAsSystem<{ _id: string }>(\n                CoreResourceType.USER_IDENTITY_LINKS, { userId, organizationId }, { suppressSystemAudit: true },\n              );\n              if (identityLink) anyDirectoryManaged = true;\n            }\n          } catch {\n            // Posture / identity-link read failure is non-fatal for THIS org — leave the flag as-is. Login\n            // must not hard-fail on a transient read; the invite-accept MUTATION path stays the fail-closed\n            // gate for credential CREATION, and reconciliation (AUTH-24 part 3) is the durable backstop.\n          }\n        }\n      }\n\n      // No overrides AND not directory-managed → nothing derived; return the raw user-type policy.\n      if (orgOverrides.length === 0 && !anyDirectoryManaged) return rawPolicy;\n\n      // Base effective config: org-merged (most-restrictive) when overrides exist, else the raw policy.\n      let effectiveMethods: AuthMethodsMap;\n      let effectiveMfa = rawPolicy.mfaPolicy;\n      let effectivePassword = rawPolicy.passwordPolicy;\n      if (orgOverrides.length > 0) {\n        const authConfig = this.appConfigService.config.auth;\n        const resolved = resolveAuthConfig({\n          userTypeAuth: rawPolicy,\n          orgOverrides,\n          orgAuthMethodPolicy: authConfig.orgAuthMethodPolicy,\n          expandableOrgMethods: authConfig.expandableOrgMethods,\n        });\n        effectiveMethods = resolved.authMethodsEnabled;\n        effectiveMfa = resolved.mfaPolicy;\n        effectivePassword = resolved.passwordPolicy;\n      } else {\n        effectiveMethods = rawPolicy.authMethodsEnabled as AuthMethodsMap;\n      }\n\n      // AUTH-24 derivation: posture wins over authored config (same most-restrictive direction as the\n      // org-override merge) — force the local first-factor methods OFF for a directory-managed user.\n      const authMethodsEnabled = anyDirectoryManaged\n        ? disableDirectoryIncompatibleMethods(effectiveMethods)\n        : effectiveMethods;\n\n      return {\n        ...rawPolicy,\n        authMethodsEnabled: authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n        mfaPolicy: effectiveMfa,\n        passwordPolicy: effectivePassword,\n      };\n    } catch (error) {\n      this.logDebug('AUTH-14: Org override resolution failed, falling back to raw user-type policy', {\n        userId: userId.substring(0, 8) + '...',\n        userType,\n        ...projectCaughtErrorLogFields(error),\n      });\n      return rawPolicy;\n    }\n  }\n\n  /**\n   * Org-TYPE-keyed effective auth-policy resolution — PURE (no DB, no EC).\n   *\n   * For surfaces that must know an organization's available auth methods WITHOUT\n   * an authenticated user AND WITHOUT reading the ORGANIZATIONS resource. The\n   * canonical caller is the public invitation-accept screen, which runs under an\n   * unauthenticated `APP_PUBLIC` pre-auth EC that CANNOT read ORGANIZATIONS (its\n   * READ ACL is ORG_MEMBER / super-admin). An earlier org-ID-keyed variant read\n   * ORGANIZATIONS internally and fail-closed silently under that EC, dropping the\n   * org's auth overrides — so this takes the `orgType` the caller has already\n   * resolved via the system-access door and does zero I/O.\n   *\n   * Resolves the effective policy for a hypothetical member of `userType` in an\n   * organization of type `orgType`: `organizationTypes[orgType].authOverrides`\n   * merged through the SAME pure `resolveAuthConfig` core (most-restrictive-wins)\n   * used by the user-keyed path. Single-org, so no multi-org intersection — but the\n   * per-org RESTRICT_ONLY / EXPAND_WITHIN_SET / UNRESTRICTED policy still applies.\n   *\n   * Fail-open to the raw user-type policy when `orgType` is absent or its type\n   * declares no overrides. Returns `null` only when the user type has no policy at\n   * all (unknown user type).\n   */\n  resolveAuthPolicyForOrgType(\n    userType: string,\n    orgType: string | undefined,\n  ): UserTypeAuthPolicy | null {\n    return resolveAuthPolicyForOrganizationType(\n      this.appConfigService.config,\n      userType,\n      orgType,\n      this.appConfigService.getUserTypeAuthPolicy(userType),\n    );\n  }\n}\n"]}
+{"version":3,"file":"auth-user-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/auth-user-lookup.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,iBAAiB,EAAE,mCAAmC,EAAE,MAAM,uBAAuB,CAAC;AAE7H,OAAO,EAAE,6BAA6B,EAAE,MAAM,gFAAgF,CAAC;AAC/H,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,+FAA+F,CAAC;AAK1I,OAAO,EACL,oCAAoC,GACrC,MAAM,wCAAwC,CAAC;AAEhD;;;;GAIG;AAEI,IAAM,4BAA4B,GAAlC,MAAM,4BAA4B;IAIe;IACwB;IACd;IAGQ;IACL;IATlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACG,uBAA8D,EAC5E,gBAAyC,EAGjC,iBAAkD,EACvD,mBAA+C;QAN5D,WAAM,GAAN,MAAM,CAAe;QACG,4BAAuB,GAAvB,uBAAuB,CAAuC;QAC5E,qBAAgB,GAAhB,gBAAgB,CAAyB;QAGjC,sBAAiB,GAAjB,iBAAiB,CAAiC;QACvD,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,KAAa;QAC5D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxI,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,EAAyB,EACzB,KAAa,EACb,cAA+B;QAE/B,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CACtC,gBAAgB,CAAC,KAAK,EACtB,EAAE,EACF,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,EAC9B,cAAc,CACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAiC,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAClI,OAAO,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAyB,EAAE,MAAc;QAC1D,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,EAAyB,EAAE,MAAc;QACzE,OAAO,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAkB,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,0BAA0B;IAC9B,iGAAiG;IACjG,kGAAkG;IAClG,mGAAmG;IACnG,GAA0B,EAC1B,MAAc,EACd,QAAgB;QAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACxE,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,IAAI,CAAC;YACH,wGAAwG;YACxG,yGAAyG;YACzG,wGAAwG;YACxG,0GAA0G;YAC1G,0GAA0G;YAC1G,wGAAwG;YACxG,sGAAsG;YACtG,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAEvF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YAEhD,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;YAC/E,MAAM,YAAY,GAA2B,EAAE,CAAC;YAChD,2FAA2F;YAC3F,gGAAgG;YAChG,kFAAkF;YAClF,+EAA+E;YAC/E,qGAAqG;YACrG,gGAAgG;YAChG,4EAA4E;YAC5E,mDAAmD;YACnD,IAAI,mBAAmB,GAAG,KAAK,CAAC;YAEhC,KAAK,MAAM,cAAc,IAAI,YAAY,EAAE,CAAC;gBAC1C,IAAI,CAAC;oBACH,+FAA+F;oBAC/F,yFAAyF;oBACzF,mGAAmG;oBACnG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACrD,gBAAgB,CAAC,aAAa,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9E,CAAC;oBACF,IAAI,GAAG,EAAE,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;wBAC5D,YAAY,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,aAAc,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,IAAI,CAAC;wBACH,MAAM,YAAY,GAAG,MAAM,6BAA6B,CAAC;4BACvD,cAAc;4BACd,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;4BACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;yBAC9C,CAAC,CAAC;wBACH,6FAA6F;wBAC7F,kGAAkG;wBAClG,kGAAkG;wBAClG,mGAAmG;wBACnG,oFAAoF;wBACpF,IAAI,YAAY,EAAE,CAAC;4BACjB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC9D,gBAAgB,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAChG,CAAC;4BACF,IAAI,YAAY;gCAAE,mBAAmB,GAAG,IAAI,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,+FAA+F;wBAC/F,gGAAgG;wBAChG,6FAA6F;oBAC/F,CAAC;gBACH,CAAC;YACH,CAAC;YAED,6FAA6F;YAC7F,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB;gBAAE,OAAO,SAAS,CAAC;YAExE,kGAAkG;YAClG,IAAI,gBAAgC,CAAC;YACrC,IAAI,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC;YACvC,IAAI,iBAAiB,GAAG,SAAS,CAAC,cAAc,CAAC;YACjD,+FAA+F;YAC/F,8FAA8F;YAC9F,uBAAuB;YACvB,IAAI,eAAe,GAAG,SAAS,CAAC,UAAU,CAAC;YAC3C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC;gBACrD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;oBACjC,YAAY,EAAE,SAAS;oBACvB,YAAY;oBACZ,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;oBACnD,oBAAoB,EAAE,UAAU,CAAC,oBAAoB;iBACtD,CAAC,CAAC;gBACH,gBAAgB,GAAG,QAAQ,CAAC,kBAAkB,CAAC;gBAC/C,YAAY,GAAG,QAAQ,CAAC,SAAS,CAAC;gBAClC,iBAAiB,GAAG,QAAQ,CAAC,cAAc,CAAC;gBAC5C,eAAe,GAAG,QAAQ,CAAC,UAAU,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,gBAAgB,GAAG,SAAS,CAAC,kBAAoC,CAAC;YACpE,CAAC;YAED,gGAAgG;YAChG,+FAA+F;YAC/F,MAAM,kBAAkB,GAAG,mBAAmB;gBAC5C,CAAC,CAAC,mCAAmC,CAAC,gBAAgB,CAAC;gBACvD,CAAC,CAAC,gBAAgB,CAAC;YAErB,OAAO;gBACL,GAAG,SAAS;gBACZ,kBAAkB,EAAE,kBAA8D;gBAClF,SAAS,EAAE,YAAY;gBACvB,cAAc,EAAE,iBAAiB;gBACjC,UAAU,EAAE,eAAe;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,+EAA+E,EAAE;gBAC7F,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK;gBACtC,QAAQ;gBACR,GAAG,2BAA2B,CAAC,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,2BAA2B,CACzB,QAAgB,EAChB,OAA2B;QAE3B,OAAO,oCAAoC,CACzC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAC5B,QAAQ,EACR,OAAO,EACP,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CACtD,CAAC;IACJ,CAAC;CACF,CAAA;AAtOY,4BAA4B;IADxC,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;IAG3C,WAAA,MAAM,CAAC,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;IACnD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCANa,aAAa,YAEO,uBAAuB;GAN9F,4BAA4B,CAsOxC","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\nimport { CoreResourceType, UserStatus, resolveAuthConfig, disableDirectoryIncompatibleMethods } from '@wildo-ai/saas-models';\nimport type { User, UserPreferences, UserTypeAuthPolicy, OrgTypeAuthOverrides, AuthMethodsMap } from '@wildo-ai/saas-models';\nimport { isOrgActivelyDirectoryManaged } from '~wildo-backend-lib/organizations/services/scim-provisioning-gate.backend.utils';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { resolveActiveMemberOrgIds } from '~wildo-backend-lib/security/authentications/services/resolve-active-member-orgs.backend.utils';\nimport type { FeatureResolutionBackendService } from '~wildo-backend-lib/features/services/feature-resolution.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { ServiceOptions } from '~wildo-backend-lib/base-classes/models/repositories.backend.schemas';\nimport {\n  resolveAuthPolicyForOrganizationType,\n} from './auth-policy-resolution.backend.utils';\n\n/**\n * User lookup helpers extracted from controller private methods.\n * Provides email-based lookups for Users and effective auth policy resolution\n * with org override merging (W5.8 / AUTH-14).\n */\n@injectable()\nexport class AuthUserLookupBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n    @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n    // AUTH-24: resolve per-org directory-management posture (DIRECTORY_PROVISIONING feature + a live SCIM\n    // token) to derive local first-factor credential methods OFF the effective policy for a managed user.\n    @inject(SAAS_SERVICE_TYPES.FeatureResolutionService) private readonly featureResolution: FeatureResolutionBackendService,\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('AuthUserLookup');\n    this.logger.setDebugTypeLogging('AuthUserLookup', false);\n  }\n\n  /**\n   * Find a user by email address (ACTIVE only).\n   * Returns null if not found — used by password reset which must not leak info.\n   */\n  async findUserByEmail(ec: ExecutionContext<any>, email: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { email: email.toLowerCase(), status: UserStatus.ACTIVE });\n  }\n\n  /**\n   * Find a user by email address (any status).\n   * Used by registration to check email uniqueness across ALL statuses.\n   */\n  async findAnyUserByEmail(\n    ec: ExecutionContext<any>,\n    email: string,\n    serviceOptions?: ServiceOptions,\n  ): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(\n      CoreResourceType.USERS,\n      ec,\n      { email: email.toLowerCase() },\n      serviceOptions,\n    );\n  }\n\n  /**\n   * Look up a user's email for audit/display purposes.\n   * Returns empty string if not found.\n   */\n  async getUserEmail(ec: ExecutionContext<any>, userId: string): Promise<string> {\n    const user = await this.servicesRegistryHandler.read<{ _id: string; email: string }>(CoreResourceType.USERS, ec, { _id: userId });\n    return user?.email ?? '';\n  }\n\n  async findUserById(ec: ExecutionContext<any>, userId: string): Promise<User | null> {\n    return this.servicesRegistryHandler.read<User>(CoreResourceType.USERS, ec, { _id: userId });\n  }\n\n  async findUserPreferencesByUserId(ec: ExecutionContext<any>, userId: string): Promise<UserPreferences | null> {\n    return this.servicesRegistryHandler.read<UserPreferences>(CoreResourceType.USER_PREFERENCES, ec, { userId });\n  }\n\n  /**\n   * AUTH-14 / W5.8: Resolve effective auth policy with org override merging.\n   *\n   * 1. Gets the raw UserTypeAuthPolicy from config\n   * 2. Fetches user's active org memberships\n   * 3. For each org, reads the org to get its type\n   * 4. Collects authOverrides from organizationTypes[orgType]\n   * 5. Calls resolveAuthConfig to merge (most-restrictive-wins)\n   * 6. Returns the full UserTypeAuthPolicy with overridable fields merged\n   *\n   * Fields affected by org overrides: authMethodsEnabled, mfaPolicy, passwordPolicy.\n   * All other fields (sessionDurationMinutes, lockoutPolicy, registration, etc.)\n   * come from the raw user-type policy unchanged.\n   */\n  async resolveEffectiveAuthPolicy(\n    // `_ec` is intentionally unused: AUTH-24 moved membership/org/link resolution to the SYSTEM door\n    // (see the body), which builds its own context — a login/session EC carries no trusted org scope.\n    // Kept in the signature for call-site stability and parity with the other lookups on this service.\n    _ec: ExecutionContext<any>,\n    userId: string,\n    userType: string,\n  ): Promise<UserTypeAuthPolicy | null> {\n    const rawPolicy = this.appConfigService.getUserTypeAuthPolicy(userType);\n    if (!rawPolicy) return null;\n\n    try {\n      // Resolve the user's ACTIVE org memberships via the SYSTEM door, NOT an ec-scoped read. A login/session\n      // is globally org-agnostic and its EC carries NO trusted org scope, so an ec-scoped ORGANIZATION_MEMBERS\n      // list surfaces only the user's PRIMARY-org membership and silently MISSES a CROSS-org membership (e.g.\n      // one a SCIM push just added) — which would defeat the user-global closure below (a user password-logs-in\n      // fine because the resolver never sees the managed org they were just provisioned into). See the incident\n      // note in `resolveActiveMemberOrgIds` — the same reason per-org audit routing must read the junction as\n      // system. That canonical resolver (`listAsSystem`, self-referential audit suppressed) is reused here.\n      const activeOrgIds = await resolveActiveMemberOrgIds(this.systemAccessService, userId);\n\n      if (activeOrgIds.length === 0) return rawPolicy;\n\n      const organizationTypes = this.appConfigService.config.organizationTypes ?? {};\n      const orgOverrides: OrgTypeAuthOverrides[] = [];\n      // AUTH-24: also detect whether ANY of the user's ACTIVE orgs is ACTIVELY directory-managed\n      // (DIRECTORY_PROVISIONING feature + a live SCIM token). If so, the effective policy must forbid\n      // local first-factor credentials (PASSWORD / PASSKEY / MAGIC_LINK / SMS_OTP — see\n      // `DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS`) — they bypass the IdP and would\n      // survive deprovisioning. Because this resolves across ALL the user's orgs, ONE managed org disables\n      // them GLOBALLY for the user (the user-global closure); keying on CURRENT posture also covers a\n      // credential set before the org became managed (the activation window). See\n      // `.claude/plans/auth-24-credential-lifecycle.md`.\n      let anyDirectoryManaged = false;\n\n      for (const organizationId of activeOrgIds) {\n        try {\n          // System read: the org is one of the user's memberships resolved as system above, and may be a\n          // CROSS-org the login EC cannot see — so read it the same way. `ORGANIZATIONS` opts into\n          // `systemAccessPolicy.read`; the self-referential auth-policy resolution suppresses its own audit.\n          const org = await this.systemAccessService.readAsSystem<{ _id: string; type?: string }>(\n            CoreResourceType.ORGANIZATIONS, organizationId, { suppressSystemAudit: true },\n          );\n          if (org?.type && organizationTypes[org.type]?.authOverrides) {\n            orgOverrides.push(organizationTypes[org.type].authOverrides!);\n          }\n        } catch {\n          // Org read failure is non-fatal — skip this org's overrides\n        }\n        if (!anyDirectoryManaged) {\n          try {\n            const orgIsManaged = await isOrgActivelyDirectoryManaged({\n              organizationId,\n              featureResolution: this.featureResolution,\n              systemAccessService: this.systemAccessService,\n            });\n            // PROVISIONED-ONLY (user decision 2026-07-21): the derivation applies only to a user the IdP\n            // actually PROVISIONED — evidenced by a USER_IDENTITY_LINKS row for THIS org (written by the SCIM\n            // push / SSO-JIT). The owner/admin who joined via local registration/invite has NO link and keeps\n            // a break-glass credential. Aligns Part 1 with Part 3 (reconciliation only fires on the SCIM push,\n            // which also writes the link). See `.claude/plans/auth-24-credential-lifecycle.md`.\n            if (orgIsManaged) {\n              const identityLink = await this.systemAccessService.readAsSystem<{ _id: string }>(\n                CoreResourceType.USER_IDENTITY_LINKS, { userId, organizationId }, { suppressSystemAudit: true },\n              );\n              if (identityLink) anyDirectoryManaged = true;\n            }\n          } catch {\n            // Posture / identity-link read failure is non-fatal for THIS org — leave the flag as-is. Login\n            // must not hard-fail on a transient read; the invite-accept MUTATION path stays the fail-closed\n            // gate for credential CREATION, and reconciliation (AUTH-24 part 3) is the durable backstop.\n          }\n        }\n      }\n\n      // No overrides AND not directory-managed → nothing derived; return the raw user-type policy.\n      if (orgOverrides.length === 0 && !anyDirectoryManaged) return rawPolicy;\n\n      // Base effective config: org-merged (most-restrictive) when overrides exist, else the raw policy.\n      let effectiveMethods: AuthMethodsMap;\n      let effectiveMfa = rawPolicy.mfaPolicy;\n      let effectivePassword = rawPolicy.passwordPolicy;\n      // #527 — the fourth overridable axis. Declared beside its three siblings because this resolver\n      // and the pure org-type one are TWO sites of one invariant, and the merge must not be applied\n      // at only one of them.\n      let effectiveStepUp = rawPolicy.stepUpAuth;\n      if (orgOverrides.length > 0) {\n        const authConfig = this.appConfigService.config.auth;\n        const resolved = resolveAuthConfig({\n          userTypeAuth: rawPolicy,\n          orgOverrides,\n          orgAuthMethodPolicy: authConfig.orgAuthMethodPolicy,\n          expandableOrgMethods: authConfig.expandableOrgMethods,\n        });\n        effectiveMethods = resolved.authMethodsEnabled;\n        effectiveMfa = resolved.mfaPolicy;\n        effectivePassword = resolved.passwordPolicy;\n        effectiveStepUp = resolved.stepUpAuth;\n      } else {\n        effectiveMethods = rawPolicy.authMethodsEnabled as AuthMethodsMap;\n      }\n\n      // AUTH-24 derivation: posture wins over authored config (same most-restrictive direction as the\n      // org-override merge) — force the local first-factor methods OFF for a directory-managed user.\n      const authMethodsEnabled = anyDirectoryManaged\n        ? disableDirectoryIncompatibleMethods(effectiveMethods)\n        : effectiveMethods;\n\n      return {\n        ...rawPolicy,\n        authMethodsEnabled: authMethodsEnabled as UserTypeAuthPolicy['authMethodsEnabled'],\n        mfaPolicy: effectiveMfa,\n        passwordPolicy: effectivePassword,\n        stepUpAuth: effectiveStepUp,\n      };\n    } catch (error) {\n      this.logDebug('AUTH-14: Org override resolution failed, falling back to raw user-type policy', {\n        userId: userId.substring(0, 8) + '...',\n        userType,\n        ...projectCaughtErrorLogFields(error),\n      });\n      return rawPolicy;\n    }\n  }\n\n  /**\n   * Org-TYPE-keyed effective auth-policy resolution — PURE (no DB, no EC).\n   *\n   * For surfaces that must know an organization's available auth methods WITHOUT\n   * an authenticated user AND WITHOUT reading the ORGANIZATIONS resource. The\n   * canonical caller is the public invitation-accept screen, which runs under an\n   * unauthenticated `APP_PUBLIC` pre-auth EC that CANNOT read ORGANIZATIONS (its\n   * READ ACL is ORG_MEMBER / super-admin). An earlier org-ID-keyed variant read\n   * ORGANIZATIONS internally and fail-closed silently under that EC, dropping the\n   * org's auth overrides — so this takes the `orgType` the caller has already\n   * resolved via the system-access door and does zero I/O.\n   *\n   * Resolves the effective policy for a hypothetical member of `userType` in an\n   * organization of type `orgType`: `organizationTypes[orgType].authOverrides`\n   * merged through the SAME pure `resolveAuthConfig` core (most-restrictive-wins)\n   * used by the user-keyed path. Single-org, so no multi-org intersection — but the\n   * per-org RESTRICT_ONLY / EXPAND_WITHIN_SET / UNRESTRICTED policy still applies.\n   *\n   * Fail-open to the raw user-type policy when `orgType` is absent or its type\n   * declares no overrides. Returns `null` only when the user type has no policy at\n   * all (unknown user type).\n   */\n  resolveAuthPolicyForOrgType(\n    userType: string,\n    orgType: string | undefined,\n  ): UserTypeAuthPolicy | null {\n    return resolveAuthPolicyForOrganizationType(\n      this.appConfigService.config,\n      userType,\n      orgType,\n      this.appConfigService.getUserTypeAuthPolicy(userType),\n    );\n  }\n}\n"]}

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts

@@ -1,4 +1,4 @@
-import type { ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';
+import type { ExecutionContext_InitiatorIds, ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';
 import type { RedisService } from '../../../../databases/services/redis.service';
 import type { LoggerService } from '../../../../monitoring/logger/services/logger.service';
 import type { SocketAuthResult } from '../../../../runtime/models/execution-context.backend.schemas';
@@ -68,6 +68,42 @@ export type ExternalTurnRateDecision = {
  * owner id, so the caller treats `undefined` as "cannot throttle → proceed", fail-open).
  */
 export declare function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined;
+/**
+ * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a
+ * credentialed agent plane (today: MCP `tools/call`). Sits beside
+ * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two
+ * different guards, and the ONE thing a reader must not have to reconstruct is why they
+ * answer it differently.
+ *
+ * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision
+ *
+ * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the
+ * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being
+ * protected is the tenant's shared upstream quota, so every credential the tenant issued should
+ * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.
+ *
+ * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced
+ * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant "5/min
+ * for the whole tenant"; it means "5/min per client, and N clients get N × 5". The faithful
+ * translation onto a plane whose callers are credentials rather than sockets is therefore the
+ * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as
+ * two browsers on two IPs are. Keying this guard on the org instead would silently make the
+ * SAME declared number roughly N times stricter over MCP than over REST for any tenant running
+ * more than one agent — the "throttles a whole tenant on one agent's traffic" failure — and an
+ * application author reading `requestsPerMinute: 5` has no way to discover that.
+ *
+ * Hence: credential first, then the delegated user, then the owning scope as a last resort.
+ * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which
+ * always carries `machineCredential`) or user-delegated (which always carries `userId`).
+ *
+ * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be
+ * sourced from tool arguments or any other model-supplied value, or the throttle becomes
+ * opt-out by an attacker choosing a fresh bucket per call.
+ *
+ * @returns `undefined` when no identity field is present (see the call site for what that means
+ *   there — this function does not decide the posture, it only reports that it cannot key).
+ */
+export declare function resolveDeclaredPolicySubjectKey(initiatorIds: ExecutionContext_InitiatorIds | null | undefined): string | undefined;
 /**
  * Increment and evaluate the per-principal counter for one external turn/call. Call this
  * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external-turn-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAI5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAOlF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC3D,MAAM,EAAE;IACN,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,CAAC;CACpC,GACA,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}
+{"version":3,"file":"external-turn-rate-limit.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACnH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qDAAqD,CAAC;AACxF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAI5G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAC7C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD,4FAA4F;AAC5F,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,mEAAmE;AACnE,eAAO,MAAM,qCAAqC,KAAK,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GACd;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,GAAG,SAAS,CAOlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,6BAA6B,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUlI;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IAAE,YAAY,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,EAC3D,MAAM,EAAE;IACN,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,kBAAkB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,kBAAkB,CAAC;CACpC,GACA,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js

@@ -63,6 +63,57 @@ export function resolvePrincipalRateKey(auth) {
         return `app:${ids.applicationId}`;
     return undefined;
 }
+/**
+ * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a
+ * credentialed agent plane (today: MCP `tools/call`). Sits beside
+ * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two
+ * different guards, and the ONE thing a reader must not have to reconstruct is why they
+ * answer it differently.
+ *
+ * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision
+ *
+ * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the
+ * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being
+ * protected is the tenant's shared upstream quota, so every credential the tenant issued should
+ * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.
+ *
+ * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced
+ * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant "5/min
+ * for the whole tenant"; it means "5/min per client, and N clients get N × 5". The faithful
+ * translation onto a plane whose callers are credentials rather than sockets is therefore the
+ * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as
+ * two browsers on two IPs are. Keying this guard on the org instead would silently make the
+ * SAME declared number roughly N times stricter over MCP than over REST for any tenant running
+ * more than one agent — the "throttles a whole tenant on one agent's traffic" failure — and an
+ * application author reading `requestsPerMinute: 5` has no way to discover that.
+ *
+ * Hence: credential first, then the delegated user, then the owning scope as a last resort.
+ * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which
+ * always carries `machineCredential`) or user-delegated (which always carries `userId`).
+ *
+ * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be
+ * sourced from tool arguments or any other model-supplied value, or the throttle becomes
+ * opt-out by an attacker choosing a fresh bucket per call.
+ *
+ * @returns `undefined` when no identity field is present (see the call site for what that means
+ *   there — this function does not decide the posture, it only reports that it cannot key).
+ */
+export function resolveDeclaredPolicySubjectKey(initiatorIds) {
+    if (!initiatorIds)
+        return undefined;
+    const credential = initiatorIds.machineCredential;
+    // The auth method rides the key because the two credential kinds are separate id spaces
+    // (an ApiKey row id and an OAuthClient row id could collide) — never as a policy axis.
+    if (credential?.credentialId)
+        return `cred:${credential.authMethod}:${credential.credentialId}`;
+    if (initiatorIds.userId)
+        return `user:${initiatorIds.userId}`;
+    if (initiatorIds.organizationId)
+        return `org:${initiatorIds.organizationId}`;
+    if (initiatorIds.applicationId)
+        return `app:${initiatorIds.applicationId}`;
+    return undefined;
+}
 /**
  * Increment and evaluate the per-principal counter for one external turn/call. Call this
  * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns

package/dist/esm/security/authentications/services/utils/external-turn-rate-limit.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"external-turn-rate-limit.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAEtI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAExD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAcxD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAsB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAA2D,EAC3D,MAMC;IAED,MAAM,UAAU,GAAG,iBAAiB,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACnF,MAAM,qBAAqB,GAAG,mCAAmC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3F,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAClC,mFAAmF;YACnF,IAAI,iBAAiB,GAAG,MAAM,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,GAAG,GAAG,CAAC;oBAAE,iBAAiB,GAAG,GAAG,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uFAAuF;YACzF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;YAClH,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import type { ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\n\n/**\n * Per-PRINCIPAL success-path throttle for the external agent transports (A2A / MCP).\n *\n * ## Why this exists, and how it differs from the auth guard next door\n *\n * `machine-auth-rate-limit.backend.utils.ts` is a **failure-keyed** brute-force guard —\n * it only counts REJECTED secret/token presentations, keyed on the source IP, and it\n * deliberately does NOT throttle a valid token (a signature-gated token cannot be\n * guessed). That leaves a real exposure this util closes: an authenticated caller\n * holding ONE valid credential can drive UNBOUNDED work on the credentialed endpoints —\n * for A2A, unbounded LLM turns (direct spend + noisy-neighbor exhaustion of the app's\n * shared upstream model quota); for MCP, unbounded resource-operation dispatch (DB load).\n * There is no app-level global HTTP limiter on these routes, so the only cap is the one\n * added here.\n *\n * This guard is therefore the mirror image of the auth guard:\n * - **Success-keyed, per PRINCIPAL** — every ACCEPTED turn/call increments a counter keyed\n *   on the authenticated principal (`userId` \\| `organizationId` \\| `applicationId`), never\n *   on a caller/LLM-supplied value. Keying on the principal (not the IP) caps the actual\n *   spend axis: the credential. (The FAILURE path already feeds a per-IP counter.)\n * - **Fixed window, increment-then-compare** — the Nth call's atomic `INCR` returns N; once\n *   N exceeds the cap the caller is throttled for the remainder of the window. A throttled\n *   attempt still consumed its `INCR`, which is intentional: a burst of rejected attempts\n *   keeps the abuser saturated rather than clearing the window.\n * - **Fails OPEN on a limiter outage** — a Redis failure must never break the external\n *   endpoint. This is an ABUSE-throttle, not a billing boundary; consistency with the\n *   sibling auth limiter. (The future per-tenant SPEND budget is a billing boundary and\n *   will fail CLOSED instead — do not copy this fail-open policy there.)\n *\n * ## Distinct caps per surface (semantic precision)\n *\n * A2A `message/send` runs an LLM agent turn; MCP `tools/call` dispatches a CRUD resource\n * operation — NOT an LLM call. Their abuse profiles differ (model spend vs DB load), so the\n * two surfaces carry distinct caps rather than one merged number. All caps are framework\n * defaults, tunable later (a per-tenant budget / app-config surface is the follow-on).\n */\n\n/** Max A2A agent turns (`message/send` + `message/stream`) per principal per window (LLM spend — tighter). */\nexport const A2A_EXTERNAL_TURN_RATE_MAX = 30;\n/** Rolling window (seconds) for the A2A per-principal turn cap. */\nexport const A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS = 60;\n\n/** Max MCP `tools/call` dispatches per principal per window (resource-op load — looser). */\nexport const MCP_EXTERNAL_CALL_RATE_MAX = 120;\n/** Rolling window (seconds) for the MCP per-principal call cap. */\nexport const MCP_EXTERNAL_CALL_RATE_WINDOW_SECONDS = 60;\n\n/**\n * Outcome of a per-principal throttle check. STRING discriminant (`kind`) because this\n * package compiles with `strictNullChecks` off, under which boolean-literal discriminated\n * unions do not narrow reliably (same rationale as the A2A/MCP transport result types).\n * Returned rather than thrown so the caller can emit a controlled transport response\n * (HTTP 429 + `Retry-After`) instead of routing a `RATE_LIMIT` error through the generic\n * async error handler.\n */\nexport type ExternalTurnRateDecision =\n  | { kind: 'ok' }\n  | { kind: 'rate_limited'; retryAfterSeconds: number };\n\n/**\n * Derive the stable throttle key for an authenticated principal from its server-verified\n * identity. A user-delegated principal carries a `userId`; a machine principal carries\n * exactly one of `organizationId` / `applicationId`. Returns `undefined` for an unkeyable\n * principal (defensive — auth already fails closed for a principal with no resolvable\n * owner id, so the caller treats `undefined` as \"cannot throttle → proceed\", fail-open).\n */\nexport function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined {\n  const ids = auth.initiatorIds;\n  if (!ids) return undefined;\n  if (ids.userId) return `user:${ids.userId}`;\n  if (ids.organizationId) return `org:${ids.organizationId}`;\n  if (ids.applicationId) return `app:${ids.applicationId}`;\n  return undefined;\n}\n\n/**\n * Increment and evaluate the per-principal counter for one external turn/call. Call this\n * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns\n * `{ kind: 'rate_limited', retryAfterSeconds }` once the principal exceeds `maxPerWindow`\n * in the window, otherwise `{ kind: 'ok' }`. Fails OPEN (returns `ok`) on any Redis error.\n *\n * `params.applicationEnv` scales `maxPerWindow` in DEVELOPMENT/TEST through the shared\n * relaxation seam, so an e2e suite driving many A2A turns or MCP calls under one\n * provisioned principal is not throttled by a production-authored spend guard.\n * `STAGING`/`PRODUCTION` enforce the caller's number exactly.\n */\nexport async function assertExternalTurnWithinRate(\n  deps: { redisService: RedisService; logger: LoggerService },\n  params: {\n    principalKey: string;\n    resourceServer: ResourceServerKind;\n    maxPerWindow: number;\n    windowSeconds: number;\n    applicationEnv: RuntimeEnvironment;\n  },\n): Promise<ExternalTurnRateDecision> {\n  const identifier = `external_turn:${params.resourceServer}:${params.principalKey}`;\n  const effectiveMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(params.maxPerWindow, params.applicationEnv);\n  try {\n    const count = await deps.redisService.incrementRateLimit(identifier, params.windowSeconds);\n    if (count > effectiveMaxPerWindow) {\n      // Prefer the live TTL for an accurate `Retry-After`; fall back to the full window.\n      let retryAfterSeconds = params.windowSeconds;\n      try {\n        const ttl = await deps.redisService.getRateLimitTtl(identifier);\n        if (ttl > 0) retryAfterSeconds = ttl;\n      } catch {\n        // Keep the window fallback — a TTL read failure must not upgrade this to a hard error.\n      }\n      return { kind: 'rate_limited', retryAfterSeconds };\n    }\n    return { kind: 'ok' };\n  } catch (error) {\n    // Fail OPEN: a limiter outage must never break the external endpoint. This is an\n    // abuse-throttle, not a billing boundary — the per-tenant spend budget (a later,\n    // separate concern) is the one that fails closed.\n    deps.logger.warn('[external-turn-rate-limit] throttle check skipped (rate-limit store unavailable) — failing open', {\n      resourceServer: params.resourceServer,\n      ...projectCaughtErrorLogFields(error),\n    });\n    return { kind: 'ok' };\n  }\n}\n"]}
+{"version":3,"file":"external-turn-rate-limit.backend.utils.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/utils/external-turn-rate-limit.backend.utils.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EAAE,mCAAmC,EAAE,MAAM,iFAAiF,CAAC;AAEtI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,8GAA8G;AAC9G,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAC7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAExD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,mEAAmE;AACnE,MAAM,CAAC,MAAM,qCAAqC,GAAG,EAAE,CAAC;AAcxD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAsB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;IAC5C,IAAI,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,GAAG,CAAC,cAAc,EAAE,CAAC;IAC3D,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,OAAO,GAAG,CAAC,aAAa,EAAE,CAAC;IACzD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,+BAA+B,CAAC,YAA8D;IAC5G,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,iBAAiB,CAAC;IAClD,wFAAwF;IACxF,uFAAuF;IACvF,IAAI,UAAU,EAAE,YAAY;QAAE,OAAO,QAAQ,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;IAChG,IAAI,YAAY,CAAC,MAAM;QAAE,OAAO,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,YAAY,CAAC,cAAc;QAAE,OAAO,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC;IAC7E,IAAI,YAAY,CAAC,aAAa;QAAE,OAAO,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAA2D,EAC3D,MAMC;IAED,MAAM,UAAU,GAAG,iBAAiB,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;IACnF,MAAM,qBAAqB,GAAG,mCAAmC,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9G,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC3F,IAAI,KAAK,GAAG,qBAAqB,EAAE,CAAC;YAClC,mFAAmF;YACnF,IAAI,iBAAiB,GAAG,MAAM,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;gBAChE,IAAI,GAAG,GAAG,CAAC;oBAAE,iBAAiB,GAAG,GAAG,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,uFAAuF;YACzF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;QACrD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iFAAiF;QACjF,iFAAiF;QACjF,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iGAAiG,EAAE;YAClH,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,2BAA2B,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;AACH,CAAC","sourcesContent":["import type { ExecutionContext_InitiatorIds, ResourceServerKind, RuntimeEnvironment } from '@wildo-ai/saas-models';\nimport type { RedisService } from '~wildo-backend-lib/databases/services/redis.service';\nimport type { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport type { SocketAuthResult } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { relaxAbuseThrottleMaxForEnvironment } from '~wildo-backend-lib/errors/utils/rate-limit-environment-relaxation.backend.utils';\n\n/**\n * Per-PRINCIPAL success-path throttle for the external agent transports (A2A / MCP).\n *\n * ## Why this exists, and how it differs from the auth guard next door\n *\n * `machine-auth-rate-limit.backend.utils.ts` is a **failure-keyed** brute-force guard —\n * it only counts REJECTED secret/token presentations, keyed on the source IP, and it\n * deliberately does NOT throttle a valid token (a signature-gated token cannot be\n * guessed). That leaves a real exposure this util closes: an authenticated caller\n * holding ONE valid credential can drive UNBOUNDED work on the credentialed endpoints —\n * for A2A, unbounded LLM turns (direct spend + noisy-neighbor exhaustion of the app's\n * shared upstream model quota); for MCP, unbounded resource-operation dispatch (DB load).\n * There is no app-level global HTTP limiter on these routes, so the only cap is the one\n * added here.\n *\n * This guard is therefore the mirror image of the auth guard:\n * - **Success-keyed, per PRINCIPAL** — every ACCEPTED turn/call increments a counter keyed\n *   on the authenticated principal (`userId` \\| `organizationId` \\| `applicationId`), never\n *   on a caller/LLM-supplied value. Keying on the principal (not the IP) caps the actual\n *   spend axis: the credential. (The FAILURE path already feeds a per-IP counter.)\n * - **Fixed window, increment-then-compare** — the Nth call's atomic `INCR` returns N; once\n *   N exceeds the cap the caller is throttled for the remainder of the window. A throttled\n *   attempt still consumed its `INCR`, which is intentional: a burst of rejected attempts\n *   keeps the abuser saturated rather than clearing the window.\n * - **Fails OPEN on a limiter outage** — a Redis failure must never break the external\n *   endpoint. This is an ABUSE-throttle, not a billing boundary; consistency with the\n *   sibling auth limiter. (The future per-tenant SPEND budget is a billing boundary and\n *   will fail CLOSED instead — do not copy this fail-open policy there.)\n *\n * ## Distinct caps per surface (semantic precision)\n *\n * A2A `message/send` runs an LLM agent turn; MCP `tools/call` dispatches a CRUD resource\n * operation — NOT an LLM call. Their abuse profiles differ (model spend vs DB load), so the\n * two surfaces carry distinct caps rather than one merged number. All caps are framework\n * defaults, tunable later (a per-tenant budget / app-config surface is the follow-on).\n */\n\n/** Max A2A agent turns (`message/send` + `message/stream`) per principal per window (LLM spend — tighter). */\nexport const A2A_EXTERNAL_TURN_RATE_MAX = 30;\n/** Rolling window (seconds) for the A2A per-principal turn cap. */\nexport const A2A_EXTERNAL_TURN_RATE_WINDOW_SECONDS = 60;\n\n/** Max MCP `tools/call` dispatches per principal per window (resource-op load — looser). */\nexport const MCP_EXTERNAL_CALL_RATE_MAX = 120;\n/** Rolling window (seconds) for the MCP per-principal call cap. */\nexport const MCP_EXTERNAL_CALL_RATE_WINDOW_SECONDS = 60;\n\n/**\n * Outcome of a per-principal throttle check. STRING discriminant (`kind`) because this\n * package compiles with `strictNullChecks` off, under which boolean-literal discriminated\n * unions do not narrow reliably (same rationale as the A2A/MCP transport result types).\n * Returned rather than thrown so the caller can emit a controlled transport response\n * (HTTP 429 + `Retry-After`) instead of routing a `RATE_LIMIT` error through the generic\n * async error handler.\n */\nexport type ExternalTurnRateDecision =\n  | { kind: 'ok' }\n  | { kind: 'rate_limited'; retryAfterSeconds: number };\n\n/**\n * Derive the stable throttle key for an authenticated principal from its server-verified\n * identity. A user-delegated principal carries a `userId`; a machine principal carries\n * exactly one of `organizationId` / `applicationId`. Returns `undefined` for an unkeyable\n * principal (defensive — auth already fails closed for a principal with no resolvable\n * owner id, so the caller treats `undefined` as \"cannot throttle → proceed\", fail-open).\n */\nexport function resolvePrincipalRateKey(auth: SocketAuthResult): string | undefined {\n  const ids = auth.initiatorIds;\n  if (!ids) return undefined;\n  if (ids.userId) return `user:${ids.userId}`;\n  if (ids.organizationId) return `org:${ids.organizationId}`;\n  if (ids.applicationId) return `app:${ids.applicationId}`;\n  return undefined;\n}\n\n/**\n * Derive the counting subject for an operation's OWN declared `rateLimit` policy on a\n * credentialed agent plane (today: MCP `tools/call`). Sits beside\n * {@link resolvePrincipalRateKey} on purpose — the two answer the same question for two\n * different guards, and the ONE thing a reader must not have to reconstruct is why they\n * answer it differently.\n *\n * ## The precedence differs from {@link resolvePrincipalRateKey}, and that is the decision\n *\n * `resolvePrincipalRateKey` deliberately keys the framework's blanket abuse throttle on the\n * principal's OWNER (`user` → `org` → `app`). That is right for a spend guard: the thing being\n * protected is the tenant's shared upstream quota, so every credential the tenant issued should\n * saturate ONE bucket and a tenant cannot buy more headroom by minting more clients.\n *\n * An AUTHORED per-endpoint `rateLimit` is a different statement. Over HTTP it is enforced\n * per SOURCE IP — one caller, one budget — so `requestsPerMinute: 5` has never meant \"5/min\n * for the whole tenant\"; it means \"5/min per client, and N clients get N × 5\". The faithful\n * translation onto a plane whose callers are credentials rather than sockets is therefore the\n * CREDENTIAL: two agents an organization runs against the same tool are two clients, exactly as\n * two browsers on two IPs are. Keying this guard on the org instead would silently make the\n * SAME declared number roughly N times stricter over MCP than over REST for any tenant running\n * more than one agent — the \"throttles a whole tenant on one agent's traffic\" failure — and an\n * application author reading `requestsPerMinute: 5` has no way to discover that.\n *\n * Hence: credential first, then the delegated user, then the owning scope as a last resort.\n * The scope fallback is defensive only — an authenticated MCP caller is either a machine (which\n * always carries `machineCredential`) or user-delegated (which always carries `userId`).\n *\n * Every branch reads a SERVER-VERIFIED field of the execution context. Nothing here may ever be\n * sourced from tool arguments or any other model-supplied value, or the throttle becomes\n * opt-out by an attacker choosing a fresh bucket per call.\n *\n * @returns `undefined` when no identity field is present (see the call site for what that means\n *   there — this function does not decide the posture, it only reports that it cannot key).\n */\nexport function resolveDeclaredPolicySubjectKey(initiatorIds: ExecutionContext_InitiatorIds | null | undefined): string | undefined {\n  if (!initiatorIds) return undefined;\n  const credential = initiatorIds.machineCredential;\n  // The auth method rides the key because the two credential kinds are separate id spaces\n  // (an ApiKey row id and an OAuthClient row id could collide) — never as a policy axis.\n  if (credential?.credentialId) return `cred:${credential.authMethod}:${credential.credentialId}`;\n  if (initiatorIds.userId) return `user:${initiatorIds.userId}`;\n  if (initiatorIds.organizationId) return `org:${initiatorIds.organizationId}`;\n  if (initiatorIds.applicationId) return `app:${initiatorIds.applicationId}`;\n  return undefined;\n}\n\n/**\n * Increment and evaluate the per-principal counter for one external turn/call. Call this\n * AFTER authentication and BEFORE the expensive dispatch (LLM turn / resource op). Returns\n * `{ kind: 'rate_limited', retryAfterSeconds }` once the principal exceeds `maxPerWindow`\n * in the window, otherwise `{ kind: 'ok' }`. Fails OPEN (returns `ok`) on any Redis error.\n *\n * `params.applicationEnv` scales `maxPerWindow` in DEVELOPMENT/TEST through the shared\n * relaxation seam, so an e2e suite driving many A2A turns or MCP calls under one\n * provisioned principal is not throttled by a production-authored spend guard.\n * `STAGING`/`PRODUCTION` enforce the caller's number exactly.\n */\nexport async function assertExternalTurnWithinRate(\n  deps: { redisService: RedisService; logger: LoggerService },\n  params: {\n    principalKey: string;\n    resourceServer: ResourceServerKind;\n    maxPerWindow: number;\n    windowSeconds: number;\n    applicationEnv: RuntimeEnvironment;\n  },\n): Promise<ExternalTurnRateDecision> {\n  const identifier = `external_turn:${params.resourceServer}:${params.principalKey}`;\n  const effectiveMaxPerWindow = relaxAbuseThrottleMaxForEnvironment(params.maxPerWindow, params.applicationEnv);\n  try {\n    const count = await deps.redisService.incrementRateLimit(identifier, params.windowSeconds);\n    if (count > effectiveMaxPerWindow) {\n      // Prefer the live TTL for an accurate `Retry-After`; fall back to the full window.\n      let retryAfterSeconds = params.windowSeconds;\n      try {\n        const ttl = await deps.redisService.getRateLimitTtl(identifier);\n        if (ttl > 0) retryAfterSeconds = ttl;\n      } catch {\n        // Keep the window fallback — a TTL read failure must not upgrade this to a hard error.\n      }\n      return { kind: 'rate_limited', retryAfterSeconds };\n    }\n    return { kind: 'ok' };\n  } catch (error) {\n    // Fail OPEN: a limiter outage must never break the external endpoint. This is an\n    // abuse-throttle, not a billing boundary — the per-tenant spend budget (a later,\n    // separate concern) is the one that fails closed.\n    deps.logger.warn('[external-turn-rate-limit] throttle check skipped (rate-limit store unavailable) — failing open', {\n      resourceServer: params.resourceServer,\n      ...projectCaughtErrorLogFields(error),\n    });\n    return { kind: 'ok' };\n  }\n}\n"]}

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts

@@ -3,9 +3,50 @@ interface EnterpriseSsoEnforcementLike {
     requireSSO?: boolean | undefined;
     allowPasswordFallback?: boolean | undefined;
 }
+/** The break-glass half of a tenant's SSO policy, taken structurally so a partial config fits. */
+export interface EmergencyAccessLike {
+    enabled?: boolean | undefined;
+    breakGlassAccounts?: readonly string[] | undefined;
+}
 interface DomainOrgLookupLike {
     enforcement?: EnterpriseSsoEnforcementLike | undefined;
+    ssoConfig?: {
+        emergencyAccess?: EmergencyAccessLike | undefined;
+    } | undefined;
 }
+/**
+ * Does this tenant have break-glass accounts that could actually be used?
+ *
+ * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the
+ * switch on is the same as no break-glass at all. Written as one predicate because both the offered
+ * methods and the enforcement gate must agree about it — if they disagree, either the accounts
+ * cannot reach a password field or everyone else can.
+ */
+export declare function tenantHasUsableBreakGlassAccounts(domainOrgLookup?: DomainOrgLookupLike | null | undefined): boolean;
+/**
+ * Is this address one of the tenant's named break-glass accounts?
+ *
+ * Compared case-insensitively on the address, because that is how the operator authored it and how
+ * the caller typed it. The CALLER's claim is never the input — every call site passes the address of
+ * a user whose credential has already been verified.
+ */
+export declare function isBreakGlassAccount(emergencyAccess: EmergencyAccessLike | undefined | null, email: string | undefined | null): boolean;
+/**
+ * Must this tenant's sign-in page offer ONLY enterprise methods?
+ *
+ * ## Why break-glass answers this for the whole tenant rather than per account
+ *
+ * A tenant with named break-glass accounts keeps its password field — for EVERY address at the
+ * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered
+ * method list is built before anything is authenticated, from an email hint, so narrowing it for
+ * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is
+ * a small, high-value target; publishing its membership to anyone who can type an address is worse
+ * than the outage it protects against.
+ *
+ * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost
+ * of this is a password field that only the listed accounts can use, and the benefit is that
+ * nothing about the response says which those are.
+ */
 export declare function requiresEnterpriseSsoOnly(domainOrgLookup?: DomainOrgLookupLike | null | undefined): boolean;
 export declare function restrictFirstFactorMethodsForEnterpriseSso(methods: ReadonlyArray<AvailableMethod>, domainOrgLookup?: DomainOrgLookupLike | null | undefined): AvailableMethod[];
 export {};

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-sso-enforcement.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,UAAU,4BAA4B;IACpC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,UAAU,mBAAmB;IAC3B,WAAW,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;CACxD;AAED,wBAAgB,yBAAyB,CACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAGT;AAED,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,EACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,eAAe,EAAE,CAUnB"}
+{"version":3,"file":"enterprise-sso-enforcement.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEzE,UAAU,4BAA4B;IACpC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED,kGAAkG;AAClG,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACpD;AAED,UAAU,mBAAmB;IAC3B,WAAW,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACvD,SAAS,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;CAC/E;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAIT;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,eAAe,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,EACvD,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAC/B,OAAO,CAMT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAMT;AAED,wBAAgB,0CAA0C,CACxD,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,EACvC,eAAe,CAAC,EAAE,mBAAmB,GAAG,IAAI,GAAG,SAAS,GACvD,eAAe,EAAE,CAUnB"}

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js

@@ -1,5 +1,50 @@
 import { AuthMethod } from '@wildo-ai/saas-models';
+/**
+ * Does this tenant have break-glass accounts that could actually be used?
+ *
+ * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the
+ * switch on is the same as no break-glass at all. Written as one predicate because both the offered
+ * methods and the enforcement gate must agree about it — if they disagree, either the accounts
+ * cannot reach a password field or everyone else can.
+ */
+export function tenantHasUsableBreakGlassAccounts(domainOrgLookup) {
+    const emergencyAccess = domainOrgLookup?.ssoConfig?.emergencyAccess;
+    return emergencyAccess?.enabled === true
+        && (emergencyAccess.breakGlassAccounts?.length ?? 0) > 0;
+}
+/**
+ * Is this address one of the tenant's named break-glass accounts?
+ *
+ * Compared case-insensitively on the address, because that is how the operator authored it and how
+ * the caller typed it. The CALLER's claim is never the input — every call site passes the address of
+ * a user whose credential has already been verified.
+ */
+export function isBreakGlassAccount(emergencyAccess, email) {
+    if (emergencyAccess?.enabled !== true || !email)
+        return false;
+    const normalized = email.trim().toLowerCase();
+    return (emergencyAccess.breakGlassAccounts ?? []).some((account) => account.trim().toLowerCase() === normalized);
+}
+/**
+ * Must this tenant's sign-in page offer ONLY enterprise methods?
+ *
+ * ## Why break-glass answers this for the whole tenant rather than per account
+ *
+ * A tenant with named break-glass accounts keeps its password field — for EVERY address at the
+ * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered
+ * method list is built before anything is authenticated, from an email hint, so narrowing it for
+ * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is
+ * a small, high-value target; publishing its membership to anyone who can type an address is worse
+ * than the outage it protects against.
+ *
+ * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost
+ * of this is a password field that only the listed accounts can use, and the benefit is that
+ * nothing about the response says which those are.
+ */
 export function requiresEnterpriseSsoOnly(domainOrgLookup) {
+    if (tenantHasUsableBreakGlassAccounts(domainOrgLookup)) {
+        return false;
+    }
     return domainOrgLookup?.enforcement?.requireSSO === true
         && domainOrgLookup.enforcement.allowPasswordFallback !== true;
 }

package/dist/esm/security/authentications/utils/enterprise-sso-enforcement.backend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-sso-enforcement.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAWzE,MAAM,UAAU,yBAAyB,CACvC,eAAwD;IAExD,OAAO,eAAe,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI;WACnD,eAAe,CAAC,WAAW,CAAC,qBAAqB,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,OAAuC,EACvC,eAAwD;IAExD,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;WAC5C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAC3C,CAAC;AACJ,CAAC","sourcesContent":["import { AuthMethod, type AvailableMethod } from '@wildo-ai/saas-models';\n\ninterface EnterpriseSsoEnforcementLike {\n  requireSSO?: boolean | undefined;\n  allowPasswordFallback?: boolean | undefined;\n}\n\ninterface DomainOrgLookupLike {\n  enforcement?: EnterpriseSsoEnforcementLike | undefined;\n}\n\nexport function requiresEnterpriseSsoOnly(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  return domainOrgLookup?.enforcement?.requireSSO === true\n    && domainOrgLookup.enforcement.allowPasswordFallback !== true;\n}\n\nexport function restrictFirstFactorMethodsForEnterpriseSso(\n  methods: ReadonlyArray<AvailableMethod>,\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): AvailableMethod[] {\n  if (!requiresEnterpriseSsoOnly(domainOrgLookup)) {\n    return [...methods];\n  }\n\n  return methods.filter(\n    (method) =>\n      method.method === AuthMethod.ORG_OPENID_CONNECT\n      || method.method === AuthMethod.ORG_SAML,\n  );\n}\n"]}
+{"version":3,"file":"enterprise-sso-enforcement.backend.utils.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/utils/enterprise-sso-enforcement.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAwB,MAAM,uBAAuB,CAAC;AAkBzE;;;;;;;GAOG;AACH,MAAM,UAAU,iCAAiC,CAC/C,eAAwD;IAExD,MAAM,eAAe,GAAG,eAAe,EAAE,SAAS,EAAE,eAAe,CAAC;IACpE,OAAO,eAAe,EAAE,OAAO,KAAK,IAAI;WACnC,CAAC,eAAe,CAAC,kBAAkB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,eAAuD,EACvD,KAAgC;IAEhC,IAAI,eAAe,EAAE,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,CAAC,eAAe,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,CACpD,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAAwD;IAExD,IAAI,iCAAiC,CAAC,eAAe,CAAC,EAAE,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,EAAE,WAAW,EAAE,UAAU,KAAK,IAAI;WACnD,eAAe,CAAC,WAAW,CAAC,qBAAqB,KAAK,IAAI,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,0CAA0C,CACxD,OAAuC,EACvC,eAAwD;IAExD,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CACnB,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,kBAAkB;WAC5C,MAAM,CAAC,MAAM,KAAK,UAAU,CAAC,QAAQ,CAC3C,CAAC;AACJ,CAAC","sourcesContent":["import { AuthMethod, type AvailableMethod } from '@wildo-ai/saas-models';\n\ninterface EnterpriseSsoEnforcementLike {\n  requireSSO?: boolean | undefined;\n  allowPasswordFallback?: boolean | undefined;\n}\n\n/** The break-glass half of a tenant's SSO policy, taken structurally so a partial config fits. */\nexport interface EmergencyAccessLike {\n  enabled?: boolean | undefined;\n  breakGlassAccounts?: readonly string[] | undefined;\n}\n\ninterface DomainOrgLookupLike {\n  enforcement?: EnterpriseSsoEnforcementLike | undefined;\n  ssoConfig?: { emergencyAccess?: EmergencyAccessLike | undefined } | undefined;\n}\n\n/**\n * Does this tenant have break-glass accounts that could actually be used?\n *\n * `enabled` alone grants nothing: the LIST is what confers the bypass, so an empty list with the\n * switch on is the same as no break-glass at all. Written as one predicate because both the offered\n * methods and the enforcement gate must agree about it — if they disagree, either the accounts\n * cannot reach a password field or everyone else can.\n */\nexport function tenantHasUsableBreakGlassAccounts(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  const emergencyAccess = domainOrgLookup?.ssoConfig?.emergencyAccess;\n  return emergencyAccess?.enabled === true\n    && (emergencyAccess.breakGlassAccounts?.length ?? 0) > 0;\n}\n\n/**\n * Is this address one of the tenant's named break-glass accounts?\n *\n * Compared case-insensitively on the address, because that is how the operator authored it and how\n * the caller typed it. The CALLER's claim is never the input — every call site passes the address of\n * a user whose credential has already been verified.\n */\nexport function isBreakGlassAccount(\n  emergencyAccess: EmergencyAccessLike | undefined | null,\n  email: string | undefined | null,\n): boolean {\n  if (emergencyAccess?.enabled !== true || !email) return false;\n  const normalized = email.trim().toLowerCase();\n  return (emergencyAccess.breakGlassAccounts ?? []).some(\n    (account) => account.trim().toLowerCase() === normalized,\n  );\n}\n\n/**\n * Must this tenant's sign-in page offer ONLY enterprise methods?\n *\n * ## Why break-glass answers this for the whole tenant rather than per account\n *\n * A tenant with named break-glass accounts keeps its password field — for EVERY address at the\n * domain, not for the listed ones. This is the enumeration-safety decision (#481/#423): the offered\n * method list is built before anything is authenticated, from an email hint, so narrowing it for\n * the listed accounts would make the sign-in page an oracle for who they are. A break-glass list is\n * a small, high-value target; publishing its membership to anyone who can type an address is worse\n * than the outage it protects against.\n *\n * What refuses everyone else is the enforcement gate, AFTER the password is verified. So the cost\n * of this is a password field that only the listed accounts can use, and the benefit is that\n * nothing about the response says which those are.\n */\nexport function requiresEnterpriseSsoOnly(\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): boolean {\n  if (tenantHasUsableBreakGlassAccounts(domainOrgLookup)) {\n    return false;\n  }\n  return domainOrgLookup?.enforcement?.requireSSO === true\n    && domainOrgLookup.enforcement.allowPasswordFallback !== true;\n}\n\nexport function restrictFirstFactorMethodsForEnterpriseSso(\n  methods: ReadonlyArray<AvailableMethod>,\n  domainOrgLookup?: DomainOrgLookupLike | null | undefined,\n): AvailableMethod[] {\n  if (!requiresEnterpriseSsoOnly(domainOrgLookup)) {\n    return [...methods];\n  }\n\n  return methods.filter(\n    (method) =>\n      method.method === AuthMethod.ORG_OPENID_CONNECT\n      || method.method === AuthMethod.ORG_SAML,\n  );\n}\n"]}

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts

@@ -0,0 +1,116 @@
+/**
+ * # Cross-tenant READ observation — the half `authorizeOrganizations` structurally cannot see
+ *
+ * assurance-control: WILDO.ACCESS.CROSS_TENANT_ADMINISTRATION — a declared read across the tenant
+ * boundary leaves evidence, per tenant reached.
+ * assurance-control: WILDO.ACCESS.AUTHORIZATION_DECISION_AUDIT
+ *
+ * ## The gap this closes
+ *
+ * `CROSS_TENANT_ADMINISTRATIVE_ACCESS` is emitted from `authorizeOrganizations`, which runs on
+ * ORGANIZATIONS-scoped resources: it fetches a row, resolves the tenant that row belongs to, and
+ * records the crossing when the caller holds no organization-wide entry for it.
+ *
+ * An APPLICATION-scoped resource never traverses that path — there is no organization in its route
+ * and no per-row tenant gate — so a door that returns rows CARRYING an `organizationId` reaches
+ * every tenant with nothing written down. That is the same invariant applied at some of its sites
+ * (`.claude/rules/invariant-call-site-enumeration.md`), and the missing site is the one that hurts
+ * most: `APPLICATION_AUDIT_LOGS` is the operator's cross-tenant view of the audit trail itself, and
+ * the trail is the worst possible surface on which to make an operator read invisible
+ * (`.claude/rules/administrative-continuity-floors.md`).
+ *
+ * Measured 2026-09-09 over the real core registry: exactly FIVE resources are APPLICATION-scoped and
+ * declare a top-level `organizationId` — `applicationAuditLogs`, `auditLogs`, `consumableTokens`,
+ * `files` and `jobExecutions`. This is a small, enumerable population, not a framework-wide sweep.
+ *
+ * ## Why only a DECLARED crossing is observed
+ *
+ * `admissionDeclared: false` on that event means an ATTEMPTED crossing that no variant asked for,
+ * **and which was refused** — that is what its own field JSDoc says, and what a reviewer reads it
+ * as. A read here SUCCEEDS, so emitting `false` for an undeclared door would put a false sentence in
+ * the trail: it would describe a completed disclosure as a blocked attempt. Deriving the field from
+ * anywhere other than the variant's own flag would be a second derivation of one predicate, which is
+ * how a gate and its trail start disagreeing.
+ *
+ * So the enrolment rule is exact, and it is one act: **declaring
+ * `admitsCrossTenantPlatformAdministration` on a read variant is what puts that read in the trail.**
+ * The four sibling resources declare no crossing and are therefore unchanged. An UNDECLARED
+ * application-scoped door that returns foreign rows is a different defect — an undeclared crossing —
+ * and the answer to it is a declaration or a confinement, never an audit row that misdescribes
+ * itself.
+ *
+ * ## Why ORGANIZATIONS-scoped resources are excluded
+ *
+ * They already emit, from `authorizeOrganizations`, on the same event. Observing them here as well
+ * would double-record every declared crossing on `organizations` and `platformAccessGrants` — and a
+ * duplicated crossing is worse than a missing one, because a reviewer counting operator reaches
+ * would over-count without any way to tell.
+ *
+ * ## Why membership comes from ROLE ENTRIES
+ *
+ * The same reason its three siblings give: `initiatorIds.organizationId` names the one tenant the
+ * request is acting in, which cannot answer "is this caller a member of the tenant THIS ROW belongs
+ * to" for a result set spanning many. Role entries are the one input a request cannot author for
+ * itself. {@link resolveCallerOrganizationIds} is reused rather than re-derived so this observation
+ * and the confinement authorities can never disagree about who is a member.
+ */
+import { CoreResourceOperation } from '@wildo-ai/saas-models';
+import { type ScopeRootCollectionConfinementSignal } from '../../security/authorizations/scope-root-collection-confinement.backend';
+/**
+ * The EXECUTED operation variant — the one whose declaration decides enrolment.
+ *
+ * Passed explicitly rather than read off `executionContext.operation`, and that is a correctness
+ * requirement rather than a style choice. A resource authors ONE variant per operation and the
+ * config factory derives `summary` and `context` variants from it, so "the operation" is ambiguous
+ * unless the executed one is named; `authorizations.backend.service` already hedges by consulting
+ * BOTH the passed operation and the context's, which is the tell that the context's copy cannot be
+ * relied on. Taking it here means the enrolment decision and the `admissionDeclared` the emitter
+ * writes are read from the SAME object and cannot disagree — the failure this repository keeps
+ * paying for when one predicate is derived twice.
+ */
+export interface CrossTenantReadObservationOperation {
+    readonly admitsCrossTenantPlatformAdministration?: boolean;
+}
+/** What this authority needs from the resource configuration. Deliberately narrow, like its siblings. */
+export interface CrossTenantReadObservationResource {
+    readonly resourceIdentifier?: string;
+    readonly resourcePrimaryScope?: string;
+}
+/** One tenant reached by a single read, with the rows of that tenant it returned. */
+export interface CrossTenantReadCrossing {
+    readonly targetOrganizationId: string;
+    readonly targetResourceIds: string[];
+}
+/**
+ * Is this read enrolled in the crossing trail at all?
+ *
+ * Separated from the row walk so the decision can be pinned on its own, and so a caller pays nothing
+ * for a read that is not enrolled — which is every read of all but a handful of resources.
+ */
+export declare function isObservedCrossTenantRead(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: CrossTenantReadObservationResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+}): boolean;
+/**
+ * The distinct tenants a read reached into, and which of their rows it returned.
+ *
+ * Returns EMPTY when the read is not enrolled, when no returned row carries a tenant, or when every
+ * tenant reached is one the caller belongs to. Grouping by tenant rather than emitting per row is
+ * what bounds the trail: one operator read produces one row per TENANT reached, not one per record,
+ * and the audit row's own `organizationId` is then that tenant's — which is what makes the crossing
+ * visible in the reached tenant's own organization-scoped viewer, rather than only to the operator.
+ *
+ * `rows` accepts whatever the read returned — one object, an array, or nothing — because the three
+ * seams that call this differ in shape and normalising at each of them is how one of them would come
+ * to normalise differently.
+ */
+export declare function collectCrossTenantReadCrossings(params: {
+    readonly executionContext: ScopeRootCollectionConfinementSignal;
+    readonly operation: CrossTenantReadObservationOperation | undefined;
+    readonly resourceConfiguration: CrossTenantReadObservationResource;
+    readonly executedCoreOperation: CoreResourceOperation | undefined;
+    readonly rows: unknown;
+}): CrossTenantReadCrossing[];
+//# sourceMappingURL=cross-tenant-read-observation.backend.d.ts.map

package/dist/esm/security/authorizations/cross-tenant-read-observation.backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cross-tenant-read-observation.backend.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/cross-tenant-read-observation.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,EACL,qBAAqB,EAGtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAEL,KAAK,oCAAoC,EAC1C,MAAM,sFAAsF,CAAC;AAoC9F;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;CAC5D;AAED,yGAAyG;AACzG,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,qFAAqF;AACrF,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;CACnE,GAAG,OAAO,CAUV;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAAC,MAAM,EAAE;IACtD,QAAQ,CAAC,gBAAgB,EAAE,oCAAoC,CAAC;IAChE,QAAQ,CAAC,SAAS,EAAE,mCAAmC,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;IACnE,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,uBAAuB,EAAE,CAiC5B"}