@wildo-ai/saas-backend-lib 1.1.2 → 1.1.4

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-headers.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-headers.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EAC9D,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,GACxD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js

@@ -0,0 +1,75 @@
+/**
+ * Merging engine-owned headers over a header set the engine does not control.
+ *
+ * ## The defect this exists to remove
+ *
+ * Every outbound arm in the engine composes its request headers the same way: take a set the
+ * PROVIDER supplied (transport headers off a runtime contract, a harvested REST catalogue's
+ * `defaultHeaders`) and apply the engine's own credential over the top. Written as an object
+ * literal that reads as safe, and four arms carried a JSDoc saying so — a variant of *"it is
+ * applied AFTER the provider's headers, so a provider cannot take authentication over by naming
+ * that header"*.
+ *
+ * **That reasoning holds only for an IDENTICAL spelling.** HTTP header names are case-insensitive;
+ * a JavaScript object's keys are not. A provider naming `Authorization` while the engine writes
+ * `authorization` produces TWO DISTINCT KEYS, and neither `fetch` nor `Headers` treats the later
+ * one as a replacement — they are COMBINED into a single comma-joined field value:
+ *
+ * ```
+ * authorization: Bearer provider-chosen, Basic QUMtYWNjb3VudDpzM2NyM3Q=
+ * ```
+ *
+ * That is strictly worse than the takeover the ordering was defending against. A takeover
+ * authenticates as the provider; a combination authenticates as NOBODY, so the arm fails closed
+ * against its vendor with a credential error that names neither cause. It is a provider-caused
+ * outage the arm's own promise says cannot happen.
+ *
+ * ## Why the collision is likely rather than theoretical
+ *
+ * The two spellings are not equally probable. `WildoHeaderKeys.AUTHORIZATION` is `authorization`,
+ * lower-case, while `Authorization` is the conventional spelling throughout vendor documentation —
+ * so the colliding case is the one a provider author writes BY DEFAULT, and the safe one is the
+ * one they would have to be told to write.
+ *
+ * ## Why a shared function rather than a filter per arm
+ *
+ * Five sites merge these two sources, and the defect had already been fixed at one of them by hand
+ * before anyone counted the rest. A predicate applied N times is a predicate that will be applied
+ * N-1 times; the invariant belongs somewhere a new arm reaches by calling rather than by
+ * remembering. See `.claude/rules/invariant-call-site-enumeration.md` — "prefer making the
+ * invariant unbypassable over applying it N times".
+ *
+ * ## Why DROP rather than REFUSE
+ *
+ * A provider that names the engine's credential header has made a mistake, not an attack. Refusing
+ * the request would turn a harmless declaration into a dead capability — on the SMS arm, one that
+ * carries phone verification and the second factor. The engine's value is authoritative either
+ * way, so dropping the provider's key restores exactly the promise the JSDoc always made.
+ */
+/**
+ * The provider's headers, with every case-insensitive spelling of an engine-owned header removed,
+ * and the engine's own values applied over the result.
+ *
+ * The returned record is safe to hand to `fetch`: no two of its keys name the same HTTP header, so
+ * the `Headers` layer has nothing to combine.
+ *
+ * `engineOwned` wins unconditionally — that is what makes it engine-owned. Keys of `engineOwned`
+ * whose value is `undefined` are omitted rather than sent empty, so a caller may build its set
+ * conditionally without an intermediate spread.
+ *
+ * @param providerSupplied Headers the engine did not author: a provider contract's transport
+ *   headers, a harvested catalogue's `defaultHeaders`, or any set crossing a trust boundary.
+ * @param engineOwned Headers the engine owns and that must reach the wire exactly once — the
+ *   credential, and anything else whose value a provider must not influence.
+ */
+export function withEngineOwnedHeaders(providerSupplied, engineOwned) {
+    const reserved = new Set(Object.keys(engineOwned).map((name) => name.toLowerCase()));
+    const merged = Object.fromEntries(Object.entries(providerSupplied ?? {}).filter(([name]) => !reserved.has(name.toLowerCase())));
+    for (const [name, value] of Object.entries(engineOwned)) {
+        if (value !== undefined) {
+            merged[name] = value;
+        }
+    }
+    return merged;
+}
+//# sourceMappingURL=outbound-request-headers.backend.utils.js.map

package/dist/esm/security/outbound/outbound-request-headers.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-request-headers.backend.utils.js","sourceRoot":"","sources":["../../../../src/security/outbound/outbound-request-headers.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,gBAA8D,EAC9D,WAAyD;IAEzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAErF,MAAM,MAAM,GAA2B,MAAM,CAAC,WAAW,CACvD,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAC7F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Merging engine-owned headers over a header set the engine does not control.\n *\n * ## The defect this exists to remove\n *\n * Every outbound arm in the engine composes its request headers the same way: take a set the\n * PROVIDER supplied (transport headers off a runtime contract, a harvested REST catalogue's\n * `defaultHeaders`) and apply the engine's own credential over the top. Written as an object\n * literal that reads as safe, and four arms carried a JSDoc saying so — a variant of *\"it is\n * applied AFTER the provider's headers, so a provider cannot take authentication over by naming\n * that header\"*.\n *\n * **That reasoning holds only for an IDENTICAL spelling.** HTTP header names are case-insensitive;\n * a JavaScript object's keys are not. A provider naming `Authorization` while the engine writes\n * `authorization` produces TWO DISTINCT KEYS, and neither `fetch` nor `Headers` treats the later\n * one as a replacement — they are COMBINED into a single comma-joined field value:\n *\n * ```\n * authorization: Bearer provider-chosen, Basic QUMtYWNjb3VudDpzM2NyM3Q=\n * ```\n *\n * That is strictly worse than the takeover the ordering was defending against. A takeover\n * authenticates as the provider; a combination authenticates as NOBODY, so the arm fails closed\n * against its vendor with a credential error that names neither cause. It is a provider-caused\n * outage the arm's own promise says cannot happen.\n *\n * ## Why the collision is likely rather than theoretical\n *\n * The two spellings are not equally probable. `WildoHeaderKeys.AUTHORIZATION` is `authorization`,\n * lower-case, while `Authorization` is the conventional spelling throughout vendor documentation —\n * so the colliding case is the one a provider author writes BY DEFAULT, and the safe one is the\n * one they would have to be told to write.\n *\n * ## Why a shared function rather than a filter per arm\n *\n * Five sites merge these two sources, and the defect had already been fixed at one of them by hand\n * before anyone counted the rest. A predicate applied N times is a predicate that will be applied\n * N-1 times; the invariant belongs somewhere a new arm reaches by calling rather than by\n * remembering. See `.claude/rules/invariant-call-site-enumeration.md` — \"prefer making the\n * invariant unbypassable over applying it N times\".\n *\n * ## Why DROP rather than REFUSE\n *\n * A provider that names the engine's credential header has made a mistake, not an attack. Refusing\n * the request would turn a harmless declaration into a dead capability — on the SMS arm, one that\n * carries phone verification and the second factor. The engine's value is authoritative either\n * way, so dropping the provider's key restores exactly the promise the JSDoc always made.\n */\n\n/**\n * The provider's headers, with every case-insensitive spelling of an engine-owned header removed,\n * and the engine's own values applied over the result.\n *\n * The returned record is safe to hand to `fetch`: no two of its keys name the same HTTP header, so\n * the `Headers` layer has nothing to combine.\n *\n * `engineOwned` wins unconditionally — that is what makes it engine-owned. Keys of `engineOwned`\n * whose value is `undefined` are omitted rather than sent empty, so a caller may build its set\n * conditionally without an intermediate spread.\n *\n * @param providerSupplied Headers the engine did not author: a provider contract's transport\n *   headers, a harvested catalogue's `defaultHeaders`, or any set crossing a trust boundary.\n * @param engineOwned Headers the engine owns and that must reach the wire exactly once — the\n *   credential, and anything else whose value a provider must not influence.\n */\nexport function withEngineOwnedHeaders(\n  providerSupplied: Readonly<Record<string, string>> | undefined,\n  engineOwned: Readonly<Record<string, string | undefined>>,\n): Record<string, string> {\n  const reserved = new Set(Object.keys(engineOwned).map((name) => name.toLowerCase()));\n\n  const merged: Record<string, string> = Object.fromEntries(\n    Object.entries(providerSupplied ?? {}).filter(([name]) => !reserved.has(name.toLowerCase())),\n  );\n\n  for (const [name, value] of Object.entries(engineOwned)) {\n    if (value !== undefined) {\n      merged[name] = value;\n    }\n  }\n\n  return merged;\n}\n"]}

package/dist/esm/security/scim/controllers/scim.backend.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAsC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAI5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAwCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}
+{"version":3,"file":"scim.backend.controller.d.ts","sourceRoot":"","sources":["../../../../../src/security/scim/controllers/scim.backend.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,kBAAkB,CAAC;AAK1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,EAAE,mBAAmB,EAAE,MAAM,kEAAkE,CAAC;AACvG,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AAEzJ,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,EAAE,wCAAwC,EAAE,MAAM,gHAAgH,CAAC;AAI1K,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AACzH,OAAO,EAAE,gCAAgC,EAAE,MAAM,0FAA0F,CAAC;AAuC5I,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EAAE,uBAAuB,EAAE,MAAM,+DAA+D,CAAC;AACxG,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,qBACa,4BAA6B,SAAQ,gCAAgC;IAWnB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAI9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;gBAbjD,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EACxC,YAAY,EAAE,mBAAmB,EACL,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EAClD,mBAAmB,EAAE,wCAAwC,EAC9E,gBAAgB,EAAE,uBAAuB,EACrB,gBAAgB,EAAE,oCAAoC,EACnE,gBAAgB,EAAE,uBAAuB,EAChD,gBAAgB,EAAE,uBAAuB,EAItC,mBAAmB,EAAE,0BAA0B;IASlH,SAAS,CAAC,WAAW,IAAI,IAAI;YAyCf,yBAAyB;YAkIzB,4BAA4B;YAgB5B,cAAc;YAUd,oBAAoB;YAcpB,iBAAiB;YA4DjB,cAAc;YA8Bd,gBAAgB;YA6DhB,kBAAkB;YAqElB,gBAAgB;YAsGhB,iBAAiB;YAuCjB,WAAW;YAyEX,qBAAqB;IA8InC,OAAO,CAAC,oBAAoB;IAwB5B,OAAO,CAAC,qBAAqB;IAiD7B,OAAO,CAAC,oBAAoB;YAqBd,cAAc;YAed,eAAe;YASf,oBAAoB;IAalC;;;;;;;;;;;;;OAaG;IACH;;;;;;;OAOG;YACW,sBAAsB;IAuCpC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,gCAAgC;IA0D9C,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;IAoCxB,OAAO,CAAC,UAAU;YAIJ,gCAAgC;IAiB9C,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,WAAW;YAQL,4BAA4B;CAG3C"}

package/dist/esm/security/scim/controllers/scim.backend.controller.js

@@ -42,9 +42,9 @@ import { EnterpriseUserProvisioningBackendService } from '../../../security/auth
 import { buildEnterpriseConnectionScope } from '../../../security/authentications/models/sso-connection.backend.schemas.js';
 import { AuditLogsBackendService } from '../../../compliance/audit-trails/services/audit-logs.backend.service.js';
 import { AbstractControllerBackendService } from '../../../base-classes/services/controllers/abstract-controller.backend.service.js';
-import { CoreResourceType, UserStatus, ErrorType, isWildoBackendError, AuthScopeType, ExternalIdentitySource, SsoConnectionType, WildoHeaderKeys, } from '@wildo-ai/saas-models';
+import { resolveVerifiedDomains, CoreResourceType, UserStatus, ErrorType, isWildoBackendError, AuthScopeType, ExternalIdentitySource, SsoConnectionType, WildoHeaderKeys, } from '@wildo-ai/saas-models';
 import { resolveScimAttributePath } from '../../../security/scim/utils/scim-attribute-path-resolver.backend.utils.js';
-import { SCIM_USER_ATTRIBUTE_MAP, SCIM_SCHEMAS, SCIM_CONTENT_TYPE, SCIM_SERVICE_PROVIDER_CONFIG, SCIM_USER_SCHEMA_DEFINITION, SCIM_RESOURCE_TYPES, extractScimDirectoryUnitValue, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
+import { SCIM_USER_ATTRIBUTE_MAP, SCIM_SCHEMAS, SCIM_CONTENT_TYPE, buildScimServiceProviderConfig, SCIM_USER_SCHEMA_DEFINITION, SCIM_RESOURCE_TYPES, extractScimDirectoryUnitValue, } from '../../../security/scim/models/scim-protocol.backend.schemas.js';
 import { isScimOrganizationUnitManagementEnabled, resolveScimOrganizationUnitId, resolveScimOrganizationUnitReconciliation, } from '@wildo-ai/saas-models';
 import { parseSCIMFilter } from '../../../security/scim/utils/scim-filter-parser.js';
 import { formatUserAsSCIM, formatListAsSCIM, formatSCIMError } from '../../../security/scim/utils/scim-response-formatter.js';
@@ -202,7 +202,18 @@ let SCIMControllerBackendService = class SCIMControllerBackendService extends Ab
     // Discovery Endpoints
     // ═══════════════════════════════════════════════════════════════
     async _handleServiceProviderConfig(_req, res) {
-        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json(SCIM_SERVICE_PROVIDER_CONFIG);
+        /*
+         * The two documentation URLs come from the application (`auth.scimDocumentation`) and are
+         * OMITTED when it declares none — see `buildScimServiceProviderConfig`. Read through
+         * `isInitialized()` because this is a public discovery endpoint: it must answer with the
+         * implementation's own facts even on a runtime whose configuration has not landed, rather than
+         * throw and leave a directory administrator with a 500 where the RFC promises a document.
+         */
+        const scimDocumentation = this.appConfigService.isInitialized()
+            ? this.appConfigService.config.auth?.scimDocumentation
+            : undefined;
+        res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE)
+            .json(buildScimServiceProviderConfig(scimDocumentation));
     }
     async _handleSchemas(_req, res) {
         res.set(WildoHeaderKeys.CONTENT_TYPE, SCIM_CONTENT_TYPE).json({
@@ -835,8 +846,9 @@ let SCIMControllerBackendService = class SCIMControllerBackendService extends Ab
         try {
             const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, AuthScopeType.ORGANIZATION, organizationId);
             if (ssoConfig) {
-                // Only include domains that have passed DNS verification (H4)
-                allowedDomains = ssoConfig.domains.verifiedDomains.filter(d => ssoConfig.domains.domainVerificationStatus[d] === 'verified');
+                // Only include domains that have passed DNS verification (H4). Through the one derivation
+                // (#457) rather than a fifth hand-written join — the stored list holds CLAIMED domains.
+                allowedDomains = resolveVerifiedDomains(ssoConfig.domains);
             }
         }
         catch {