@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js

@@ -24,12 +24,13 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
 import 'reflect-metadata';
-import { injectable, inject } from 'inversify';
+import { injectable, inject, optional } from 'inversify';
 import { randomUUID } from 'crypto';
 import { SAAS_SERVICE_TYPES } from '../../../../inject/models/service-types.js';
 import { LoggerService } from '../../../../monitoring/logger/services/logger.service.js';
 import { describeCaughtError } from '../../../../errors/utils/error-log-level-classification.backend.utils.js';
 import { AuthOrganizationConfigurationService } from '../../../../security/authentications/services/admin-config/auth-organization-configuration.service.js';
+import { resolveVerifiedDomains, AuthScopeType, CoreResourceType, DomainVerificationStatus, isDomainVerified } from '@wildo-ai/saas-models';
 /** Expected DNS TXT record prefix */
 const VERIFICATION_PREFIX = 'wildo-domain-verification=';
 /** DNS TXT record subdomain */
@@ -37,50 +38,222 @@ const VERIFICATION_SUBDOMAIN = '_wildo-verification';
 let DomainVerificationBackendService = class DomainVerificationBackendService {
     logger;
     orgConfigService;
+    systemAccessService;
     logDebug;
-    constructor(logger, orgConfigService) {
+    constructor(logger, orgConfigService, systemAccessService) {
         this.logger = logger;
         this.orgConfigService = orgConfigService;
+        this.systemAccessService = systemAccessService;
         this.logDebug = this.logger.debugByType('DomainVerification');
         this.logger.setDebugTypeLogging('DomainVerification', false);
     }
+    // ════════════════════════════════════════════════════════════════════
+    // PLANNERS — pure, and the reason they exist
+    // ════════════════════════════════════════════════════════════════════
+    //
+    // The three methods below compute a NEW `domains` block and write nothing. That split is what
+    // lets the public `claimDomain` / `verifyDomain` / `revokeDomain` operations (#424) run as
+    // resource-operation PREFIX hooks: the hook returns the patch and the framework's own core
+    // UPDATE persists it, inside the operation's transaction and in front of the
+    // `RESOURCE_OPERATION_PERFORMED` audit event.
+    //
+    // The self-writing wrappers underneath are kept for callers that hold no operation — they simply
+    // load, plan and save. Both paths go through one implementation, so a rule applied to one cannot
+    // drift from the other.
     /**
-     * Initiate domain verification: generate a token and store it in the org's SSO config.
-     * Returns the token the admin must add as a DNS TXT record.
+     * Mint a challenge for `domain` and return the `domains` block that records it as `pending`.
+     *
+     * Re-claiming an already-claimed domain is legal and deliberate: it mints a FRESH nonce and
+     * resets the status to `pending`. The stored nonce is `.isBackendOnly()` and is disclosed exactly
+     * once, in the claim response, so re-claiming is the only way to recover a lost record value —
+     * and it invalidates the previous one, which is the right direction.
      */
-    async initiateDomainVerification(ec, scopeType, scopeId, domain) {
+    planDomainClaim(domains, domain) {
         const normalizedDomain = domain.toLowerCase();
         const verificationToken = randomUUID();
-        const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
-        if (!ssoConfig) {
-            const defaultConfig = this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId);
-            defaultConfig.domains.verifiedDomains = [normalizedDomain];
-            defaultConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';
-            defaultConfig.domains.domainVerificationTokens[normalizedDomain] = verificationToken;
-            await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, defaultConfig);
+        /*
+         * ─── THIS is where `verifiedDomains` stops meaning what its name says (#457) ─────────────────
+         *
+         * A domain enters the list at CLAIM time, with status `pending`. So the stored array holds every
+         * CLAIMED domain and the real answer is the join with `domainVerificationStatus` — which is why
+         * `resolveVerifiedDomains` / `isDomainVerified` exist beside the field and every READER goes
+         * through them.
+         *
+         * If you add a write here, write the STATUS in the same step. A domain in the list with no
+         * status entry is claimed-but-unknowable, and every reader treats that as unverified — which is
+         * safe, and silently loses the claim.
+         */
+        return {
+            domains: {
+                ...domains,
+                verifiedDomains: domains.verifiedDomains.includes(normalizedDomain)
+                    ? [...domains.verifiedDomains]
+                    : [...domains.verifiedDomains, normalizedDomain],
+                domainVerificationStatus: {
+                    ...domains.domainVerificationStatus,
+                    [normalizedDomain]: DomainVerificationStatus.PENDING,
+                },
+                domainVerificationTokens: {
+                    ...domains.domainVerificationTokens,
+                    [normalizedDomain]: verificationToken,
+                },
+            },
+            verificationToken,
+            dnsName: this.verificationDnsName(normalizedDomain),
+            dnsRecordValue: `${VERIFICATION_PREFIX}${verificationToken}`,
+        };
+    }
+    /**
+     * Record the outcome of a challenge check. `verified` decides between `verified` and `failed`;
+     * there is no third answer, because a check that could not resolve DNS has already been reported
+     * as not-verified by {@link checkDomainChallenge}.
+     */
+    planVerificationOutcome(domains, domain, verified) {
+        const normalizedDomain = domain.toLowerCase();
+        return {
+            ...domains,
+            domainVerificationStatus: {
+                ...domains.domainVerificationStatus,
+                [normalizedDomain]: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,
+            },
+        };
+    }
+    /**
+     * Remove every trace of a domain from a scope: the claim, its status, its nonce — and its entry
+     * in `ssoEnabledDomains`.
+     *
+     * That last one is the half a revocation forgets. `ssoEnabledDomains` is a SECOND claim channel
+     * that the sign-in router consults with its own status gate
+     * (`domain-to-org-lookup.backend.service.ts`), so leaving the domain there while deleting the
+     * status entry produces a half-revoked domain: harmless today, and one status write away from
+     * routing again under a claim nobody believes they still hold.
+     */
+    planDomainRevocation(domains, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        const { [normalizedDomain]: _removedStatus, ...remainingStatus } = domains.domainVerificationStatus;
+        const { [normalizedDomain]: _removedToken, ...remainingTokens } = domains.domainVerificationTokens;
+        return {
+            ...domains,
+            verifiedDomains: domains.verifiedDomains.filter((entry) => entry !== normalizedDomain),
+            ssoEnabledDomains: domains.ssoEnabledDomains.filter((entry) => entry !== normalizedDomain),
+            domainVerificationStatus: remainingStatus,
+            domainVerificationTokens: remainingTokens,
+        };
+    }
+    /** The challenge nonce a scope holds for a domain, if it has claimed one. */
+    getVerificationToken(domains, domain) {
+        return domains.domainVerificationTokens?.[domain.toLowerCase()];
+    }
+    /** The DNS name the operator publishes the TXT record on. */
+    verificationDnsName(domain) {
+        return `${VERIFICATION_SUBDOMAIN}.${domain.toLowerCase()}`;
+    }
+    /**
+     * Resolve the challenge record and say whether it carries the expected nonce.
+     *
+     * Public because the operation that verifies a domain must run the check and persist the outcome
+     * as ONE resource UPDATE; a method that did both would have to write on its own.
+     */
+    async checkDomainChallenge(domain, expectedToken) {
+        return this._checkDnsTxtRecord(domain.toLowerCase(), expectedToken);
+    }
+    // ════════════════════════════════════════════════════════════════════
+    // EXCLUSIVITY
+    // ════════════════════════════════════════════════════════════════════
+    /**
+     * The scope OTHER than `(scopeType, scopeId)` that already holds `domain` VERIFIED, if any.
+     *
+     * ## Why exclusivity is enforced at all
+     *
+     * `DomainToOrgLookupBackendService.findOrgByDomain` returns the FIRST scope whose config matches.
+     * Two scopes holding one domain therefore means a `@customer.com` sign-in routes to whichever the
+     * lookup reaches first — an answer that can change between processes. Nothing prevented that
+     * before, only the fact that reaching the verified state required an out-of-band database write
+     * by two different tenants. A public route makes it reachable.
+     *
+     * ## What this is NOT protecting against
+     *
+     * Worth stating precisely, because it decides how much this check is load-bearing. DNS is already
+     * the defence against TAKEOVER: only whoever controls `customer.com` can publish the nonce, so a
+     * rogue tenant's claim can never be verified. What remains is the real owner verifying the same
+     * domain under two of their own scopes — an ambiguity, not an attack. This check makes that
+     * refuse instead of silently deciding.
+     *
+     * ## Why the scan is exhaustive, and why it is not filtered
+     *
+     * It reads every SSO config row of both scope variants and joins in memory. Two cheaper options
+     * were rejected:
+     *   - `getAllOrganizationIds()` enumerates a warm in-memory cache, so on a cold process it
+     *     reports fewer scopes than exist. An exclusivity check built on it answers "nobody else
+     *     holds it" from an incomplete population;
+     *   - a repository filter on `domains.verifiedDomains` is a nested-array predicate. It works on
+     *     the MongoDB adapter and is not portable to the SQL one, where the block is a JSON column —
+     *     so it would return nothing rather than fail, in the direction that produces a false
+     *     "available".
+     * The cost is bounded by tenant count and paid only on claim and verify, which are rare admin
+     * acts. If it ever stops being cheap, the answer is an indexed projection of the verified set,
+     * not a filter nobody can prove is portable.
+     *
+     * Returns `null` when no other scope holds it. THROWS when it cannot answer — a probe that cannot
+     * read must not be mistaken for a probe that found nothing.
+     */
+    async findConflictingScope(scopeType, scopeId, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        if (!this.systemAccessService) {
+            throw new Error('Domain exclusivity cannot be established without the system-access service; '
+                + 'refusing rather than reporting that no other scope holds this domain.');
         }
-        else {
-            if (!ssoConfig.domains.verifiedDomains.includes(normalizedDomain)) {
-                ssoConfig.domains.verifiedDomains.push(normalizedDomain);
+        const variants = [
+            { scopeType: AuthScopeType.ORGANIZATION, resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG, scopeField: 'organizationId' },
+            { scopeType: AuthScopeType.APPLICATION, resourceType: CoreResourceType.APPLICATION_SSO_CONFIG, scopeField: 'applicationId' },
+        ];
+        for (const variant of variants) {
+            const rows = await this.systemAccessService.listAsSystem(variant.resourceType, {}, undefined, { paginated: false });
+            for (const row of rows ?? []) {
+                const rowScopeId = row[variant.scopeField];
+                if (variant.scopeType === scopeType && rowScopeId === scopeId)
+                    continue;
+                if (!row.domains)
+                    continue;
+                if (!isDomainVerified(row.domains, normalizedDomain))
+                    continue;
+                return { scopeType: variant.scopeType, scopeId: String(rowScopeId ?? '') };
             }
-            ssoConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';
-            ssoConfig.domains.domainVerificationTokens[normalizedDomain] = verificationToken;
-            await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);
         }
+        return null;
+    }
+    // ════════════════════════════════════════════════════════════════════
+    // SELF-WRITING WRAPPERS
+    // ════════════════════════════════════════════════════════════════════
+    /**
+     * Initiate domain verification: generate a token and store it in the scope's SSO config.
+     * Returns the token the admin must add as a DNS TXT record.
+     *
+     * Does NOT check exclusivity — see {@link findConflictingScope}, which the public operation calls
+     * before this planner's patch is persisted. A caller reaching this method directly is asserting
+     * it has already answered that question.
+     */
+    async initiateDomainVerification(ec, scopeType, scopeId, domain) {
+        const normalizedDomain = domain.toLowerCase();
+        const ssoConfig = (await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId))
+            ?? this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId);
+        const plan = this.planDomainClaim(ssoConfig.domains, normalizedDomain);
+        ssoConfig.domains = plan.domains;
+        await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);
         this.logDebug('Domain verification initiated', {
             scopeType,
             scopeId,
             domain: normalizedDomain,
         });
         return {
-            verificationToken,
-            dnsRecord: `${VERIFICATION_PREFIX}${verificationToken}`,
-            dnsName: `${VERIFICATION_SUBDOMAIN}.${normalizedDomain}`,
+            verificationToken: plan.verificationToken,
+            dnsRecord: plan.dnsRecordValue,
+            dnsName: plan.dnsName,
         };
     }
     /**
      * Verify domain ownership by checking DNS TXT records.
-     * Updates the domain's verification status in the org's SSO config.
+     * Updates the domain's verification status in the scope's SSO config.
      */
     async verifyDomainOwnership(ec, scopeType, scopeId, domain) {
         const normalizedDomain = domain.toLowerCase();
@@ -93,7 +266,7 @@ let DomainVerificationBackendService = class DomainVerificationBackendService {
                 dnsRecordsFound: [],
             };
         }
-        const expectedToken = ssoConfig.domains.domainVerificationTokens?.[normalizedDomain];
+        const expectedToken = this.getVerificationToken(ssoConfig.domains, normalizedDomain);
         if (!expectedToken) {
             this.logDebug('No verification token found for domain', {
                 scopeType,
@@ -107,20 +280,19 @@ let DomainVerificationBackendService = class DomainVerificationBackendService {
                 dnsRecordsFound: [],
             };
         }
-        const { verified, recordsFound } = await this._checkDnsTxtRecord(normalizedDomain, expectedToken);
-        const newStatus = verified ? 'verified' : 'failed';
-        ssoConfig.domains.domainVerificationStatus[normalizedDomain] = newStatus;
+        const { verified, recordsFound } = await this.checkDomainChallenge(normalizedDomain, expectedToken);
+        ssoConfig.domains = this.planVerificationOutcome(ssoConfig.domains, normalizedDomain, verified);
         await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);
         this.logDebug('Domain verification result', {
             scopeType,
             scopeId,
             domain: normalizedDomain,
-            status: newStatus,
+            status: verified ? 'verified' : 'failed',
             recordsFound: recordsFound.length,
         });
         return {
             domain: normalizedDomain,
-            status: newStatus,
+            status: verified ? 'verified' : 'failed',
             verificationToken: expectedToken,
             dnsRecordsFound: recordsFound,
         };
@@ -143,7 +315,10 @@ let DomainVerificationBackendService = class DomainVerificationBackendService {
         const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);
         if (!ssoConfig)
             return [];
-        return ssoConfig.domains.verifiedDomains.filter(d => ssoConfig.domains.domainVerificationStatus[d] === 'verified');
+        // The one derivation (#457). This service is also the WRITER that puts a claimed domain into
+        // `verifiedDomains` with status `pending`, so it is the last place that should re-derive the
+        // join it creates the need for.
+        return resolveVerifiedDomains(ssoConfig.domains);
     }
     /**
      * Resolve DNS TXT records for the verification subdomain and check for the expected token.
@@ -173,8 +348,10 @@ DomainVerificationBackendService = __decorate([
     injectable(),
     __param(0, inject(SAAS_SERVICE_TYPES.Logger)),
     __param(1, inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService)),
+    __param(2, inject(SAAS_SERVICE_TYPES.SystemAccessService)),
+    __param(2, optional()),
     __metadata("design:paramtypes", [LoggerService,
-        AuthOrganizationConfigurationService])
+        AuthOrganizationConfigurationService, Function])
 ], DomainVerificationBackendService);
 export { DomainVerificationBackendService };
 //# sourceMappingURL=domain-verification.backend.service.js.map

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-verification.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAYjK,qCAAqC;AACrC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAG9C,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAIW;IAC8B;IAJnE,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD;QADpF,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAExI,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAMd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;QAEvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAQ,CAAC;YAC9F,aAAa,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC3D,aAAa,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;YAC7E,aAAa,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;YACrF,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAClE,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC3D,CAAC;YACD,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;YACxE,SAAS,CAAC,OAAe,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,iBAAiB,CAAC;YAC1F,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB;YACjB,SAAS,EAAE,GAAG,mBAAmB,GAAG,iBAAiB,EAAE;YACvD,OAAO,EAAE,GAAG,sBAAsB,IAAI,gBAAgB,EAAE;SACzD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAI,SAAS,CAAC,OAAe,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,CAAC;QAC9F,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAElG,MAAM,SAAS,GAAkD,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAClG,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,GAAG,SAAS,CAAC;QACzE,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,SAAS;YACjB,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;IACrF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE1B,OAAO,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAC7C,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC,KAAK,UAAU,CAClE,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAIpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,aAAa,GAAG,GAAG,mBAAmB,GAAG,aAAa,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAErD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;gBAC5C,MAAM;gBACN,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAA;AAhLY,gCAAgC;IAD5C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;qCADJ,aAAa;QAC2B,oCAAoC;GAL/H,gCAAgC,CAgL5C","sourcesContent":["/**\n * DomainVerificationBackendService — H4 fix\n *\n * DNS TXT record verification for domain ownership claims.\n * Prevents domain takeover by requiring orgs to prove they own\n * domains before those domains are trusted for SSO routing.\n *\n * Verification flow:\n * 1. Admin claims a domain → service generates a unique verification token\n * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`\n * 3. Admin triggers verification → service resolves DNS TXT and compares tokens\n * 4. On match, domain status becomes 'verified'; on failure, 'failed'\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { randomUUID } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport { AuthScopeType } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/** Result of a domain verification attempt */\nexport interface DomainVerificationResult {\n  domain: string;\n  status: 'pending' | 'verified' | 'failed' | 'expired';\n  verificationToken: string;\n  dnsRecordsFound: string[];\n}\n\n/** Expected DNS TXT record prefix */\nconst VERIFICATION_PREFIX = 'wildo-domain-verification=';\n\n/** DNS TXT record subdomain */\nconst VERIFICATION_SUBDOMAIN = '_wildo-verification';\n\n@injectable()\nexport class DomainVerificationBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n  ) {\n    this.logDebug = this.logger.debugByType('DomainVerification');\n    this.logger.setDebugTypeLogging('DomainVerification', false);\n  }\n\n  /**\n   * Initiate domain verification: generate a token and store it in the org's SSO config.\n   * Returns the token the admin must add as a DNS TXT record.\n   */\n  public async initiateDomainVerification(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<{\n    verificationToken: string;\n    dnsRecord: string;\n    dnsName: string;\n  }> {\n    const normalizedDomain = domain.toLowerCase();\n    const verificationToken = randomUUID();\n\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) {\n      const defaultConfig = this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId) as any;\n      defaultConfig.domains.verifiedDomains = [normalizedDomain];\n      defaultConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';\n      defaultConfig.domains.domainVerificationTokens[normalizedDomain] = verificationToken;\n      await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, defaultConfig);\n    } else {\n      if (!ssoConfig.domains.verifiedDomains.includes(normalizedDomain)) {\n        ssoConfig.domains.verifiedDomains.push(normalizedDomain);\n      }\n      ssoConfig.domains.domainVerificationStatus[normalizedDomain] = 'pending';\n      (ssoConfig.domains as any).domainVerificationTokens[normalizedDomain] = verificationToken;\n      await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n    }\n\n    this.logDebug('Domain verification initiated', {\n      scopeType,\n      scopeId,\n      domain: normalizedDomain,\n    });\n\n    return {\n      verificationToken,\n      dnsRecord: `${VERIFICATION_PREFIX}${verificationToken}`,\n      dnsName: `${VERIFICATION_SUBDOMAIN}.${normalizedDomain}`,\n    };\n  }\n\n  /**\n   * Verify domain ownership by checking DNS TXT records.\n   * Updates the domain's verification status in the org's SSO config.\n   */\n  public async verifyDomainOwnership(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<DomainVerificationResult> {\n    const normalizedDomain = domain.toLowerCase();\n\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) {\n      return {\n        domain: normalizedDomain,\n        status: 'failed',\n        verificationToken: '',\n        dnsRecordsFound: [],\n      };\n    }\n\n    const expectedToken = (ssoConfig.domains as any).domainVerificationTokens?.[normalizedDomain];\n    if (!expectedToken) {\n      this.logDebug('No verification token found for domain', {\n        scopeType,\n        scopeId,\n        domain: normalizedDomain,\n      });\n      return {\n        domain: normalizedDomain,\n        status: 'failed',\n        verificationToken: '',\n        dnsRecordsFound: [],\n      };\n    }\n\n    const { verified, recordsFound } = await this._checkDnsTxtRecord(normalizedDomain, expectedToken);\n\n    const newStatus: 'pending' | 'verified' | 'failed' | 'expired' = verified ? 'verified' : 'failed';\n    ssoConfig.domains.domainVerificationStatus[normalizedDomain] = newStatus;\n    await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n    this.logDebug('Domain verification result', {\n      scopeType,\n      scopeId,\n      domain: normalizedDomain,\n      status: newStatus,\n      recordsFound: recordsFound.length,\n    });\n\n    return {\n      domain: normalizedDomain,\n      status: newStatus,\n      verificationToken: expectedToken,\n      dnsRecordsFound: recordsFound,\n    };\n  }\n\n  /**\n   * Check if a domain is verified for the given scope.\n   */\n  public async isDomainVerified(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<boolean> {\n    const normalizedDomain = domain.toLowerCase();\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return false;\n    return ssoConfig.domains.domainVerificationStatus[normalizedDomain] === 'verified';\n  }\n\n  /**\n   * Get the list of verified domains for the given scope.\n   * Only returns domains with verificationStatus === 'verified'.\n   */\n  public async getVerifiedDomains(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n  ): Promise<string[]> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return [];\n\n    return ssoConfig.domains.verifiedDomains.filter(\n      d => ssoConfig.domains.domainVerificationStatus[d] === 'verified',\n    );\n  }\n\n  /**\n   * Resolve DNS TXT records for the verification subdomain and check for the expected token.\n   */\n  private async _checkDnsTxtRecord(domain: string, expectedToken: string): Promise<{\n    verified: boolean;\n    recordsFound: string[];\n  }> {\n    try {\n      const { Resolver } = await import('node:dns/promises');\n      const resolver = new Resolver();\n      resolver.setServers(['8.8.8.8', '1.1.1.1']);\n\n      const lookupHost = `${VERIFICATION_SUBDOMAIN}.${domain}`;\n      const records = await resolver.resolveTxt(lookupHost);\n      const flat = records.map(r => r.join(''));\n\n      const expectedValue = `${VERIFICATION_PREFIX}${expectedToken}`;\n      const verified = flat.some(r => r === expectedValue);\n\n      return { verified, recordsFound: flat };\n    } catch (error) {\n      this.logDebug('DNS TXT record lookup failed', {\n        domain,\n        error: describeCaughtError(error),\n      });\n      return { verified: false, recordsFound: [] };\n    }\n  }\n}\n"]}
+{"version":3,"file":"domain-verification.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACL,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA8BrI,qCAAqC;AACrC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAG9C,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAIW;IAC8B;IAML;IAV9D,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAM3D,mBAAgD;QAPzE,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAM3D,wBAAmB,GAAnB,mBAAmB,CAA6B;QAE7H,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,6CAA6C;IAC7C,uEAAuE;IACvE,EAAE;IACF,8FAA8F;IAC9F,2FAA2F;IAC3F,2FAA2F;IAC3F,6EAA6E;IAC7E,8CAA8C;IAC9C,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,wBAAwB;IAExB;;;;;;;OAOG;IACI,eAAe,CAAC,OAAyB,EAAE,MAAc;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;QAEvC;;;;;;;;;;;WAWG;QACH,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACjE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC9B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAClD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,OAAO;iBACrD;gBACD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB;iBACtC;aACF;YACD,iBAAiB;YACjB,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YACnD,cAAc,EAAE,GAAG,mBAAmB,GAAG,iBAAiB,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAC5B,OAAyB,EACzB,MAAc,EACd,QAAiB;QAEjB,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,OAAO;YACV,wBAAwB,EAAE;gBACxB,GAAG,OAAO,CAAC,wBAAwB;gBACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;aACnG;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACpG,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACnG,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YACtF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YAC1F,wBAAwB,EAAE,eAAe;YACzC,wBAAwB,EAAE,eAAe;SAC1C,CAAC;IACJ,CAAC;IAED,6EAA6E;IACtE,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,OAAO,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,6DAA6D;IACtD,mBAAmB,CAAC,MAAc;QACvC,OAAO,GAAG,sBAAsB,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAIrE,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,cAAc;IACd,uEAAuE;IAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACI,KAAK,CAAC,oBAAoB,CAC/B,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8EAA8E;kBAC5E,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAoG;YAChH,EAAE,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB,EAAE,UAAU,EAAE,gBAAgB,EAAE;YAC/H,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB,EAAE,UAAU,EAAE,eAAe,EAAE;SAC7H,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACtD,OAAO,CAAC,YAAqB,EAC7B,EAAE,EACF,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACF,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAI,GAA0C,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;oBAAE,SAAS;gBACxE,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,SAAS;gBAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC;oBAAE,SAAS;gBAC/D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,wBAAwB;IACxB,uEAAuE;IAEvE;;;;;;;OAOG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAMd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;eAC/E,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAS,CAAC;QAE/E,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAEpG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;IACrF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE1B,6FAA6F;QAC7F,6FAA6F;QAC7F,gCAAgC;QAChC,OAAO,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAIpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,aAAa,GAAG,GAAG,mBAAmB,GAAG,aAAa,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAErD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;gBAC5C,MAAM;gBACN,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAA;AAhYY,gCAAgC;IAD5C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAM/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAPC,aAAa;QAC2B,oCAAoC;GAL/H,gCAAgC,CAgY5C","sourcesContent":["/**\n * DomainVerificationBackendService — H4 fix\n *\n * DNS TXT record verification for domain ownership claims.\n * Prevents domain takeover by requiring orgs to prove they own\n * domains before those domains are trusted for SSO routing.\n *\n * Verification flow:\n * 1. Admin claims a domain → service generates a unique verification token\n * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`\n * 3. Admin triggers verification → service resolves DNS TXT and compares tokens\n * 4. On match, domain status becomes 'verified'; on failure, 'failed'\n */\n\nimport 'reflect-metadata';\nimport { injectable, inject, optional } from 'inversify';\nimport { randomUUID } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport {\n  resolveVerifiedDomains, AuthScopeType, CoreResourceType, DomainVerificationStatus, isDomainVerified } from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/** Result of a domain verification attempt */\nexport interface DomainVerificationResult {\n  domain: string;\n  status: 'pending' | 'verified' | 'failed' | 'expired';\n  verificationToken: string;\n  dnsRecordsFound: string[];\n}\n\n/** The `domains` block of an SSO config — the only part of the row these planners touch. */\nexport type SsoConfigDomains = SsoConfigBase['domains'];\n\n/** The scope that already holds a domain VERIFIED, when one does. */\nexport interface DomainExclusivityConflict {\n  scopeType: AuthScopeType;\n  scopeId: string;\n}\n\n/** A minted challenge plus the `domains` block that records it. */\nexport interface DomainClaimPlan {\n  domains: SsoConfigDomains;\n  verificationToken: string;\n  dnsName: string;\n  dnsRecordValue: string;\n}\n\n/** Expected DNS TXT record prefix */\nconst VERIFICATION_PREFIX = 'wildo-domain-verification=';\n\n/** DNS TXT record subdomain */\nconst VERIFICATION_SUBDOMAIN = '_wildo-verification';\n\n@injectable()\nexport class DomainVerificationBackendService {\n  private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n  constructor(\n    @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n    @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n    /**\n     * The exclusivity probe reads OTHER scopes' SSO configs, which no tenant-scoped context may do.\n     * `@optional()` so a minimal test container that binds neither still constructs; the probe\n     * itself fails CLOSED when it is absent rather than reporting \"no conflict\".\n     */\n    @inject(SAAS_SERVICE_TYPES.SystemAccessService) @optional() private readonly systemAccessService?: SystemAccessBackendService,\n  ) {\n    this.logDebug = this.logger.debugByType('DomainVerification');\n    this.logger.setDebugTypeLogging('DomainVerification', false);\n  }\n\n  // ════════════════════════════════════════════════════════════════════\n  // PLANNERS — pure, and the reason they exist\n  // ════════════════════════════════════════════════════════════════════\n  //\n  // The three methods below compute a NEW `domains` block and write nothing. That split is what\n  // lets the public `claimDomain` / `verifyDomain` / `revokeDomain` operations (#424) run as\n  // resource-operation PREFIX hooks: the hook returns the patch and the framework's own core\n  // UPDATE persists it, inside the operation's transaction and in front of the\n  // `RESOURCE_OPERATION_PERFORMED` audit event.\n  //\n  // The self-writing wrappers underneath are kept for callers that hold no operation — they simply\n  // load, plan and save. Both paths go through one implementation, so a rule applied to one cannot\n  // drift from the other.\n\n  /**\n   * Mint a challenge for `domain` and return the `domains` block that records it as `pending`.\n   *\n   * Re-claiming an already-claimed domain is legal and deliberate: it mints a FRESH nonce and\n   * resets the status to `pending`. The stored nonce is `.isBackendOnly()` and is disclosed exactly\n   * once, in the claim response, so re-claiming is the only way to recover a lost record value —\n   * and it invalidates the previous one, which is the right direction.\n   */\n  public planDomainClaim(domains: SsoConfigDomains, domain: string): DomainClaimPlan {\n    const normalizedDomain = domain.toLowerCase();\n    const verificationToken = randomUUID();\n\n    /*\n     * ─── THIS is where `verifiedDomains` stops meaning what its name says (#457) ─────────────────\n     *\n     * A domain enters the list at CLAIM time, with status `pending`. So the stored array holds every\n     * CLAIMED domain and the real answer is the join with `domainVerificationStatus` — which is why\n     * `resolveVerifiedDomains` / `isDomainVerified` exist beside the field and every READER goes\n     * through them.\n     *\n     * If you add a write here, write the STATUS in the same step. A domain in the list with no\n     * status entry is claimed-but-unknowable, and every reader treats that as unverified — which is\n     * safe, and silently loses the claim.\n     */\n    return {\n      domains: {\n        ...domains,\n        verifiedDomains: domains.verifiedDomains.includes(normalizedDomain)\n          ? [...domains.verifiedDomains]\n          : [...domains.verifiedDomains, normalizedDomain],\n        domainVerificationStatus: {\n          ...domains.domainVerificationStatus,\n          [normalizedDomain]: DomainVerificationStatus.PENDING,\n        },\n        domainVerificationTokens: {\n          ...domains.domainVerificationTokens,\n          [normalizedDomain]: verificationToken,\n        },\n      },\n      verificationToken,\n      dnsName: this.verificationDnsName(normalizedDomain),\n      dnsRecordValue: `${VERIFICATION_PREFIX}${verificationToken}`,\n    };\n  }\n\n  /**\n   * Record the outcome of a challenge check. `verified` decides between `verified` and `failed`;\n   * there is no third answer, because a check that could not resolve DNS has already been reported\n   * as not-verified by {@link checkDomainChallenge}.\n   */\n  public planVerificationOutcome(\n    domains: SsoConfigDomains,\n    domain: string,\n    verified: boolean,\n  ): SsoConfigDomains {\n    const normalizedDomain = domain.toLowerCase();\n    return {\n      ...domains,\n      domainVerificationStatus: {\n        ...domains.domainVerificationStatus,\n        [normalizedDomain]: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n      },\n    };\n  }\n\n  /**\n   * Remove every trace of a domain from a scope: the claim, its status, its nonce — and its entry\n   * in `ssoEnabledDomains`.\n   *\n   * That last one is the half a revocation forgets. `ssoEnabledDomains` is a SECOND claim channel\n   * that the sign-in router consults with its own status gate\n   * (`domain-to-org-lookup.backend.service.ts`), so leaving the domain there while deleting the\n   * status entry produces a half-revoked domain: harmless today, and one status write away from\n   * routing again under a claim nobody believes they still hold.\n   */\n  public planDomainRevocation(domains: SsoConfigDomains, domain: string): SsoConfigDomains {\n    const normalizedDomain = domain.toLowerCase();\n    const { [normalizedDomain]: _removedStatus, ...remainingStatus } = domains.domainVerificationStatus;\n    const { [normalizedDomain]: _removedToken, ...remainingTokens } = domains.domainVerificationTokens;\n    return {\n      ...domains,\n      verifiedDomains: domains.verifiedDomains.filter((entry) => entry !== normalizedDomain),\n      ssoEnabledDomains: domains.ssoEnabledDomains.filter((entry) => entry !== normalizedDomain),\n      domainVerificationStatus: remainingStatus,\n      domainVerificationTokens: remainingTokens,\n    };\n  }\n\n  /** The challenge nonce a scope holds for a domain, if it has claimed one. */\n  public getVerificationToken(domains: SsoConfigDomains, domain: string): string | undefined {\n    return domains.domainVerificationTokens?.[domain.toLowerCase()];\n  }\n\n  /** The DNS name the operator publishes the TXT record on. */\n  public verificationDnsName(domain: string): string {\n    return `${VERIFICATION_SUBDOMAIN}.${domain.toLowerCase()}`;\n  }\n\n  /**\n   * Resolve the challenge record and say whether it carries the expected nonce.\n   *\n   * Public because the operation that verifies a domain must run the check and persist the outcome\n   * as ONE resource UPDATE; a method that did both would have to write on its own.\n   */\n  public async checkDomainChallenge(domain: string, expectedToken: string): Promise<{\n    verified: boolean;\n    recordsFound: string[];\n  }> {\n    return this._checkDnsTxtRecord(domain.toLowerCase(), expectedToken);\n  }\n\n  // ════════════════════════════════════════════════════════════════════\n  // EXCLUSIVITY\n  // ════════════════════════════════════════════════════════════════════\n\n  /**\n   * The scope OTHER than `(scopeType, scopeId)` that already holds `domain` VERIFIED, if any.\n   *\n   * ## Why exclusivity is enforced at all\n   *\n   * `DomainToOrgLookupBackendService.findOrgByDomain` returns the FIRST scope whose config matches.\n   * Two scopes holding one domain therefore means a `@customer.com` sign-in routes to whichever the\n   * lookup reaches first — an answer that can change between processes. Nothing prevented that\n   * before, only the fact that reaching the verified state required an out-of-band database write\n   * by two different tenants. A public route makes it reachable.\n   *\n   * ## What this is NOT protecting against\n   *\n   * Worth stating precisely, because it decides how much this check is load-bearing. DNS is already\n   * the defence against TAKEOVER: only whoever controls `customer.com` can publish the nonce, so a\n   * rogue tenant's claim can never be verified. What remains is the real owner verifying the same\n   * domain under two of their own scopes — an ambiguity, not an attack. This check makes that\n   * refuse instead of silently deciding.\n   *\n   * ## Why the scan is exhaustive, and why it is not filtered\n   *\n   * It reads every SSO config row of both scope variants and joins in memory. Two cheaper options\n   * were rejected:\n   *   - `getAllOrganizationIds()` enumerates a warm in-memory cache, so on a cold process it\n   *     reports fewer scopes than exist. An exclusivity check built on it answers \"nobody else\n   *     holds it\" from an incomplete population;\n   *   - a repository filter on `domains.verifiedDomains` is a nested-array predicate. It works on\n   *     the MongoDB adapter and is not portable to the SQL one, where the block is a JSON column —\n   *     so it would return nothing rather than fail, in the direction that produces a false\n   *     \"available\".\n   * The cost is bounded by tenant count and paid only on claim and verify, which are rare admin\n   * acts. If it ever stops being cheap, the answer is an indexed projection of the verified set,\n   * not a filter nobody can prove is portable.\n   *\n   * Returns `null` when no other scope holds it. THROWS when it cannot answer — a probe that cannot\n   * read must not be mistaken for a probe that found nothing.\n   */\n  public async findConflictingScope(\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<DomainExclusivityConflict | null> {\n    const normalizedDomain = domain.toLowerCase();\n\n    if (!this.systemAccessService) {\n      throw new Error(\n        'Domain exclusivity cannot be established without the system-access service; '\n        + 'refusing rather than reporting that no other scope holds this domain.',\n      );\n    }\n\n    const variants: ReadonlyArray<{ scopeType: AuthScopeType; resourceType: CoreResourceType; scopeField: string }> = [\n      { scopeType: AuthScopeType.ORGANIZATION, resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG, scopeField: 'organizationId' },\n      { scopeType: AuthScopeType.APPLICATION, resourceType: CoreResourceType.APPLICATION_SSO_CONFIG, scopeField: 'applicationId' },\n    ];\n\n    for (const variant of variants) {\n      const rows = await this.systemAccessService.listAsSystem<SsoConfigBase>(\n        variant.resourceType as never,\n        {},\n        undefined,\n        { paginated: false },\n      ) as SsoConfigBase[];\n\n      for (const row of rows ?? []) {\n        const rowScopeId = (row as unknown as Record<string, unknown>)[variant.scopeField];\n        if (variant.scopeType === scopeType && rowScopeId === scopeId) continue;\n        if (!row.domains) continue;\n        if (!isDomainVerified(row.domains, normalizedDomain)) continue;\n        return { scopeType: variant.scopeType, scopeId: String(rowScopeId ?? '') };\n      }\n    }\n\n    return null;\n  }\n\n  // ════════════════════════════════════════════════════════════════════\n  // SELF-WRITING WRAPPERS\n  // ════════════════════════════════════════════════════════════════════\n\n  /**\n   * Initiate domain verification: generate a token and store it in the scope's SSO config.\n   * Returns the token the admin must add as a DNS TXT record.\n   *\n   * Does NOT check exclusivity — see {@link findConflictingScope}, which the public operation calls\n   * before this planner's patch is persisted. A caller reaching this method directly is asserting\n   * it has already answered that question.\n   */\n  public async initiateDomainVerification(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<{\n    verificationToken: string;\n    dnsRecord: string;\n    dnsName: string;\n  }> {\n    const normalizedDomain = domain.toLowerCase();\n    const ssoConfig = (await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId))\n      ?? (this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId) as any);\n\n    const plan = this.planDomainClaim(ssoConfig.domains, normalizedDomain);\n    ssoConfig.domains = plan.domains;\n    await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n    this.logDebug('Domain verification initiated', {\n      scopeType,\n      scopeId,\n      domain: normalizedDomain,\n    });\n\n    return {\n      verificationToken: plan.verificationToken,\n      dnsRecord: plan.dnsRecordValue,\n      dnsName: plan.dnsName,\n    };\n  }\n\n  /**\n   * Verify domain ownership by checking DNS TXT records.\n   * Updates the domain's verification status in the scope's SSO config.\n   */\n  public async verifyDomainOwnership(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<DomainVerificationResult> {\n    const normalizedDomain = domain.toLowerCase();\n\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) {\n      return {\n        domain: normalizedDomain,\n        status: 'failed',\n        verificationToken: '',\n        dnsRecordsFound: [],\n      };\n    }\n\n    const expectedToken = this.getVerificationToken(ssoConfig.domains, normalizedDomain);\n    if (!expectedToken) {\n      this.logDebug('No verification token found for domain', {\n        scopeType,\n        scopeId,\n        domain: normalizedDomain,\n      });\n      return {\n        domain: normalizedDomain,\n        status: 'failed',\n        verificationToken: '',\n        dnsRecordsFound: [],\n      };\n    }\n\n    const { verified, recordsFound } = await this.checkDomainChallenge(normalizedDomain, expectedToken);\n\n    ssoConfig.domains = this.planVerificationOutcome(ssoConfig.domains, normalizedDomain, verified);\n    await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n    this.logDebug('Domain verification result', {\n      scopeType,\n      scopeId,\n      domain: normalizedDomain,\n      status: verified ? 'verified' : 'failed',\n      recordsFound: recordsFound.length,\n    });\n\n    return {\n      domain: normalizedDomain,\n      status: verified ? 'verified' : 'failed',\n      verificationToken: expectedToken,\n      dnsRecordsFound: recordsFound,\n    };\n  }\n\n  /**\n   * Check if a domain is verified for the given scope.\n   */\n  public async isDomainVerified(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n    domain: string,\n  ): Promise<boolean> {\n    const normalizedDomain = domain.toLowerCase();\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return false;\n    return ssoConfig.domains.domainVerificationStatus[normalizedDomain] === 'verified';\n  }\n\n  /**\n   * Get the list of verified domains for the given scope.\n   * Only returns domains with verificationStatus === 'verified'.\n   */\n  public async getVerifiedDomains(\n    ec: ExecutionContext<any>,\n    scopeType: AuthScopeType,\n    scopeId: string,\n  ): Promise<string[]> {\n    const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n    if (!ssoConfig) return [];\n\n    // The one derivation (#457). This service is also the WRITER that puts a claimed domain into\n    // `verifiedDomains` with status `pending`, so it is the last place that should re-derive the\n    // join it creates the need for.\n    return resolveVerifiedDomains(ssoConfig.domains);\n  }\n\n  /**\n   * Resolve DNS TXT records for the verification subdomain and check for the expected token.\n   */\n  private async _checkDnsTxtRecord(domain: string, expectedToken: string): Promise<{\n    verified: boolean;\n    recordsFound: string[];\n  }> {\n    try {\n      const { Resolver } = await import('node:dns/promises');\n      const resolver = new Resolver();\n      resolver.setServers(['8.8.8.8', '1.1.1.1']);\n\n      const lookupHost = `${VERIFICATION_SUBDOMAIN}.${domain}`;\n      const records = await resolver.resolveTxt(lookupHost);\n      const flat = records.map(r => r.join(''));\n\n      const expectedValue = `${VERIFICATION_PREFIX}${expectedToken}`;\n      const verified = flat.some(r => r === expectedValue);\n\n      return { verified, recordsFound: flat };\n    } catch (error) {\n      this.logDebug('DNS TXT record lookup failed', {\n        domain,\n        error: describeCaughtError(error),\n      });\n      return { verified: false, recordsFound: [] };\n    }\n  }\n}\n"]}

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts

@@ -27,6 +27,7 @@ import type { AuthTokenIssuerBackendService } from '../../../../security/authent
 import type { AuthUserLookupBackendService } from '../../../../security/authentications/services/utils/auth-user-lookup.backend.service';
 import type { AppConfigurationService } from '../../../../config/services/app-configuration.backend.service';
 import { AuditLogsBackendService } from '../../../../compliance/audit-trails/services/audit-logs.backend.service';
+import type { FeatureResolutionBackendService } from '../../../../features/services/feature-resolution.backend.service';
 import { User } from '@wildo-ai/saas-models';
 import type { EmailVerificationInitiatorBackendService } from '../../../../security/authentications/services/email-verification-initiator.backend.service';
 import type { NormalizedUserProfile, ProvisioningConnectionContext, EnterpriseProvisioningConfig } from '../../../../security/authentications/models/sso-connection.backend.schemas';
@@ -58,8 +59,9 @@ export declare class EnterpriseUserProvisioningBackendService {
     private readonly systemAccessService;
     private readonly emailVerificationInitiator;
     private readonly resourcePersistenceUnitOfWork;
+    private readonly featureResolution;
     private readonly logDebug;
-    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, tokenIssuer: AuthTokenIssuerBackendService, auditLogsService: AuditLogsBackendService, appConfigService: AppConfigurationService, userLookup: AuthUserLookupBackendService, systemAccessService: SystemAccessBackendService, emailVerificationInitiator: EmailVerificationInitiatorBackendService, resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService);
+    constructor(logger: LoggerService, errorBuilder: ErrorBuilderBackendService, servicesRegistryHandler: ServicesRegistryHandlerBackendService, authEcFactory: AuthExecutionContextFactoryBackendService, tokenIssuer: AuthTokenIssuerBackendService, auditLogsService: AuditLogsBackendService, appConfigService: AppConfigurationService, userLookup: AuthUserLookupBackendService, systemAccessService: SystemAccessBackendService, emailVerificationInitiator: EmailVerificationInitiatorBackendService, resourcePersistenceUnitOfWork: ResourcePersistenceUnitOfWorkBackendService, featureResolution: FeatureResolutionBackendService);
     /**
      * Create or link a user within an organization from an IdP profile.
      *
@@ -88,6 +90,36 @@ export declare class EnterpriseUserProvisioningBackendService {
      * acquisition-channel, application-fallback, invitation, profile, membership, or link behavior.
      */
     private provisionExistingUser;
+    /**
+     * The population gate in front of the destructive per-user credential clear: reconcile ONLY when
+     * the user was just provisioned into an org that is ACTIVELY directory-managed.
+     *
+     * ### Why the gate exists, measured rather than assumed
+     * `provisionExistingUser` is the shared seam for THREE surfaces — SCIM push, enterprise SAML ACS,
+     * and enterprise OIDC JIT — and until this gate the clear fired on all of them, unconditionally.
+     * So an ordinary enterprise-SSO login into an org with no directory integration at all silently
+     * destroyed that user's password and every enrolled passkey, on every login, while the method's own
+     * docstring described a population ("a user provisioned into a directory-MANAGED org") that no code
+     * anywhere checked. The obligation is real for a managed org and does not exist for an unmanaged
+     * one; the reconciliation sweep this sits beside is only as sound as the rule that says who owes it.
+     *
+     * ### Only an ORGANIZATION scope can be directory-managed
+     * An APPLICATION-scoped enterprise connection has no organization, hence no SCIM token and no
+     * per-org `DIRECTORY_PROVISIONING` feature, hence no directory doing the deprovisioning that makes
+     * a local first factor a bypass. It is skipped, not defaulted.
+     *
+     * ### A failed posture read SKIPS the clear, which is the opposite of the invite-accept gate
+     * `isOrgActivelyDirectoryManaged` deliberately propagates read errors so that its usual caller —
+     * the invite-accept credential BLOCK — fails closed. Here "closed" points the other way: the
+     * dangerous act is the irreversible DESTRUCTION of a live user's only credential, so an
+     * unanswerable posture question must not authorise it. Skipping is safe because nothing is lost by
+     * waiting: the effective policy (`resolveEffectiveAuthPolicy`) already refuses the local method for
+     * a managed user meanwhile, and the clear is retried on this user's next provision and on the org's
+     * next SCIM token mint (see {@link sweepDirectoryManagedCredentialsForOrg}). That is the whole
+     * argument for building the reconciliation first: it is what makes the conservative choice here
+     * affordable.
+     */
+    private _reconcileLocalCredentialsIfOrgIsDirectoryManaged;
     /**
      * Fail-closed status gate for an existing user resolved by email during enterprise
      * provisioning — the shared guard for every {@link provisionEnterpriseUser} entry point (enterprise
@@ -138,6 +170,22 @@ export declare class EnterpriseUserProvisioningBackendService {
      * renders these methods DORMANT for a managed user (`resolveEffectiveAuthPolicy`); this is the
      * compliance-grade DESTRUCTION on top (chosen over dormant-only). See
      * `.claude/plans/auth-24-credential-lifecycle.md`.
+     *
+     * ### It clears; it does NOT decide who owes the clear
+     * This is a destructive PRIMITIVE. Whether the user's org is actually directory-managed is the
+     * CALLER's question, because only the caller knows the scope the provision happened in — see the
+     * `isOrgActivelyDirectoryManaged` gate at the {@link provisionExistingUser} call site, and
+     * {@link sweepDirectoryManagedCredentialsForOrg} for the bulk one. Naming the population here
+     * would put a feature + token read inside a method that is called in a loop.
+     *
+     * ### Why it still swallows, and what changed
+     * The swallow is right and stays: a failed clear must not fail the SCIM provisioning that added
+     * the user, and the effective policy already refuses the local method meanwhile. What was wrong is
+     * that the failure went nowhere — a warn line, and no second attempt, ever. It now RETURNS its
+     * outcome, so the bulk caller can retry and can say out loud which users are still carrying a
+     * first factor in an org that deprovisions through a directory.
+     *
+     * @returns `true` when the clear landed, `false` when it failed (already logged).
      */
     private _reconcileLocalCredentialsForDirectoryManaged;
     /**
@@ -149,8 +197,53 @@ export declare class EnterpriseUserProvisioningBackendService {
      * and best-effort (logged, never thrown — must not fail the token mint). Part 1 (`resolveEffectiveAuthPolicy`)
      * already renders these members dormant the moment the org is managed; this brings the physical DESTRUCTION
      * forward to activation time. See `.claude/plans/auth-24-credential-lifecycle.md`.
+     *
+     * ### The reconciliation contract (what a partial sweep now does instead of nothing)
+     * A member whose clear fails is a LIVE deprovisioning bypass sitting in a now-managed org, and
+     * until this change the whole record of it was one `warn` per user with no second attempt. The
+     * sweep now:
+     *
+     * 1. **Retries the failed set once, in the same pass.** The dominant failure mode at this seam is
+     *    a transient repository/transaction error, and the clear is idempotent — re-issuing
+     *    `{ passwordHash: null, passkeyCredentials: [] }` against an already-cleared row is a no-op
+     *    write, never a second destruction. One retry is what turns "recorded that it stopped" into
+     *    "finished"; a loop is not, because a persistent failure is a defect and must surface, not spin.
+     * 2. **Reports the residual at ERROR, naming every user.** A `warn` is where a security finding
+     *    goes to die: it is below a level-60 gate and it aggregates nothing. The residual is the whole
+     *    point of the sweep, so it is the loud line, with the ids an operator needs to act.
+     * 3. **Returns a structured result**, so a caller that CAN block on it (a future admin-triggered
+     *    re-sweep) is able to; today's caller deliberately does not.
+     *
+     * ### Rejected: verifying convergence by reading the credential rows back
+     * The honest check would be "re-read each row and count who still carries local first-factor
+     * material". It is not available and must not be made available cheaply: `USER_CREDENTIALS` opts
+     * into `systemAccessPolicy` `create` + `update` ONLY, so `readAsSystem` fails closed by design —
+     * that row holds the password hash, the TOTP secret and the hashed backup codes, and opening a
+     * trusted system READ door onto it for every future caller is a worse trade than living with a
+     * write-outcome-only signal. The write's own success is therefore the observation, and the
+     * re-run below is what covers the case where the write lied.
+     *
+     * ### Rejected: throwing on a non-converged sweep
+     * The caller is the SCIM token mint — the act that MAKES the org directory-managed. Refusing it
+     * because some member's old password could not be destroyed would block the activation whose
+     * safety this exists to improve, and would leave the org unmanaged with every local credential
+     * intact: strictly the worse state. Proceed-and-record is the correct posture, the same shape
+     * `.claude/rules/administrative-continuity-floors.md` prescribes for an acknowledged floor breach —
+     * the RECORD is the control.
+     *
+     * ### Where the re-run comes from
+     * This pass is safe to repeat, so it does not need a scheduler of its own. It re-runs on every
+     * SCIM token mint for the org (rotation included), and each individual member is re-reconciled on
+     * their next enterprise provision through the gated {@link provisionExistingUser} call site. What
+     * remains uncovered is a member who is never re-provisioned and whose org never rotates its token;
+     * for them the effective-policy block (part 1) is the standing control, and the ERROR line above is
+     * the operator's cue.
      */
-    sweepDirectoryManagedCredentialsForOrg(organizationId: string): Promise<void>;
+    sweepDirectoryManagedCredentialsForOrg(organizationId: string): Promise<{
+        membersExamined: number;
+        cleared: number;
+        stillCarryingLocalCredentials: string[];
+    }>;
     /**
      * Update an existing org user's profile attributes.
      * FUTURE: Called by SCIM PATCH/PUT handlers (Step 20).

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-user-provisioning.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAOjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAEhJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,EAQL,IAAI,EAQL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAQlK,OAAO,KAAK,EAEV,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC7B,MAAM,mFAAmF,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAKtB,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAEzG,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAxBhD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EACpE,WAAW,EAAE,6BAA6B,EACzC,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACpC,UAAU,EAAE,4BAA4B,EAO1C,mBAAmB,EAAE,0BAA0B,EAKjC,0BAA0B,EAAE,wCAAwC,EAElI,6BAA6B,EAAE,2CAA2C;IAU7F;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,6BAA6B,EACzC,kBAAkB,EAAE,4BAA4B,EAChD,aAAa,GAAE,mCAAwC,GACtD,OAAO,CAAC,yBAAyB,CAAC;IAkRrC;;;;;;OAMG;YACW,8BAA8B;IA2C5C;;;;;;OAMG;YACW,qBAAqB;IA2KnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;;;;;;;OAgBG;YACW,6CAA6C;IAkB3D;;;;;;;;;OASG;IACU,sCAAsC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6B1F;;;OAGG;IACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EAC/F,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,IAAI,CAAC;IAkChB;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,4BAA4B,GAC/C,OAAO,CAAC,IAAI,CAAC;IAoFhB;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAqB9G;;;;;OAKG;YACW,mBAAmB;IA+IjC;;;;;OAKG;YACW,6BAA6B;YAiD7B,kBAAkB;IAqGhC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;YACW,2BAA2B;CAG1C"}
+{"version":3,"file":"enterprise-user-provisioning.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAOjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAEhJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAE/H,OAAO,EAQL,IAAI,EAQL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAQlK,OAAO,KAAK,EAEV,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC7B,MAAM,mFAAmF,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAKtB,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAEzG,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAMO,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IA9BzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EACpE,WAAW,EAAE,6BAA6B,EACzC,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACpC,UAAU,EAAE,4BAA4B,EAO1C,mBAAmB,EAAE,0BAA0B,EAKjC,0BAA0B,EAAE,wCAAwC,EAElI,6BAA6B,EAAE,2CAA2C,EAMrB,iBAAiB,EAAE,+BAA+B;IAU1H;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,6BAA6B,EACzC,kBAAkB,EAAE,4BAA4B,EAChD,aAAa,GAAE,mCAAwC,GACtD,OAAO,CAAC,yBAAyB,CAAC;IAkRrC;;;;;;OAMG;YACW,8BAA8B;IA2C5C;;;;;;OAMG;YACW,qBAAqB;IAuKnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,iDAAiD;IA+B/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,6CAA6C;IAoB3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACU,sCAAsC,CACjD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,6BAA6B,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAuDjG;;;OAGG;IACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EAC/F,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,IAAI,CAAC;IAkChB;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,4BAA4B,GAC/C,OAAO,CAAC,IAAI,CAAC;IAoFhB;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAqB9G;;;;;OAKG;YACW,mBAAmB;IA+IjC;;;;;OAKG;YACW,6BAA6B;YAiD7B,kBAAkB;IAqGhC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;YACW,2BAA2B;CAG1C"}