npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/security/authentications/services/admin-config/auth-organization-configuration.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-organization-configuration.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/auth-organization-configuration.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;;;;;;;;;;;;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAOnH;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAS;IACpE,cAAc,CAAC,SAAS;IACxB,cAAc,CAAC,SAAS;CACzB,CAAC,CAAC;AAGI,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAOF;IACY;IAPjD,UAAU,GAA+B,IAAI,GAAG,EAAE,CAAC;IACnD,iBAAiB,GAAsC,IAAI,GAAG,EAAE,CAAC;IACjE,qBAAqB,GAAsF,EAAE,CAAC;IAC5G,QAAQ,CAA+D;IAEjF,YAC6C,MAAqB,EACT,SAAoB;QADhC,WAAM,GAAN,MAAM,CAAe;QACT,cAAS,GAAT,SAAS,CAAW;QAE3E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;OAIG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACtH,CAAC;IAED;;;;OAIG;IACK,sBAAsB;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChG,CAAC;IAED;qGACiG;IACzF,eAAe;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChG,CAAC;IAED;;;;;;OAMG;IACK,8BAA8B,CAAC,MAA2C;QAChF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,WAAW,IAAI,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,oEAAoE,WAAW,8DAA8D;oBACtJ,WAAW;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IAEzB,SAAS,CAAC,SAAwB,EAAE,OAAe;QACzD,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,SAAwB,EAAE,OAAe;QAC5D,OAAO,EAAE,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IACtG,CAAC;IAED;;;;;;;OAOG;IACK,0BAA0B,CAChC,SAAwB,EACxB,OAAe;QAEf,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE;YAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,0CAA0C,CACtD,YAA8B,EAC9B,SAAwB,EACxB,OAAe,EACf,WAAoC;QAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,cAAc,CAAI,YAAY,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC5D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,CACjB,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,uFAAuF,EAAE;oBACrG,YAAY;oBACZ,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,WAAW,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,SAAwB;QACtD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,uBAAuB;YAC1C,CAAC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IAEO,kCAAkC,CAAC,SAAwB;QACjE,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACnD,CAAC;IAEO,wBAAwB,CAAC,SAAwB;QACvD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,+BAA+B;YAClD,CAAC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IACtD,CAAC;IAEO,8BAA8B,CAAC,SAAwB;QAC7D,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,qCAAqC;YACxD,CAAC,CAAC,gBAAgB,CAAC,oCAAoC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACI,qBAAqB;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,oBAAoB;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kCAAkC;IAClC,oBAAoB;IACpB,kCAAkC;IAElC;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,gFAAgF;YAChF,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACpD,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,qBAAqB,CAAC,SAAwB,EAAE,OAAe;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,yDAAyD,EAAE;gBACvE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,yBAAyB,CACpC,SAAwB,EACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC/C,YAAY,EACZ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAC/D,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,6BAA6B,CAAC,SAAwB,EAAE,YAAoB;QACvF,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAAoB,YAAY,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oCAAoC,CAAC,SAAwB,EAAE,QAAgB;QAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAAoB,YAAY,EAAE;YAC/F,QAAQ,EAAE,WAAW,CAAC,IAAI;YAC1B,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAA8B;QAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAgB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACvG,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAAmB,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACpD,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,sDAAsD;IACtD,kCAAkC;IAElC,kEAAkE;IAC3D,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,aAAa,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,yBAAyB,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,sBAAsB,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,qBAAqB,CAAC,cAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACrF,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;eACjE,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,sBAAsB,CACjC,cAAsB,EACtB,WAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1E,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACzD,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAClE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,sBAAsB;IACtB,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,UAAU,IAAI,KAAK,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAK1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO;YACL;;;;;;eAMG;YACH,QAAQ,EAAE,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YACjD,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YACnD,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,KAAK;SAC7D,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IAEI,iBAAiB,CAAC,MAA8B;QACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAI,MAAoD,CAAC,KAAK,CAAC;YAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAE3B,cAAc,CAAC,QAAoF;QACxG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,SAAwB,EAAE,OAAe,EAAE,MAAqB;QACzF,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC5C,IAAI,CAAC;gBACH,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,qBAAqB;IACrB,kCAAkC;IAE3B,sBAAsB,CAAC,SAAwB,EAAE,OAAe;QACrE,OAAO;YACL,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;YACxC,WAAW,EAAE;gBACX,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,IAAI;gBAC3B,kBAAkB,EAAE,CAAC;aACtB;YACD,OAAO,EAAE;gBACP,eAAe,EAAE,EAAE;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,aAAa,EAAE,IAAI;gBACnB,oBAAoB,EAAE,KAAK;gBAC3B,wBAAwB,EAAE,EAAE;gBAC5B,wBAAwB,EAAE,EAAE;aAC7B;YACD,YAAY,EAAE;gBACZ,eAAe,EAAE,IAAI;gBACrB,eAAe,EAAE,IAAI;gBACrB,mBAAmB,EAAE,KAAK;gBAC1B,kBAAkB,EAAE,CAAC,OAAO,CAAC;gBAC7B,kBAAkB,EAAE,EAAE;aACvB;YACD,eAAe,EAAE;gBACf,yBAAyB,EAAE,GAAG;gBAC9B,yBAAyB,EAAE,IAAI;gBAC/B,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,CAAC;aACzB;YACD,WAAW,EAAE;gBACX,eAAe,EAAE,IAAI;gBACrB,oBAAoB,EAAE,IAAI;gBAC1B,cAAc,EAAE,IAAI;gBACpB,mBAAmB,EAAE,KAAK;gBAC1B,aAAa,EAAE,GAAG;aACnB;YACD,8FAA8F;YAC9F,oFAAoF;YACpF,6FAA6F;YAC7F,qFAAqF;YACrF,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,EAAE;aACvB;YACD,0BAA0B,EAAE;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,wBAAwB,EAAE,KAAK;aAChC;SACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACpG,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAClG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,gFAAgF;YAChF,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBAC5D,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAAqC;QAC3I,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAuB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9G,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAA0B,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBAC5D,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAClC,CAAC;IAED,kCAAkC;IAClC,kCAAkC;IAClC,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,0BAA0B,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC1G,KAAK,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAClE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAA2C;QAE3C,yFAAyF;QACzF,4FAA4F;QAC5F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAA6B,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACpH,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAClE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAptBY,oCAAoC;IADhD,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;qCADc,aAAa;QACE,SAAS;GARlE,oCAAoC,CAotBhD","sourcesContent":["/*\n Organization Configuration Service\n \n Scope-aware service for managing SSO enforcement, authentication policies,\n * SIEM export, and SCIM provisioning configuration.\n * Supports both organization-level and application-level scopes.\n /\n\nimport { Container, injectable, inject } from 'inversify';\nimport {\n resolveVerifiedDomains,\n CoreResourceType,\n AuthScopeType,\n SsoProtocol,\n SsoConfigBaseSchema,\n isWildoBackendError,\n ErrorType,\n CORE_ORG_ROLES,\n type SsoConfigBase,\n type SsoConnectionBase,\n type SiemExportConfigBase,\n type ScimProvisioningConfigBase,\n} from '@wildo-ai/saas-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ZodSafeParseError } from 'zod';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/\n Org roles that carry administrative control over a tenant. A SCIM-provisioning\n * `defaultRole` — the fallback role assigned to a directory-pushed user when the IdP\n * payload maps no stronger role — must never be one of these: otherwise an org-admin who\n * (mis)configures SCIM turns \"the directory can push users\" into \"the directory can mint\n * admins\", a privilege-escalation vector where the IdP effectively controls tenant admin\n * membership. `ORG_MANAGER` is elevated but not full-control, so it is allowed. Custom\n * (non-core) roles are the app's own responsibility — the framework can only reason about\n * the roles it defines.\n /\nconst ADMIN_GRANTING_ORG_ROLES: ReadonlySet<string> = new Set<string>([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n]);\n\n@injectable()\nexport class AuthOrganizationConfigurationService {\n private ssoConfigs: Map<string, SsoConfigBase> = new Map();\n private siemExportConfigs: Map<string, SiemExportConfigBase> = new Map();\n private configChangeListeners: Array<(scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase) => void> = [];\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n ) {\n this.logDebug = this.logger.debugByType('AuthOrganizationConfigurationService');\n this.logger.setDebugTypeLogging('AuthOrganizationConfigurationService', false);\n }\n\n /\n Organization auth configuration is consulted by services that are themselves\n * created through the services registry, so we resolve the registry lazily to\n * avoid re-entering the same singleton graph during backend startup.\n /\n private getServicesRegistryHandler(): ServicesRegistryHandlerBackendService {\n return this.container.get<ServicesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService);\n }\n\n /\n Late-resolved like the registry above. The ACL-bypassing system read used to\n * load org config during login (the authenticating user is not the config's admin\n * owner) lives on this dedicated, deliberately-resolved service (Guard 3).\n /\n private getSystemAccessService(): SystemAccessBackendService {\n return this.container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n }\n\n /* Late-resolved (this service late-resolves all its collaborators to avoid re-entering the\n * singleton graph during backend startup). Used to build the SCIM `defaultRole` guard error. /\n private getErrorBuilder(): ErrorBuilderBackendService {\n return this.container.get<ErrorBuilderBackendService>(SAAS_SERVICE_TYPES.ErrorBuilderService);\n }\n\n /\n Reject a SCIM provisioning `defaultRole` that would grant tenant-admin control. Called on the\n * write path so a mis-authored config never reaches the runtime that assigns it to every\n * IdP-pushed user lacking a mapped role (see {@link ADMIN_GRANTING_ORG_ROLES}). Only the CORE\n * admin roles are checked — custom roles are the app's own responsibility. A no-op when\n * `defaultRole` is absent or is a non-admin role.\n /\n private _assertNonAdminScimDefaultRole(config: Partial<ScimProvisioningConfigBase>): void {\n const defaultRole = config.defaultRole;\n if (defaultRole && ADMIN_GRANTING_ORG_ROLES.has(defaultRole)) {\n throw this.getErrorBuilder().buildError(ErrorType.VALIDATION, undefined, {\n context: {\n message: `SCIM provisioning defaultRole cannot be an administrative role (\"${defaultRole}\"): a directory push must not be able to mint tenant admins.`,\n defaultRole,\n },\n });\n }\n }\n\n // ── Scope resolution helpers ──\n\n private _cacheKey(scopeType: AuthScopeType, scopeId: string): string {\n return `${scopeType}:${scopeId}`;\n }\n\n private _scopeFilter(scopeType: AuthScopeType, scopeId: string): Record<string, string> {\n return { [scopeType === AuthScopeType.ORGANIZATION ? 'organizationId' : 'applicationId']: scopeId };\n }\n\n /\n Build the `scopeContext` that `readAsSystem` routes into the synthesised\n * internal EC's `contextResourcesFieldIdentifier` (the WHICH-resources-in-scope\n * channel — NOT `initiatorIds`, which the internal EC fail-closed rejects\n * identity fields on), so the system read is scoped to the correct tenant FK.\n * Mirrors `_scopeFilter` in intent — the filter narrows the query, the scope\n * context narrows the EC.\n /\n private _scopeContextForResolution(\n scopeType: AuthScopeType,\n scopeId: string,\n ): { organizationId?: string; applicationId?: string } {\n return scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scopeId }\n : { applicationId: scopeId };\n }\n\n /\n Materialise a per-scope singleton's disabled-default row via the trusted\n * system-write primitive, TOLERATING the one-per-scope unique-index race.\n \n These enterprise-config singletons carry a UNIQUE index on their scope FK\n * (the polymorphism engine's singleton business-key ⇒ `.isUnique()` convention),\n * so two concurrent loaders that both observe the row absent will both attempt\n * the lazy-create — exactly one wins, and the loser's insert fails closed with a\n * duplicate-key error. That race is BENIGN (the winner wrote the identical\n * disabled-default row), so we swallow it: re-read and return the row the winner\n * created rather than surfacing a spurious error on the login/audit path (which\n * would re-introduce a smaller echo of the very FATAL this whole change removed).\n * Only a GENUINE create failure — one whose re-read ALSO finds nothing — is\n * re-thrown to the caller's resilient catch. The re-read-if-absent shape is\n * deliberately error-type-agnostic: it recovers from the unique-index race and\n * from any transient create failure where the row nonetheless landed.\n /\n private async _createScopeSingletonDefaultToleratingRace<T>(\n resourceType: CoreResourceType,\n scopeType: AuthScopeType,\n scopeId: string,\n defaultData: Record<string, unknown>,\n ): Promise<T> {\n const scopeContext = this._scopeContextForResolution(scopeType, scopeId);\n try {\n return await this.getSystemAccessService().createAsSystem<T>(resourceType, defaultData, { scopeContext });\n } catch (createError) {\n const raced = await this.getSystemAccessService().readAsSystem<T>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext },\n );\n if (raced) {\n this.logDebug('Lazy-default create lost the one-per-scope race; returning the row the winner created', {\n resourceType,\n scopeType,\n scopeId,\n });\n return raced;\n }\n throw createError;\n }\n }\n\n private _resolveSsoResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONFIG\n : CoreResourceType.APPLICATION_SSO_CONFIG;\n }\n\n private _resolveSsoConnectionsResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n }\n\n private _resolveSiemResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG\n : CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG;\n }\n\n private _resolveScimConfigResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG\n : CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG;\n }\n\n /\n Get all organization IDs that have SSO configurations loaded.\n * Filters to organization-scoped entries only, returning plain IDs.\n /\n public getAllOrganizationIds(): string[] {\n const orgIds: string[] = [];\n for (const key of this.ssoConfigs.keys()) {\n if (key.startsWith('organization:')) {\n orgIds.push(key.slice('organization:'.length));\n }\n }\n return orgIds;\n }\n\n /\n Get all application IDs that have SSO configurations loaded.\n * Filters to application-scoped entries only, returning plain IDs.\n /\n public getAllApplicationIds(): string[] {\n const appIds: string[] = [];\n for (const key of this.ssoConfigs.keys()) {\n if (key.startsWith('application:')) {\n appIds.push(key.slice('application:'.length));\n }\n }\n return appIds;\n }\n\n // ===============================\n // SSO CONFIGURATION\n // ===============================\n\n /\n SSO configuration is consulted on every authentication attempt — the\n * caller (a not-yet-authenticated user, or an unrelated org member) is rarely\n * the admin who configured the policy. We therefore READ with a system EC\n * (`readAsSystem`) so the originating user's roles never gate policy\n * visibility, and — when no row exists yet (a provisioned / migrated /\n * pre-seed org that bypassed the `afterCreate` default-seed) — we lazily\n * materialise the disabled-default row with the same system context\n * (`createAsSystem`, gated by `systemAccessPolicy.create`). Attributing the\n * bootstrap create to the logging-in user via the caller `ec` would fail: the\n * SSO-config CREATE ACL demands ORG_ADMIN / APP super-admin, which the\n * originating user usually lacks — the very asymmetry that forces the system\n * read. `ec` is retained for signature symmetry with the write helpers and is\n * not consulted here (both the read and the lazy-create run system-context).\n /\n public async loadSSOConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<SsoConfigBase \| null> {\n void ec;\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SsoConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.ssoConfigs.set(cacheKey, config);\n return config;\n }\n const defaultConfig = this.createDefaultSSOConfig(scopeType, scopeId);\n const created = await this._createScopeSingletonDefaultToleratingRace<SsoConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n this.ssoConfigs.set(cacheKey, created);\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert that fired on every login\n // for a config-less org. Stay resilient: log the detail and fall back to cache.\n this.logger.error('Failed to load SSO configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return this.ssoConfigs.get(cacheKey) \|\| null;\n }\n }\n\n /\n Read-only counterpart of {@link loadSSOConfig}: returns the SSO config for the\n * scope if a row exists, else `null`, and NEVER creates a default.\n \n Use this from PUBLIC / unauthenticated surfaces (e.g. the SP-metadata endpoint)\n * where `loadSSOConfig`'s read-then-create semantics would, per distinct\n * caller-supplied scope, attempt an ACL-rejected CREATE and `logger.error` on\n * every miss — wasteful and noisy on an endpoint an attacker can hit with\n * arbitrary scope IDs. Absence is normal here, so a miss/failure logs at `debug`.\n * The read itself is `readAsSystem` (ACL-independent), same as `loadSSOConfig`.\n /\n public async readSSOConfigIfExists(scopeType: AuthScopeType, scopeId: string): Promise<SsoConfigBase \| null> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SsoConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.ssoConfigs.set(cacheKey, config);\n return config;\n }\n return this.ssoConfigs.get(cacheKey) ?? null;\n } catch (error) {\n this.logDebug('Read-only SSO config lookup failed — treating as absent', {\n scopeType,\n scopeId,\n error: describeCaughtError(error),\n });\n return this.ssoConfigs.get(cacheKey) ?? null;\n }\n }\n\n /\n Load a single enterprise SSO CONNECTION row (distinct from the scope-level SSO\n * {@link loadSSOConfig SSO config}) with a system EC. Used by the enterprise\n * OIDC/SAML login-initiation resolvers, which run PRE-AUTH: no user is\n * authenticated yet, so the caller holds none of the ORG_ADMIN / APP_ADMIN roles\n * the connection's READ ACL demands. Reading via `readAsSystem` bypasses that ACL\n * under the connection resource's `systemAccessPolicy.read = ALLOWED` opt-in\n * (fail-closed + audited). The connection's OWN `enabled` / protocol checks stay\n * the caller's responsibility — this method only fetches the row scoped to the\n * `(scope, connectionId)` pair. Returns `null` when no matching connection exists.\n /\n public async loadSsoConnectionAsSystem(\n scopeType: AuthScopeType,\n scopeId: string,\n connectionId: string,\n ): Promise<SsoConnectionBase \| null> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n return this.getSystemAccessService().readAsSystem<SsoConnectionBase>(\n resourceType,\n { _id: connectionId, ...this._scopeFilter(scopeType, scopeId) },\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n }\n\n /\n Load a single enterprise SSO CONNECTION by its id ALONE — no scope known — with a system EC. The\n * cross-scope-DISCOVERY counterpart of {@link loadSsoConnectionAsSystem}: SAML SP-initiated login is\n * routed as `GET /auth/saml/login/:connectionId`, carrying NO scope segment (unlike the OIDC\n * `/authorize/:orgId/:connectionId`), so the caller cannot know org-vs-app up front — it reads by\n * `_id` in each scope's resource and derives the scope from the row that matches. Same pre-auth\n * rationale and `systemAccessPolicy.read = ALLOWED` bypass as {@link loadSsoConnectionAsSystem}; the\n * connection's own `enabled`/protocol/`allowIdpInitiated` checks remain the caller's responsibility.\n * `readAsSystem` carries no `scopeContext` here on purpose — the id is the sole, globally-unique\n * locator, and the scope is an OUTPUT of the lookup, not an input. Returns `null` if no row matches.\n /\n public async loadSsoConnectionByIdAsSystem(scopeType: AuthScopeType, connectionId: string): Promise<SsoConnectionBase \| null> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n return this.getSystemAccessService().readAsSystem<SsoConnectionBase>(resourceType, { _id: connectionId });\n }\n\n /\n List SAML SSO CONNECTIONS in a scope whose `saml.entityId` matches an IdP issuer, with a system EC —\n * the LIST counterpart of {@link loadSsoConnectionByIdAsSystem} for IdP-INITIATED resolution, which is\n * likewise PRE-AUTH: an unsolicited assertion / LogoutRequest names its tenant only by the SIGNED\n * `<Issuer>` entityId, so the connection must be found by that entityId across every scope BEFORE any\n * user is authenticated. Gated by `systemAccessPolicy.list = ALLOWED` (fail-closed + audited). Filters\n * to `protocol: SAML` + `enabled: true` (a disabled connection is not a live IdP); the\n * `allowIdpInitiated` gate stays the caller's responsibility, because ACS enforces it while SLO must\n * terminate SP-initiated sessions regardless. Returns `[]` when nothing matches.\n /\n public async listSsoConnectionsByEntityIdAsSystem(scopeType: AuthScopeType, entityId: string): Promise<SsoConnectionBase[]> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n const result = await this.getSystemAccessService().listAsSystem<SsoConnectionBase>(resourceType, {\n protocol: SsoProtocol.SAML,\n 'saml.entityId': entityId,\n enabled: true,\n });\n return Array.isArray(result) ? result : [];\n }\n\n public async saveSSOConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, config: Partial<SsoConfigBase>): Promise<void> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<SsoConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n const merged = { ...(existing \|\| {}), ...config } as SsoConfigBase;\n this.ssoConfigs.set(cacheKey, merged);\n this.logDebug('SSO configuration saved', { scopeType, scopeId });\n this.notifyConfigChange(scopeType, scopeId, merged);\n } catch (error) {\n this.logger.error('Failed to save SSO configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n\n // ===============================\n // LEGACY PROVIDER METHODS (Block 2B migration target)\n // ===============================\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getSAMLProviders(organizationId: string): Promise<Record<string, unknown>[]> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));\n return (config as any)?.samlProviders \|\| [];\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getOpenIDConnectProviders(organizationId: string): Promise<Record<string, unknown>[]> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));\n return (config as any)?.openidConnectProviders \|\| [];\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getDefaultSSOProvider(organizationId: string): Promise<Record<string, unknown> \| null> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId)) as any;\n if (!config) return null;\n\n const defaultSAML = config.samlProviders?.find((p: any) => p.isDefault && p.enabled);\n if (defaultSAML) return defaultSAML;\n\n const defaultOIDC = config.openidConnectProviders?.find((p: any) => p.isDefault && p.enabled);\n if (defaultOIDC) return defaultOIDC;\n\n const firstEnabled = config.samlProviders?.find((p: any) => p.enabled)\n \|\| config.openidConnectProviders?.find((p: any) => p.enabled);\n return firstEnabled \|\| null;\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getSSOProviderByDomain(\n organizationId: string,\n emailDomain: string,\n ): Promise<Record<string, unknown> \| null> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId)) as any;\n if (!config \|\| !config.domains?.domainHinting) return null;\n\n if (!config.domains.ssoEnabledDomains?.includes(emailDomain)) return null;\n\n const samlProvider = config.samlProviders?.find((p: any) =>\n p.enabled && p.allowedDomains?.includes(emailDomain)\n );\n if (samlProvider) return samlProvider;\n\n const oidcProvider = config.openidConnectProviders?.find((p: any) =>\n p.enabled && p.allowedDomains?.includes(emailDomain)\n );\n return oidcProvider \|\| null;\n }\n\n // ===============================\n // CONVENIENCE METHODS\n // ===============================\n\n public async isSSORequired(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return config?.enforcement.requireSSO \|\| false;\n }\n\n public async isPasswordFallbackAllowed(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return config?.enforcement.allowPasswordFallback ?? true;\n }\n\n public async getDomains(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<{\n verified: string[];\n ssoEnabled: string[];\n allowExternal: boolean;\n }> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return {\n /\n * DERIVED, not the stored list (#457). `domains.verifiedDomains` holds every CLAIMED domain —\n * `initiateDomainVerification` pushes one in at claim time with status `pending` — so\n * returning it under the name `verified` handed a caller pending, failed and expired domains\n * with no reason to suspect it. There is no such caller yet, which is the only reason this was\n * contained rather than a disclosure.\n /\n verified: resolveVerifiedDomains(config?.domains),\n ssoEnabled: config?.domains.ssoEnabledDomains \|\| [],\n allowExternal: config?.domains.allowExternalDomains \|\| false,\n };\n }\n\n /\n * `isEmergencyAccessEnabled` and `getEmergencyAccessAccounts` used to sit here, and both had ZERO\n * callers for as long as they existed — two accessors onto a config block nothing read (#423).\n \n The break-glass decision is now taken by `isBreakGlassAccount` in\n * `enterprise-sso-enforcement.backend.utils`, beside `requiresEnterpriseSsoOnly`, because the two\n * must agree: one decides whether a password field is offered at all, the other decides who gets\n * past the enforcement gate, and a tenant whose accounts cannot reach a password field has\n * break-glass in name only. Splitting them across two modules is how they drift.\n /\n\n public validateSSOConfig(config: Partial<SsoConfigBase>): { isValid: boolean; errors: string[] } {\n const result = SsoConfigBaseSchema.safeParse(config);\n if (result.success) {\n return { isValid: true, errors: [] };\n } else {\n const zodError = (result as ZodSafeParseError<Partial<SsoConfigBase>>).error;\n const errors = zodError.issues.map(issue => issue.message);\n return { isValid: false, errors };\n }\n }\n\n // ===============================\n // CONFIG CHANGE LISTENERS\n // ===============================\n\n public onConfigChange(callback: (scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase) => void): void {\n this.configChangeListeners.push(callback);\n }\n\n private notifyConfigChange(scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase): void {\n this.configChangeListeners.forEach(callback => {\n try {\n callback(scopeType, scopeId, config);\n } catch (error) {\n this.logger.error('Error in configuration change listener', { scopeType, scopeId, error });\n }\n });\n }\n\n // ===============================\n // DEFAULT SSO CONFIG\n // ===============================\n\n public createDefaultSSOConfig(scopeType: AuthScopeType, scopeId: string): Record<string, unknown> {\n return {\n ...this._scopeFilter(scopeType, scopeId),\n enforcement: {\n requireSSO: false,\n allowPasswordFallback: true,\n graceLoginAttempts: 3,\n },\n domains: {\n verifiedDomains: [],\n ssoEnabledDomains: [],\n domainHinting: true,\n allowExternalDomains: false,\n domainVerificationStatus: {},\n domainVerificationTokens: {},\n },\n provisioning: {\n autoCreateUsers: true,\n autoUpdateUsers: true,\n autoDeactivateUsers: false,\n requiredAttributes: ['email'],\n syncFrequencyHours: 24,\n },\n sessionSettings: {\n ssoSessionDurationMinutes: 480,\n requireReauthForSensitive: true,\n singleLogoutEnabled: true,\n maxConcurrentSessions: 5,\n },\n auditConfig: {\n logAllSSOEvents: true,\n logProviderSwitching: true,\n logRoleMapping: true,\n complianceReporting: false,\n retentionDays: 365,\n },\n // `enabled: true` with an EMPTY list grants nothing — the list is what confers the bypass, so\n // a default tenant has break-glass switched on and nobody named. `requireApproval`,\n // `maxDurationHours` and `auditLevel` were removed from the schema (#481/#423); this builder\n // returns `Record<string, unknown>`, so nothing would have caught them staying here.\n emergencyAccess: {\n enabled: true,\n breakGlassAccounts: [],\n },\n oauth2ProviderRestrictions: {\n allowedProviders: [],\n blockedProviders: [],\n requireEnterpriseSSOOnly: false,\n },\n };\n }\n\n // ===============================\n // SIEM EXPORT CONFIGURATION\n // ===============================\n\n /\n Loads the scope's SIEM export config for the audit-event dispatcher (called\n * per-org on the login/audit path). Reads with a system EC (`readAsSystem`) —\n * the routing read is userless — and, when the row is absent (a provisioned /\n * migrated / pre-seed org that bypassed the `afterCreate` default-seed), lazily\n * materialises the disabled-default row via `createAsSystem` (gated by\n * `systemAccessPolicy.create`). The default payload mirrors the framework seed:\n * the nested `eventFilter` / `delivery` objects carry no object-level default\n * (only inner-field defaults), so each must be present as `{}` to validate.\n * `ec` is retained for signature symmetry and not consulted (both operations\n * run system-context; the logging-in user is not the config's admin owner).\n /\n public async loadSiemExportConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<SiemExportConfigBase \| null> {\n void ec;\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSiemResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SiemExportConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.siemExportConfigs.set(cacheKey, config);\n return config;\n }\n const defaultConfig = { ...this._scopeFilter(scopeType, scopeId), eventFilter: {}, delivery: {} };\n const created = await this._createScopeSingletonDefaultToleratingRace<SiemExportConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n this.siemExportConfigs.set(cacheKey, created);\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert that fired on every login\n // for a config-less org. Stay resilient: log the detail and fall back to cache.\n this.logger.error('Failed to load SIEM export configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return this.siemExportConfigs.get(cacheKey) \|\| null;\n }\n }\n\n public async saveSiemExportConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, config: Partial<SiemExportConfigBase>): Promise<void> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSiemResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<SiemExportConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n const merged = { ...(existing \|\| {}), ...config } as SiemExportConfigBase;\n this.siemExportConfigs.set(cacheKey, merged);\n this.logDebug('SIEM export configuration saved', { scopeType, scopeId, enabled: merged.enabled });\n } catch (error) {\n this.logger.error('Failed to save SIEM export configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n\n public async isSecurityExportEnabled(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSiemExportConfig(ec, scopeType, scopeId);\n return config?.enabled \|\| false;\n }\n\n // ===============================\n // SCIM PROVISIONING CONFIGURATION\n // ===============================\n\n /\n Loads the scope's SCIM provisioning config. Reads with a system EC\n * (`readAsSystem`) and, when the row is absent (a provisioned / migrated /\n * pre-seed org that bypassed the `afterCreate` default-seed), lazily\n * materialises the default row via `createAsSystem` (gated by\n * `systemAccessPolicy.create`). The default payload carries only the scope FK —\n * every behavioural field (`autoCreateUsers`, `autoVerifyEmail`,\n * `autoDeactivateUsers`, `defaultRole`, `attributeMapping`) is defaulted by\n * `ScimProvisioningConfigBaseSchema`. `ec` is retained for signature symmetry with\n * the other loaders and is not consulted (the read runs system-context).\n \n There is deliberately no `scimEnabled` seeding here: enablement is a per-ORG-TYPE\n * concern (`organizationTypes[type].scimProvisioning.enabled`), not a per-scope row\n * field — see the note on `ScimProvisioningConfigBaseSchema`. This loader materialises\n * the behaviour row that `SCIMControllerBackendService._getProvisioningConfig` reads\n * once SCIM is enabled for the org type.\n /\n public async loadScimProvisioningConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<ScimProvisioningConfigBase \| null> {\n void ec;\n try {\n const resourceType = this._resolveScimConfigResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<ScimProvisioningConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) return config;\n\n const defaultConfig = { ...this._scopeFilter(scopeType, scopeId) };\n const created = await this._createScopeSingletonDefaultToleratingRace<ScimProvisioningConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert. Stay resilient.\n this.logger.error('Failed to load SCIM provisioning configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return null;\n }\n }\n\n /\n Write counterpart of {@link loadScimProvisioningConfig}, completing the enterprise-config\n * trio's load/save symmetry (SSO and SIEM already had one; SCIM was the odd resource out).\n \n ADMIN-INITIATED, so — unlike the userless lazy-create in the loader — the write dispatches\n * through the services registry on the CALLER's `ec`, preserving admin audit attribution.\n * Deliberately NOT `updateAsSystem`: a system write would both erase that attribution and\n * require a `systemAccessPolicy.update` opt-in that no enterprise-config resource declares —\n * widening the trusted-write surface to buy nothing (the caller here IS an authenticated admin,\n * so the normal ACL is the correct door).\n \n This resolves only because the SCIM config's UPDATE variant is `INTERNAL_CALL`:\n * `ServicesRegistryHandler.update` resolves via `getServiceOperationPathDefault`, which rejects\n * `REPOSITORY_ONLY` with `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical).\n * If a future change reverts that variant, THIS method is what starts throwing — the pin in\n * `resources-registry.integration.test.ts` guards the pair.\n \n No cache write (mirroring {@link loadScimProvisioningConfig}, which does not cache — unlike\n * the SSO/SIEM helpers, whose caches back a hot login-path read).\n */\n public async saveScimProvisioningConfig(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n config: Partial<ScimProvisioningConfigBase>,\n ): Promise<void> {\n // Guard BEFORE any read/write: a defaultRole that grants admin is a privilege-escalation\n // vector (the IdP would mint tenant admins). Throwing here also keeps the invalid value out\n // of the store entirely. Runs outside the try so the VALIDATION error surfaces to the admin\n // caller verbatim rather than being caught + re-logged as a save failure.\n this._assertNonAdminScimDefaultRole(config);\n try {\n const resourceType = this._resolveScimConfigResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<ScimProvisioningConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n this.logDebug('SCIM provisioning configuration saved', { scopeType, scopeId });\n } catch (error) {\n this.logger.error('Failed to save SCIM provisioning configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n}\n"]}
1	+ {"version":3,"file":"auth-organization-configuration.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/auth-organization-configuration.service.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;;;;;;;;;;;;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,SAAS,EACT,cAAc,GAKf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AAOnH;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAS;IACpE,cAAc,CAAC,SAAS;IACxB,cAAc,CAAC,SAAS;CACzB,CAAC,CAAC;AAGI,IAAM,oCAAoC,GAA1C,MAAM,oCAAoC;IAOF;IACY;IAPjD,UAAU,GAA+B,IAAI,GAAG,EAAE,CAAC;IACnD,iBAAiB,GAAsC,IAAI,GAAG,EAAE,CAAC;IACjE,qBAAqB,GAAsF,EAAE,CAAC;IAC5G,QAAQ,CAA+D;IAEjF,YAC6C,MAAqB,EACT,SAAoB;QADhC,WAAM,GAAN,MAAM,CAAe;QACT,cAAS,GAAT,SAAS,CAAW;QAE3E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACjF,CAAC;IAED;;;;OAIG;IACK,0BAA0B;QAChC,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAwC,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IACtH,CAAC;IAED;;;;OAIG;IACK,sBAAsB;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChG,CAAC;IAED;qGACiG;IACzF,eAAe;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAA6B,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChG,CAAC;IAED;;;;;;OAMG;IACK,8BAA8B,CAAC,MAA2C;QAChF,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACvC,IAAI,WAAW,IAAI,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE;gBACvE,OAAO,EAAE;oBACP,OAAO,EAAE,oEAAoE,WAAW,8DAA8D;oBACtJ,WAAW;iBACZ;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iCAAiC;IAEzB,SAAS,CAAC,SAAwB,EAAE,OAAe;QACzD,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACnC,CAAC;IAEO,YAAY,CAAC,SAAwB,EAAE,OAAe;QAC5D,OAAO,EAAE,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC;IACtG,CAAC;IAED;;;;;;;OAOG;IACK,0BAA0B,CAChC,SAAwB,EACxB,OAAe;QAEf,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE;YAC7B,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,KAAK,CAAC,0CAA0C,CACtD,YAA8B,EAC9B,SAAwB,EACxB,OAAe,EACf,WAAoC;QAEpC,MAAM,YAAY,GAAG,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,cAAc,CAAI,YAAY,EAAE,WAAW,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,OAAO,WAAW,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC5D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,CACjB,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,QAAQ,CAAC,uFAAuF,EAAE;oBACrG,YAAY;oBACZ,SAAS;oBACT,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,WAAW,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,uBAAuB,CAAC,SAAwB;QACtD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,uBAAuB;YAC1C,CAAC,CAAC,gBAAgB,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IAEO,kCAAkC,CAAC,SAAwB;QACjE,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;IACnD,CAAC;IAEO,wBAAwB,CAAC,SAAwB;QACvD,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,+BAA+B;YAClD,CAAC,CAAC,gBAAgB,CAAC,8BAA8B,CAAC;IACtD,CAAC;IAEO,8BAA8B,CAAC,SAAwB;QAC7D,OAAO,SAAS,KAAK,aAAa,CAAC,YAAY;YAC7C,CAAC,CAAC,gBAAgB,CAAC,qCAAqC;YACxD,CAAC,CAAC,gBAAgB,CAAC,oCAAoC,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACI,qBAAqB;QAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACI,oBAAoB;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACnC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kCAAkC;IAClC,oBAAoB;IACpB,kCAAkC;IAElC;;;;;;;;;;;;;;OAcG;IACI,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,gFAAgF;YAChF,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACpD,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,qBAAqB,CAAC,SAAwB,EAAE,OAAe;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACtC,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,yDAAyD,EAAE;gBACvE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,yBAAyB,CACpC,SAAwB,EACxB,OAAe,EACf,YAAoB;QAEpB,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC/C,YAAY,EACZ,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,EAC/D,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,KAAK,CAAC,6BAA6B,CAAC,SAAwB,EAAE,YAAoB;QACvF,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAAoB,YAAY,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oCAAoC,CAAC,SAAwB,EAAE,QAAgB;QAC1F,MAAM,YAAY,GAAG,IAAI,CAAC,kCAAkC,CAAC,SAAS,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAAoB,YAAY,EAAE;YAC/F,QAAQ,EAAE,WAAW,CAAC,IAAI;YAC1B,eAAe,EAAE,QAAQ;YACzB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAA8B;QAC7H,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAgB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACvG,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAAmB,CAAC;YACnE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE;gBACpD,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,sDAAsD;IACtD,kCAAkC;IAElC,kEAAkE;IAC3D,KAAK,CAAC,gBAAgB,CAAC,cAAsB;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,aAAa,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,yBAAyB,CAAC,cAAsB;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAC/F,OAAQ,MAAc,EAAE,sBAAsB,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,qBAAqB,CAAC,cAAsB;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAEzB,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACrF,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,WAAW,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QAEpC,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;eACjE,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAChE,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kEAAkE;IAC3D,KAAK,CAAC,sBAAsB,CACjC,cAAsB,EACtB,WAAmB;QAEnB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,YAAY,EAAE,cAAc,CAAC,CAAQ,CAAC;QACtG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa;YAAE,OAAO,IAAI,CAAC;QAE3D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE1E,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CACzD,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAClE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,WAAW,CAAC,CACrD,CAAC;QACF,OAAO,YAAY,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED,kCAAkC;IAClC,sBAAsB;IACtB,kCAAkC;IAE3B,KAAK,CAAC,aAAa,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,UAAU,IAAI,KAAK,CAAC;IACjD,CAAC;IAEM,KAAK,CAAC,yBAAyB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,MAAM,EAAE,WAAW,CAAC,qBAAqB,IAAI,IAAI,CAAC;IAC3D,CAAC;IAEM,KAAK,CAAC,UAAU,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAK1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO;YACL;;;;;;eAMG;YACH,QAAQ,EAAE,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC;YACjD,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,IAAI,EAAE;YACnD,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,oBAAoB,IAAI,KAAK;SAC7D,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IAEI,iBAAiB,CAAC,MAA8B;QACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAI,MAAoD,CAAC,KAAK,CAAC;YAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,0BAA0B;IAC1B,kCAAkC;IAE3B,cAAc,CAAC,QAAoF;QACxG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAEO,kBAAkB,CAAC,SAAwB,EAAE,OAAe,EAAE,MAAqB;QACzF,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC5C,IAAI,CAAC;gBACH,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAClC,qBAAqB;IACrB,kCAAkC;IAE3B,sBAAsB,CAAC,SAAwB,EAAE,OAAe;QACrE,OAAO;YACL,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC;YACxC,WAAW,EAAE;gBACX,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,IAAI;gBAC3B,kBAAkB,EAAE,CAAC;aACtB;YACD,OAAO,EAAE;gBACP,eAAe,EAAE,EAAE;gBACnB,iBAAiB,EAAE,EAAE;gBACrB,aAAa,EAAE,IAAI;gBACnB,oBAAoB,EAAE,KAAK;gBAC3B,wBAAwB,EAAE,EAAE;gBAC5B,wBAAwB,EAAE,EAAE;aAC7B;YACD,YAAY,EAAE;gBACZ,eAAe,EAAE,IAAI;gBACrB,eAAe,EAAE,IAAI;gBACrB,mBAAmB,EAAE,KAAK;gBAC1B,kBAAkB,EAAE,CAAC,OAAO,CAAC;gBAC7B,kBAAkB,EAAE,EAAE;aACvB;YACD,eAAe,EAAE;gBACf,yBAAyB,EAAE,GAAG;gBAC9B,yBAAyB,EAAE,IAAI;gBAC/B,mBAAmB,EAAE,IAAI;gBACzB,qBAAqB,EAAE,CAAC;aACzB;YACD,WAAW,EAAE;gBACX,eAAe,EAAE,IAAI;gBACrB,oBAAoB,EAAE,IAAI;gBAC1B,cAAc,EAAE,IAAI;gBACpB,mBAAmB,EAAE,KAAK;gBAC1B,aAAa,EAAE,GAAG;aACnB;YACD,8FAA8F;YAC9F,oFAAoF;YACpF,6FAA6F;YAC7F,qFAAqF;YACrF,eAAe,EAAE;gBACf,OAAO,EAAE,IAAI;gBACb,kBAAkB,EAAE,EAAE;aACvB;YACD,0BAA0B,EAAE;gBAC1B,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,EAAE;gBACpB,wBAAwB,EAAE,KAAK;aAChC;SACF,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,4BAA4B;IAC5B,kCAAkC;IAElC;;;;;;;;;;;OAWG;IACI,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACpG,KAAK,EAAE,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAClG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,gFAAgF;YAChF,gFAAgF;YAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBAC5D,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACtD,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,oBAAoB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe,EAAE,MAAqC;QAC3I,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAuB,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC9G,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,EAA0B,CAAC;YAC1E,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,EAAE;gBAC5D,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,uBAAuB,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QACvG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvE,OAAO,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC;IAClC,CAAC;IAED,kCAAkC;IAClC,kCAAkC;IAClC,kCAAkC;IAElC;;;;;;;;;;;;;;;;OAgBG;IACI,KAAK,CAAC,0BAA0B,CAAC,EAAyB,EAAE,SAAwB,EAAE,OAAe;QAC1G,KAAK,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,CAC7D,YAAY,EACZ,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EACrC,EAAE,YAAY,EAAE,IAAI,CAAC,0BAA0B,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CACtE,CAAC;YACF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAE1B,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,0CAA0C,CACnE,YAAY,EACZ,SAAS,EACT,OAAO,EACP,aAAa,CACd,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kFAAkF;YAClF,uEAAuE;YACvE,uEAAuE;YACvE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAClE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAA2C;QAE3C,yFAAyF;QACzF,4FAA4F;QAC5F,4FAA4F;QAC5F,0EAA0E;QAC1E,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAA6B,YAAY,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACpH,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAG,QAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAClG,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;gBAClE,SAAS;gBACT,OAAO;gBACP,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;aACnF,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAptBY,oCAAoC;IADhD,UAAU,EAAE;IAQR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;qCADc,aAAa;QACE,SAAS;GARlE,oCAAoC,CAotBhD","sourcesContent":["/*\n Organization Configuration Service\n \n Scope-aware service for managing SSO enforcement, authentication policies,\n * SIEM export, and SCIM provisioning configuration.\n * Supports both organization-level and application-level scopes.\n /\n\nimport { Container, injectable, inject } from 'inversify';\nimport {\n resolveVerifiedDomains,\n CoreResourceType,\n AuthScopeType,\n SsoProtocol,\n SsoConfigBaseSchema,\n isWildoBackendError,\n ErrorType,\n CORE_ORG_ROLES,\n type SsoConfigBase,\n type SsoConnectionBase,\n type SiemExportConfigBase,\n type ScimProvisioningConfigBase,\n} from '@wildo-ai/saas-models';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport type { ZodSafeParseError } from 'zod';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ErrorBuilderBackendService } from '~wildo-backend-lib/errors/services/error-builder.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/\n Org roles that carry administrative control over a tenant. A SCIM-provisioning\n * `defaultRole` — the fallback role assigned to a directory-pushed user when the IdP\n * payload maps no stronger role — must never be one of these: otherwise an org-admin who\n * (mis)configures SCIM turns \"the directory can push users\" into \"the directory can mint\n * admins\", a privilege-escalation vector where the IdP effectively controls tenant admin\n * membership. `ORG_MANAGER` is elevated but not full-control, so it is allowed. Custom\n * (non-core) roles are the app's own responsibility — the framework can only reason about\n * the roles it defines.\n /\nconst ADMIN_GRANTING_ORG_ROLES: ReadonlySet<string> = new Set<string>([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n]);\n\n@injectable()\nexport class AuthOrganizationConfigurationService {\n private ssoConfigs: Map<string, SsoConfigBase> = new Map();\n private siemExportConfigs: Map<string, SiemExportConfigBase> = new Map();\n private configChangeListeners: Array<(scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase) => void> = [];\n protected logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.Container) private readonly container: Container,\n ) {\n this.logDebug = this.logger.debugByType('AuthOrganizationConfigurationService');\n this.logger.setDebugTypeLogging('AuthOrganizationConfigurationService', false);\n }\n\n /\n Organization auth configuration is consulted by services that are themselves\n * created through the services registry, so we resolve the registry lazily to\n * avoid re-entering the same singleton graph during backend startup.\n /\n private getServicesRegistryHandler(): ServicesRegistryHandlerBackendService {\n return this.container.get<ServicesRegistryHandlerBackendService>(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService);\n }\n\n /\n Late-resolved like the registry above. The ACL-bypassing system read used to\n * load org config during login (the authenticating user is not the config's admin\n * owner) lives on this dedicated, deliberately-resolved service (Guard 3).\n /\n private getSystemAccessService(): SystemAccessBackendService {\n return this.container.get<SystemAccessBackendService>(SAAS_SERVICE_TYPES.SystemAccessService);\n }\n\n /* Late-resolved (this service late-resolves all its collaborators to avoid re-entering the\n * singleton graph during backend startup). Used to build the SCIM `defaultRole` guard error. /\n private getErrorBuilder(): ErrorBuilderBackendService {\n return this.container.get<ErrorBuilderBackendService>(SAAS_SERVICE_TYPES.ErrorBuilderService);\n }\n\n /\n Reject a SCIM provisioning `defaultRole` that would grant tenant-admin control. Called on the\n * write path so a mis-authored config never reaches the runtime that assigns it to every\n * IdP-pushed user lacking a mapped role (see {@link ADMIN_GRANTING_ORG_ROLES}). Only the CORE\n * admin roles are checked — custom roles are the app's own responsibility. A no-op when\n * `defaultRole` is absent or is a non-admin role.\n /\n private _assertNonAdminScimDefaultRole(config: Partial<ScimProvisioningConfigBase>): void {\n const defaultRole = config.defaultRole;\n if (defaultRole && ADMIN_GRANTING_ORG_ROLES.has(defaultRole)) {\n throw this.getErrorBuilder().buildError(ErrorType.VALIDATION, undefined, {\n context: {\n message: `SCIM provisioning defaultRole cannot be an administrative role (\"${defaultRole}\"): a directory push must not be able to mint tenant admins.`,\n defaultRole,\n },\n });\n }\n }\n\n // ── Scope resolution helpers ──\n\n private _cacheKey(scopeType: AuthScopeType, scopeId: string): string {\n return `${scopeType}:${scopeId}`;\n }\n\n private _scopeFilter(scopeType: AuthScopeType, scopeId: string): Record<string, string> {\n return { [scopeType === AuthScopeType.ORGANIZATION ? 'organizationId' : 'applicationId']: scopeId };\n }\n\n /\n Build the `scopeContext` that `readAsSystem` routes into the synthesised\n * internal EC's `contextResourcesFieldIdentifier` (the WHICH-resources-in-scope\n * channel — NOT `initiatorIds`, which the internal EC fail-closed rejects\n * identity fields on), so the system read is scoped to the correct tenant FK.\n * Mirrors `_scopeFilter` in intent — the filter narrows the query, the scope\n * context narrows the EC.\n /\n private _scopeContextForResolution(\n scopeType: AuthScopeType,\n scopeId: string,\n ): { organizationId?: string; applicationId?: string } {\n return scopeType === AuthScopeType.ORGANIZATION\n ? { organizationId: scopeId }\n : { applicationId: scopeId };\n }\n\n /\n Materialise a per-scope singleton's disabled-default row via the trusted\n * system-write primitive, TOLERATING the one-per-scope unique-index race.\n \n These enterprise-config singletons carry a UNIQUE index on their scope FK\n * (the polymorphism engine's singleton business-key ⇒ `.isUnique()` convention),\n * so two concurrent loaders that both observe the row absent will both attempt\n * the lazy-create — exactly one wins, and the loser's insert fails closed with a\n * duplicate-key error. That race is BENIGN (the winner wrote the identical\n * disabled-default row), so we swallow it: re-read and return the row the winner\n * created rather than surfacing a spurious error on the login/audit path (which\n * would re-introduce a smaller echo of the very FATAL this whole change removed).\n * Only a GENUINE create failure — one whose re-read ALSO finds nothing — is\n * re-thrown to the caller's resilient catch. The re-read-if-absent shape is\n * deliberately error-type-agnostic: it recovers from the unique-index race and\n * from any transient create failure where the row nonetheless landed.\n /\n private async _createScopeSingletonDefaultToleratingRace<T>(\n resourceType: CoreResourceType,\n scopeType: AuthScopeType,\n scopeId: string,\n defaultData: Record<string, unknown>,\n ): Promise<T> {\n const scopeContext = this._scopeContextForResolution(scopeType, scopeId);\n try {\n return await this.getSystemAccessService().createAsSystem<T>(resourceType, defaultData, { scopeContext });\n } catch (createError) {\n const raced = await this.getSystemAccessService().readAsSystem<T>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext },\n );\n if (raced) {\n this.logDebug('Lazy-default create lost the one-per-scope race; returning the row the winner created', {\n resourceType,\n scopeType,\n scopeId,\n });\n return raced;\n }\n throw createError;\n }\n }\n\n private _resolveSsoResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONFIG\n : CoreResourceType.APPLICATION_SSO_CONFIG;\n }\n\n private _resolveSsoConnectionsResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n }\n\n private _resolveSiemResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SIEM_EXPORT_CONFIG\n : CoreResourceType.APPLICATION_SIEM_EXPORT_CONFIG;\n }\n\n private _resolveScimConfigResourceType(scopeType: AuthScopeType): CoreResourceType {\n return scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SCIM_PROVISIONING_CONFIG\n : CoreResourceType.APPLICATION_SCIM_PROVISIONING_CONFIG;\n }\n\n /\n Get all organization IDs that have SSO configurations loaded.\n * Filters to organization-scoped entries only, returning plain IDs.\n /\n public getAllOrganizationIds(): string[] {\n const orgIds: string[] = [];\n for (const key of this.ssoConfigs.keys()) {\n if (key.startsWith('organization:')) {\n orgIds.push(key.slice('organization:'.length));\n }\n }\n return orgIds;\n }\n\n /\n Get all application IDs that have SSO configurations loaded.\n * Filters to application-scoped entries only, returning plain IDs.\n /\n public getAllApplicationIds(): string[] {\n const appIds: string[] = [];\n for (const key of this.ssoConfigs.keys()) {\n if (key.startsWith('application:')) {\n appIds.push(key.slice('application:'.length));\n }\n }\n return appIds;\n }\n\n // ===============================\n // SSO CONFIGURATION\n // ===============================\n\n /\n SSO configuration is consulted on every authentication attempt — the\n * caller (a not-yet-authenticated user, or an unrelated org member) is rarely\n * the admin who configured the policy. We therefore READ with a system EC\n * (`readAsSystem`) so the originating user's roles never gate policy\n * visibility, and — when no row exists yet (a provisioned / migrated /\n * pre-seed org that bypassed the `afterCreate` default-seed) — we lazily\n * materialise the disabled-default row with the same system context\n * (`createAsSystem`, gated by `systemAccessPolicy.create`). Attributing the\n * bootstrap create to the logging-in user via the caller `ec` would fail: the\n * SSO-config CREATE ACL demands ORG_ADMIN / APP super-admin, which the\n * originating user usually lacks — the very asymmetry that forces the system\n * read. `ec` is retained for signature symmetry with the write helpers and is\n * not consulted here (both the read and the lazy-create run system-context).\n /\n public async loadSSOConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<SsoConfigBase \| null> {\n void ec;\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SsoConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.ssoConfigs.set(cacheKey, config);\n return config;\n }\n const defaultConfig = this.createDefaultSSOConfig(scopeType, scopeId);\n const created = await this._createScopeSingletonDefaultToleratingRace<SsoConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n this.ssoConfigs.set(cacheKey, created);\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert that fired on every login\n // for a config-less org. Stay resilient: log the detail and fall back to cache.\n this.logger.error('Failed to load SSO configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return this.ssoConfigs.get(cacheKey) \|\| null;\n }\n }\n\n /\n Read-only counterpart of {@link loadSSOConfig}: returns the SSO config for the\n * scope if a row exists, else `null`, and NEVER creates a default.\n \n Use this from PUBLIC / unauthenticated surfaces (e.g. the SP-metadata endpoint)\n * where `loadSSOConfig`'s read-then-create semantics would, per distinct\n * caller-supplied scope, attempt an ACL-rejected CREATE and `logger.error` on\n * every miss — wasteful and noisy on an endpoint an attacker can hit with\n * arbitrary scope IDs. Absence is normal here, so a miss/failure logs at `debug`.\n * The read itself is `readAsSystem` (ACL-independent), same as `loadSSOConfig`.\n /\n public async readSSOConfigIfExists(scopeType: AuthScopeType, scopeId: string): Promise<SsoConfigBase \| null> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SsoConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.ssoConfigs.set(cacheKey, config);\n return config;\n }\n return this.ssoConfigs.get(cacheKey) ?? null;\n } catch (error) {\n this.logDebug('Read-only SSO config lookup failed — treating as absent', {\n scopeType,\n scopeId,\n error: describeCaughtError(error),\n });\n return this.ssoConfigs.get(cacheKey) ?? null;\n }\n }\n\n /\n Load a single enterprise SSO CONNECTION row (distinct from the scope-level SSO\n * {@link loadSSOConfig SSO config}) with a system EC. Used by the enterprise\n * OIDC/SAML login-initiation resolvers, which run PRE-AUTH: no user is\n * authenticated yet, so the caller holds none of the ORG_ADMIN / APP_ADMIN roles\n * the connection's READ ACL demands. Reading via `readAsSystem` bypasses that ACL\n * under the connection resource's `systemAccessPolicy.read = ALLOWED` opt-in\n * (fail-closed + audited). The connection's OWN `enabled` / protocol checks stay\n * the caller's responsibility — this method only fetches the row scoped to the\n * `(scope, connectionId)` pair. Returns `null` when no matching connection exists.\n /\n public async loadSsoConnectionAsSystem(\n scopeType: AuthScopeType,\n scopeId: string,\n connectionId: string,\n ): Promise<SsoConnectionBase \| null> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n return this.getSystemAccessService().readAsSystem<SsoConnectionBase>(\n resourceType,\n { _id: connectionId, ...this._scopeFilter(scopeType, scopeId) },\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n }\n\n /\n Load a single enterprise SSO CONNECTION by its id ALONE — no scope known — with a system EC. The\n * cross-scope-DISCOVERY counterpart of {@link loadSsoConnectionAsSystem}: SAML SP-initiated login is\n * routed as `GET /auth/saml/login/:connectionId`, carrying NO scope segment (unlike the OIDC\n * `/authorize/:orgId/:connectionId`), so the caller cannot know org-vs-app up front — it reads by\n * `_id` in each scope's resource and derives the scope from the row that matches. Same pre-auth\n * rationale and `systemAccessPolicy.read = ALLOWED` bypass as {@link loadSsoConnectionAsSystem}; the\n * connection's own `enabled`/protocol/`allowIdpInitiated` checks remain the caller's responsibility.\n * `readAsSystem` carries no `scopeContext` here on purpose — the id is the sole, globally-unique\n * locator, and the scope is an OUTPUT of the lookup, not an input. Returns `null` if no row matches.\n /\n public async loadSsoConnectionByIdAsSystem(scopeType: AuthScopeType, connectionId: string): Promise<SsoConnectionBase \| null> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n return this.getSystemAccessService().readAsSystem<SsoConnectionBase>(resourceType, { _id: connectionId });\n }\n\n /\n List SAML SSO CONNECTIONS in a scope whose `saml.entityId` matches an IdP issuer, with a system EC —\n * the LIST counterpart of {@link loadSsoConnectionByIdAsSystem} for IdP-INITIATED resolution, which is\n * likewise PRE-AUTH: an unsolicited assertion / LogoutRequest names its tenant only by the SIGNED\n * `<Issuer>` entityId, so the connection must be found by that entityId across every scope BEFORE any\n * user is authenticated. Gated by `systemAccessPolicy.list = ALLOWED` (fail-closed + audited). Filters\n * to `protocol: SAML` + `enabled: true` (a disabled connection is not a live IdP); the\n * `allowIdpInitiated` gate stays the caller's responsibility, because ACS enforces it while SLO must\n * terminate SP-initiated sessions regardless. Returns `[]` when nothing matches.\n /\n public async listSsoConnectionsByEntityIdAsSystem(scopeType: AuthScopeType, entityId: string): Promise<SsoConnectionBase[]> {\n const resourceType = this._resolveSsoConnectionsResourceType(scopeType);\n const result = await this.getSystemAccessService().listAsSystem<SsoConnectionBase>(resourceType, {\n protocol: SsoProtocol.SAML,\n 'saml.entityId': entityId,\n enabled: true,\n });\n return Array.isArray(result) ? result : [];\n }\n\n public async saveSSOConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, config: Partial<SsoConfigBase>): Promise<void> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSsoResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<SsoConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n const merged = { ...(existing \|\| {}), ...config } as SsoConfigBase;\n this.ssoConfigs.set(cacheKey, merged);\n this.logDebug('SSO configuration saved', { scopeType, scopeId });\n this.notifyConfigChange(scopeType, scopeId, merged);\n } catch (error) {\n this.logger.error('Failed to save SSO configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n\n // ===============================\n // LEGACY PROVIDER METHODS (Block 2B migration target)\n // ===============================\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getSAMLProviders(organizationId: string): Promise<Record<string, unknown>[]> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));\n return (config as any)?.samlProviders \|\| [];\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getOpenIDConnectProviders(organizationId: string): Promise<Record<string, unknown>[]> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId));\n return (config as any)?.openidConnectProviders \|\| [];\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getDefaultSSOProvider(organizationId: string): Promise<Record<string, unknown> \| null> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId)) as any;\n if (!config) return null;\n\n const defaultSAML = config.samlProviders?.find((p: any) => p.isDefault && p.enabled);\n if (defaultSAML) return defaultSAML;\n\n const defaultOIDC = config.openidConnectProviders?.find((p: any) => p.isDefault && p.enabled);\n if (defaultOIDC) return defaultOIDC;\n\n const firstEnabled = config.samlProviders?.find((p: any) => p.enabled)\n \|\| config.openidConnectProviders?.find((p: any) => p.enabled);\n return firstEnabled \|\| null;\n }\n\n /* @legacy — Will be refactored to use SsoConnection resources /\n public async getSSOProviderByDomain(\n organizationId: string,\n emailDomain: string,\n ): Promise<Record<string, unknown> \| null> {\n const config = this.ssoConfigs.get(this._cacheKey(AuthScopeType.ORGANIZATION, organizationId)) as any;\n if (!config \|\| !config.domains?.domainHinting) return null;\n\n if (!config.domains.ssoEnabledDomains?.includes(emailDomain)) return null;\n\n const samlProvider = config.samlProviders?.find((p: any) =>\n p.enabled && p.allowedDomains?.includes(emailDomain)\n );\n if (samlProvider) return samlProvider;\n\n const oidcProvider = config.openidConnectProviders?.find((p: any) =>\n p.enabled && p.allowedDomains?.includes(emailDomain)\n );\n return oidcProvider \|\| null;\n }\n\n // ===============================\n // CONVENIENCE METHODS\n // ===============================\n\n public async isSSORequired(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return config?.enforcement.requireSSO \|\| false;\n }\n\n public async isPasswordFallbackAllowed(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return config?.enforcement.allowPasswordFallback ?? true;\n }\n\n public async getDomains(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<{\n verified: string[];\n ssoEnabled: string[];\n allowExternal: boolean;\n }> {\n const config = await this.loadSSOConfig(ec, scopeType, scopeId);\n return {\n /\n * DERIVED, not the stored list (#457). `domains.verifiedDomains` holds every CLAIMED domain —\n * `initiateDomainVerification` pushes one in at claim time with status `pending` — so\n * returning it under the name `verified` handed a caller pending, failed and expired domains\n * with no reason to suspect it. There is no such caller yet, which is the only reason this was\n * contained rather than a disclosure.\n /\n verified: resolveVerifiedDomains(config?.domains),\n ssoEnabled: config?.domains.ssoEnabledDomains \|\| [],\n allowExternal: config?.domains.allowExternalDomains \|\| false,\n };\n }\n\n /\n * `isEmergencyAccessEnabled` and `getEmergencyAccessAccounts` used to sit here, and both had ZERO\n * callers for as long as they existed — two accessors onto a config block nothing read (#423).\n \n The break-glass decision is now taken by `isBreakGlassAccount` in\n * `enterprise-sso-enforcement.backend.utils`, beside `requiresEnterpriseSsoOnly`, because the two\n * must agree: one decides whether a password field is offered at all, the other decides who gets\n * past the enforcement gate, and a tenant whose accounts cannot reach a password field has\n * break-glass in name only. Splitting them across two modules is how they drift.\n /\n\n public validateSSOConfig(config: Partial<SsoConfigBase>): { isValid: boolean; errors: string[] } {\n const result = SsoConfigBaseSchema.safeParse(config);\n if (result.success) {\n return { isValid: true, errors: [] };\n } else {\n const zodError = (result as ZodSafeParseError<Partial<SsoConfigBase>>).error;\n const errors = zodError.issues.map(issue => issue.message);\n return { isValid: false, errors };\n }\n }\n\n // ===============================\n // CONFIG CHANGE LISTENERS\n // ===============================\n\n public onConfigChange(callback: (scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase) => void): void {\n this.configChangeListeners.push(callback);\n }\n\n private notifyConfigChange(scopeType: AuthScopeType, scopeId: string, config: SsoConfigBase): void {\n this.configChangeListeners.forEach(callback => {\n try {\n callback(scopeType, scopeId, config);\n } catch (error) {\n this.logger.error('Error in configuration change listener', { scopeType, scopeId, error });\n }\n });\n }\n\n // ===============================\n // DEFAULT SSO CONFIG\n // ===============================\n\n public createDefaultSSOConfig(scopeType: AuthScopeType, scopeId: string): Record<string, unknown> {\n return {\n ...this._scopeFilter(scopeType, scopeId),\n enforcement: {\n requireSSO: false,\n allowPasswordFallback: true,\n graceLoginAttempts: 3,\n },\n domains: {\n verifiedDomains: [],\n ssoEnabledDomains: [],\n domainHinting: true,\n allowExternalDomains: false,\n domainVerificationStatus: {},\n domainVerificationTokens: {},\n },\n provisioning: {\n autoCreateUsers: true,\n autoUpdateUsers: true,\n autoDeactivateUsers: false,\n requiredAttributes: ['email'],\n syncFrequencyHours: 24,\n },\n sessionSettings: {\n ssoSessionDurationMinutes: 480,\n requireReauthForSensitive: true,\n singleLogoutEnabled: true,\n maxConcurrentSessions: 5,\n },\n auditConfig: {\n logAllSSOEvents: true,\n logProviderSwitching: true,\n logRoleMapping: true,\n complianceReporting: false,\n retentionDays: 365,\n },\n // `enabled: true` with an EMPTY list grants nothing — the list is what confers the bypass, so\n // a default tenant has break-glass switched on and nobody named. `requireApproval`,\n // `maxDurationHours` and `auditLevel` were removed from the schema (#481/#423); this builder\n // returns `Record<string, unknown>`, so nothing would have caught them staying here.\n emergencyAccess: {\n enabled: true,\n breakGlassAccounts: [],\n },\n oauth2ProviderRestrictions: {\n allowedProviders: [],\n blockedProviders: [],\n requireEnterpriseSSOOnly: false,\n },\n };\n }\n\n // ===============================\n // SIEM EXPORT CONFIGURATION\n // ===============================\n\n /\n Loads the scope's SIEM export config for the audit-event dispatcher (called\n * per-org on the login/audit path). Reads with a system EC (`readAsSystem`) —\n * the routing read is userless — and, when the row is absent (a provisioned /\n * migrated / pre-seed org that bypassed the `afterCreate` default-seed), lazily\n * materialises the disabled-default row via `createAsSystem` (gated by\n * `systemAccessPolicy.create`). The default payload mirrors the framework seed:\n * the nested `eventFilter` / `delivery` objects carry no object-level default\n * (only inner-field defaults), so each must be present as `{}` to validate.\n * `ec` is retained for signature symmetry and not consulted (both operations\n * run system-context; the logging-in user is not the config's admin owner).\n /\n public async loadSiemExportConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<SiemExportConfigBase \| null> {\n void ec;\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSiemResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<SiemExportConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) {\n this.siemExportConfigs.set(cacheKey, config);\n return config;\n }\n const defaultConfig = { ...this._scopeFilter(scopeType, scopeId), eventFilter: {}, delivery: {} };\n const created = await this._createScopeSingletonDefaultToleratingRace<SiemExportConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n this.siemExportConfigs.set(cacheKey, created);\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert that fired on every login\n // for a config-less org. Stay resilient: log the detail and fall back to cache.\n this.logger.error('Failed to load SIEM export configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return this.siemExportConfigs.get(cacheKey) \|\| null;\n }\n }\n\n public async saveSiemExportConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string, config: Partial<SiemExportConfigBase>): Promise<void> {\n const cacheKey = this._cacheKey(scopeType, scopeId);\n try {\n const resourceType = this._resolveSiemResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<SiemExportConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n const merged = { ...(existing \|\| {}), ...config } as SiemExportConfigBase;\n this.siemExportConfigs.set(cacheKey, merged);\n this.logDebug('SIEM export configuration saved', { scopeType, scopeId, enabled: merged.enabled });\n } catch (error) {\n this.logger.error('Failed to save SIEM export configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n\n public async isSecurityExportEnabled(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<boolean> {\n const config = await this.loadSiemExportConfig(ec, scopeType, scopeId);\n return config?.enabled \|\| false;\n }\n\n // ===============================\n // SCIM PROVISIONING CONFIGURATION\n // ===============================\n\n /\n Loads the scope's SCIM provisioning config. Reads with a system EC\n * (`readAsSystem`) and, when the row is absent (a provisioned / migrated /\n * pre-seed org that bypassed the `afterCreate` default-seed), lazily\n * materialises the default row via `createAsSystem` (gated by\n * `systemAccessPolicy.create`). The default payload carries only the scope FK —\n * every behavioural field (`autoCreateUsers`, `autoVerifyEmail`,\n * `autoDeactivateUsers`, `defaultRole`, `attributeMapping`) is defaulted by\n * `ScimProvisioningConfigBaseSchema`. `ec` is retained for signature symmetry with\n * the other loaders and is not consulted (the read runs system-context).\n \n There is deliberately no `scimEnabled` seeding here: enablement is a per-ORG-TYPE\n * concern (`organizationTypes[type].scimProvisioning.enabled`), not a per-scope row\n * field — see the note on `ScimProvisioningConfigBaseSchema`. This loader materialises\n * the behaviour row that `SCIMControllerBackendService._getProvisioningConfig` reads\n * once SCIM is enabled for the org type.\n /\n public async loadScimProvisioningConfig(ec: ExecutionContext<any>, scopeType: AuthScopeType, scopeId: string): Promise<ScimProvisioningConfigBase \| null> {\n void ec;\n try {\n const resourceType = this._resolveScimConfigResourceType(scopeType);\n const config = await this.getSystemAccessService().readAsSystem<ScimProvisioningConfigBase>(\n resourceType,\n this._scopeFilter(scopeType, scopeId),\n { scopeContext: this._scopeContextForResolution(scopeType, scopeId) },\n );\n if (config) return config;\n\n const defaultConfig = { ...this._scopeFilter(scopeType, scopeId) };\n const created = await this._createScopeSingletonDefaultToleratingRace<ScimProvisioningConfigBase>(\n resourceType,\n scopeType,\n scopeId,\n defaultConfig,\n );\n return created;\n } catch (error) {\n // Post-fix, the lazy-create resolves (INTERNAL_CALL + systemAccessPolicy.create),\n // so this only fires on a genuine load/create failure — NOT the former\n // `resources_registry_operation_path_not_found` alert. Stay resilient.\n this.logger.error('Failed to load SCIM provisioning configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n return null;\n }\n }\n\n /\n Write counterpart of {@link loadScimProvisioningConfig}, completing the enterprise-config\n * trio's load/save symmetry (SSO and SIEM already had one; SCIM was the odd resource out).\n \n ADMIN-INITIATED, so — unlike the userless lazy-create in the loader — the write dispatches\n * through the services registry on the CALLER's `ec`, preserving admin audit attribution.\n * Deliberately NOT `updateAsSystem`: a system write would both erase that attribution and\n * require a `systemAccessPolicy.update` opt-in that no enterprise-config resource declares —\n * widening the trusted-write surface to buy nothing (the caller here IS an authenticated admin,\n * so the normal ACL is the correct door).\n \n This resolves only because the SCIM config's UPDATE variant is `INTERNAL_CALL`:\n * `ServicesRegistryHandler.update` resolves via `getServiceOperationPathDefault`, which rejects\n * `REPOSITORY_ONLY` with `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical).\n * If a future change reverts that variant, THIS method is what starts throwing — the pin in\n * `resources-registry.integration.test.ts` guards the pair.\n \n No cache write (mirroring {@link loadScimProvisioningConfig}, which does not cache — unlike\n * the SSO/SIEM helpers, whose caches back a hot login-path read).\n */\n public async saveScimProvisioningConfig(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n config: Partial<ScimProvisioningConfigBase>,\n ): Promise<void> {\n // Guard BEFORE any read/write: a defaultRole that grants admin is a privilege-escalation\n // vector (the IdP would mint tenant admins). Throwing here also keeps the invalid value out\n // of the store entirely. Runs outside the try so the VALIDATION error surfaces to the admin\n // caller verbatim rather than being caught + re-logged as a save failure.\n this._assertNonAdminScimDefaultRole(config);\n try {\n const resourceType = this._resolveScimConfigResourceType(scopeType);\n const filter = this._scopeFilter(scopeType, scopeId);\n const existing = await this.getServicesRegistryHandler().read<ScimProvisioningConfigBase>(resourceType, ec, filter);\n if (existing) {\n await this.getServicesRegistryHandler().update(resourceType, ec, (existing as any)._id, config);\n } else {\n await this.getServicesRegistryHandler().create(resourceType, ec, { ...config, ...filter });\n }\n this.logDebug('SCIM provisioning configuration saved', { scopeType, scopeId });\n } catch (error) {\n this.logger.error('Failed to save SCIM provisioning configuration', {\n scopeType,\n scopeId,\n error: isWildoBackendError(error) ? (error.context?.message ?? error.type) : error,\n });\n throw error;\n }\n }\n}\n"]}

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-to-org-lookup.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAGL,aAAa,EAEb,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,WAAW,CAAC;CACnC;AAED,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC,EAC5D,uBAAuB,EAAE,qCAAqC,EACzE,mBAAmB,EAAE,0BAA0B;IAMlH;;;;;;OAMG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2B9G;;;OAGG;YACW,uBAAuB;IAyDrC;;OAEG;YACW,mBAAmB;IAgEjC;;;OAGG;IACI,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,GAAG;QACxD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,IAAI;IAYR;;;;;;;;;;;;;;;;;OAiBG;IACU,mBAAmB,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAuCzC"}
1	+ {"version":3,"file":"domain-to-org-lookup.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,EAGL,aAAa,EAEb,WAAW,EACZ,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAC5G,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,aAAa,CAAC;IACzB,yGAAyG;IACzG,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE;QACZ,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,SAAS,EAAE,aAAa,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,iBAAiB,CAAC;IACpC,iCAAiC;IACjC,mBAAmB,CAAC,EAAE,WAAW,CAAC;CACnC;AAED,qBACa,+BAA+B;IAIL,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACvC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACnD,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANtF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC,EAC5D,uBAAuB,EAAE,qCAAqC,EACzE,mBAAmB,EAAE,0BAA0B;IAMlH;;;;;;OAMG;IACU,eAAe,CAAC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IA2B9G;;;OAGG;YACW,uBAAuB;IAyDrC;;OAEG;YACW,mBAAmB;IAgEjC;;;OAGG;IACI,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,GAAG;QACxD,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,WAAW,CAAC;KAC3B,GAAG,IAAI;IAYR;;;;;;;;;;;;;;;;;OAiBG;IACU,mBAAmB,CAC9B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;CAuCzC"}

package/dist/esm/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-to-org-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAmCxB,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAIY;IAC8B;IACN;IACX;IANlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAC5D,uBAA8D,EACzE,mBAA+C;QAH5D,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACzE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEhF,yEAAyE;QACzE,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,EAAyB,EACzB,SAAwB,EACxB,gBAAwB;QAExB,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE;gBAC/F,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,gBAAgB;aACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YAC3D,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;oBACtD,CAAC,CAAE,IAAgC,CAAC,cAAwB;oBAC5D,CAAC,CAAE,IAAgC,CAAC,aAAuB,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAEzB;;;;;mBAKG;gBACH,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;gBAC3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;uBACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEvF,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAChD,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACjF,CAAC,CAAC;gBAEH,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS;oBACT,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,gBAAwB;QAExB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,2FAA2F;QAC3F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;QAE3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;eACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,gFAAgF;QAChF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QAEjD,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;aACzG,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YACtK,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnF,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,OAAO;YACP,mBAAmB;YACnB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,UAAU;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,MAA6B;QAMrD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,IAAI,aAAa;YACzD,YAAY,EAAE,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;YAC5C,YAAY,EAAE,MAAM,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,KAAK,EAAE,CAAC,CAAC,mGAAmG;QAC5G,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QACjD,MAAM,WAAW,GAA4B;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACzG,CAAC;QAEF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC7D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACpC,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF,CAAA;AAjQY,+BAA+B;IAD3C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHa,aAAa;QAC2B,oCAAoC;GAL/H,+BAA+B,CAiQ3C","sourcesContent":["/*\n DomainToOrgLookupBackendService\n \n Provides domain-based organization lookup for SSO routing.\n * When a user enters their email, this service determines if their domain\n * is claimed by an organization with SSO configured.\n \n Step 14: Enterprise SSO — Domain Routing in Auth Flow\n * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)\n \n Used by:\n * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check\n * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport {\n DomainVerificationStatus,\n isDomainVerified,\n AuthScopeType,\n CoreResourceType,\n SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase, SsoConnectionBase } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n/\n Result of a domain-based scope lookup.\n * Returns an explicit scope discriminator supporting both organization and application scope.\n \n ⚠️ TRUST CONTRACT — `scopeId` is a DOMAIN-OWNERSHIP HINT, NEVER a security key.\n * It is the org that DNS-verified-claims the login email's domain, so it is attacker-influenceable\n * (the caller picks the email → the domain → the org). Safe uses: enforcement-TIGHTENING SSO gates\n * (which only ever BLOCK a login — the fail-safe direction) and display/branding. NEVER use it to\n * route data to the org, scope a resource read/query by tenant, derive membership/roles, grant\n * access, or gate features. For a per-user VERIFIED org, resolve active memberships\n * (`resolveActiveMemberOrgIds(userId)` → branded `VerifiedOrgId[]`). Routing the audit trail on this\n * value was the 2026-07-09 cross-tenant leak (see the `session-org-trust-sweep-audit` plan).\n /\nexport interface DomainOrgLookupResult {\n scopeType: AuthScopeType;\n /* Domain-ownership hint (DNS-verified). NEVER a routing/scoping/authz key — see the interface JSDoc. /\n scopeId: string;\n enforcement?: {\n requireSSO?: boolean;\n allowPasswordFallback?: boolean;\n graceLoginAttempts?: number;\n };\n ssoConfig: SsoConfigBase;\n /* The specific SSO provider that matches the domain (OIDC or SAML) /\n matchedProvider?: SsoConnectionBase;\n /* Provider type discriminant /\n matchedProviderType?: SsoProtocol;\n}\n\n@injectable()\nexport class DomainToOrgLookupBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('DomainToOrgLookup');\n this.logger.setDebugTypeLogging('DomainToOrgLookup', false);\n }\n\n /\n Find the scope (organization or application) that claims the given email domain for SSO.\n \n Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,\n * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).\n * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.\n /\n public async findOrgByDomain(ec: ExecutionContext<any>, domain: string): Promise<DomainOrgLookupResult \| null> {\n const normalizedDomain = domain.toLowerCase();\n this.logDebug('Looking up scope by email domain', { domain: normalizedDomain });\n\n // 1. Fast path: indexed query for connections with explicit domain match\n for (const scopeType of [AuthScopeType.ORGANIZATION, AuthScopeType.APPLICATION]) {\n const result = await this._findConnectionByDomain(ec, scopeType, normalizedDomain);\n if (result) return result;\n }\n\n // 2. Fallback: iterate scopes for wildcard connections (empty allowedDomains)\n const orgIds = this.orgConfigService.getAllOrganizationIds();\n for (const orgId of orgIds) {\n const result = await this._matchDomainInScope(ec, AuthScopeType.ORGANIZATION, orgId, normalizedDomain);\n if (result) return result;\n }\n\n const appIds = this.orgConfigService.getAllApplicationIds?.() ?? [];\n for (const appId of appIds) {\n const result = await this._matchDomainInScope(ec, AuthScopeType.APPLICATION, appId, normalizedDomain);\n if (result) return result;\n }\n\n this.logDebug('No scope claims this domain', { domain: normalizedDomain });\n return null;\n }\n\n /\n Indexed cross-scope query: find enabled connections that explicitly list this domain\n * in allowedDomains, then verify DNS status via the SSO config for the matched scope.\n /\n private async _findConnectionByDomain(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n normalizedDomain: string,\n ): Promise<DomainOrgLookupResult \| null> {\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n try {\n const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, {\n enabled: true,\n allowedDomains: normalizedDomain,\n }, undefined, { paginated: false }) as SsoConnectionBase[];\n const connectionsList = connections ?? [];\n\n for (const conn of connectionsList) {\n const scopeId = scopeType === AuthScopeType.ORGANIZATION\n ? (conn as Record<string, unknown>).organizationId as string\n : (conn as Record<string, unknown>).applicationId as string;\n if (!scopeId) continue;\n\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) continue;\n\n /\n * The CLAIMED half goes through the one derivation (#457); the `ssoEnabledDomains` half\n * keeps its own status gate, because that list is a separate claim channel with the same\n * requirement. Exactly equivalent to the hand-written join it replaces — `isDomainVerified`\n * already carries the status check for its own list.\n /\n const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n \|\| (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n if (!domainMatches) continue;\n\n this.logDebug('Domain matched via indexed query', {\n domain: normalizedDomain, scopeType, scopeId, matchedProviderType: conn.protocol,\n });\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider: conn,\n matchedProviderType: conn.protocol,\n };\n }\n } catch {\n this.logDebug('SsoConnection repository not available for indexed query', { scopeType });\n }\n\n return null;\n }\n\n /\n Try to match a domain against a specific scope's SSO config.\n /\n private async _matchDomainInScope(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n normalizedDomain: string,\n ): Promise<DomainOrgLookupResult \| null> {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return null;\n\n // H4: Only trust domains that have passed DNS verification. Same shape as the indexed path\n // above — the claimed half through the derivation, the ssoEnabled half status-gated (#457).\n const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n\n const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n \|\| (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n if (!domainMatches) return null;\n\n // Find the matching SSO connection for this domain from SsoConnection resources\n let matchedProvider: SsoConnectionBase \| undefined;\n let matchedProviderType: SsoProtocol \| undefined;\n\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n try {\n const scopeFilter: Record<string, unknown> = {\n enabled: true,\n ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n };\n const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, scopeFilter, undefined, { paginated: false }) as SsoConnectionBase[];\n const connectionsList = connections ?? [];\n\n const match = connectionsList.find(conn =>\n conn.allowedDomains.length === 0 \|\| conn.allowedDomains.includes(normalizedDomain),\n );\n\n if (match) {\n matchedProvider = match;\n matchedProviderType = match.protocol;\n }\n } catch {\n this.logDebug('SsoConnection repository not available for scope', { scopeType, scopeId });\n }\n\n this.logDebug('Domain matched to scope', {\n domain: normalizedDomain,\n scopeType,\n scopeId,\n matchedProviderType,\n requireSSO: ssoConfig.enforcement.requireSSO,\n });\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider,\n matchedProviderType,\n };\n }\n\n /\n Get the SSO provider info needed for the identification response.\n * Called by identify() when a domain match is found.\n /\n public getSSOProviderInfo(result: DomainOrgLookupResult): {\n displayName: string;\n providerRef: string;\n connectionId: string;\n providerType: SsoProtocol;\n } \| null {\n if (!result.matchedProvider \|\| !result.matchedProviderType) return null;\n\n const provider = result.matchedProvider;\n return {\n displayName: provider.displayName,\n providerRef: provider.externalProviderId \|\| 'custom-oidc',\n connectionId: provider._id \|\| result.scopeId,\n providerType: result.matchedProviderType,\n };\n }\n\n /\n Scope-keyed lookup — the domain-INDEPENDENT counterpart of\n * {@link findOrgByDomain}. Given a KNOWN scope (organization or application) id,\n * resolve its active SSO connection into a {@link DomainOrgLookupResult}, so a\n * surface that already knows the scope (notably the public invitation-accept\n * screen, keyed by the invitation's `organizationId`) can enrich ORG_SAML /\n * ORG_OPENID_CONNECT methods with the SAME per-connection `ssoIds`/`config` that\n * `identify()` produces — with no email→domain gate.\n \n System-access seam: the canonical (and only) caller is the PUBLIC, NON-consuming invitation\n * discovery endpoint under an UNAUTHENTICATED pre-auth EC. `ssoConfig` is read via\n * `readSSOConfigIfExists` — a pure READ (through the ACL-independent `readAsSystem` door) that\n * NEVER lazily creates a default config row, unlike `loadSSOConfig` (read-then-create): a public\n * GET discovery endpoint must not WRITE. The SSO CONNECTIONS are org-scoped and their plain LIST\n * door would fail-closed here, so they are listed via `listAsSystem` (the SSO-connection resource\n * opts into system LIST via `systemAccessPolicy.read = ALLOWED`). Returns `null` when the scope has\n * no SSO config or no enabled connection (→ caller drops the SSO methods, as today).\n */\n public async buildLookupForScope(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n ): Promise<DomainOrgLookupResult \| null> {\n void ec; // read-only (no lazy-create) path below no longer needs the EC; retained for signature continuity.\n const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n if (!ssoConfig) return null;\n\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n const scopeFilter: Record<string, unknown> = {\n enabled: true,\n ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n };\n\n let matchedProvider: SsoConnectionBase \| undefined;\n let matchedProviderType: SsoProtocol \| undefined;\n try {\n // System-access LIST (no domain gate): take the scope's active connection.\n const connections = await this.systemAccessService.listAsSystem<SsoConnectionBase>(\n resourceType, scopeFilter, undefined, { paginated: false },\n ) as SsoConnectionBase[];\n const match = (connections ?? [])[0];\n if (match) {\n matchedProvider = match;\n matchedProviderType = match.protocol;\n }\n } catch {\n this.logDebug('SSO connections not readable for scope via system access', { scopeType, scopeId });\n }\n if (!matchedProvider) return null;\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider,\n matchedProviderType,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"domain-to-org-lookup.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-to-org-lookup.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AAEjK,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAEjB,MAAM,uBAAuB,CAAC;AAmCxB,IAAM,+BAA+B,GAArC,MAAM,+BAA+B;IAIY;IAC8B;IACN;IACX;IANlD,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAC5D,uBAA8D,EACzE,mBAA+C;QAH5D,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAC5D,4BAAuB,GAAvB,uBAAuB,CAAuC;QACzE,wBAAmB,GAAnB,mBAAmB,CAA4B;QAEhH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;OAMG;IACI,KAAK,CAAC,eAAe,CAAC,EAAyB,EAAE,MAAc;QACpE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAEhF,yEAAyE;QACzE,KAAK,MAAM,SAAS,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAChF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACnF,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACvG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACtG,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,uBAAuB,CACnC,EAAyB,EACzB,SAAwB,EACxB,gBAAwB;QAExB,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE;gBAC/F,OAAO,EAAE,IAAI;gBACb,cAAc,EAAE,gBAAgB;aACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YAC3D,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;oBACtD,CAAC,CAAE,IAAgC,CAAC,cAAwB;oBAC5D,CAAC,CAAE,IAAgC,CAAC,aAAuB,CAAC;gBAC9D,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;gBACpF,IAAI,CAAC,SAAS;oBAAE,SAAS;gBAEzB;;;;;mBAKG;gBACH,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;gBAC3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;uBACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBAEvF,IAAI,CAAC,aAAa;oBAAE,SAAS;gBAE7B,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE;oBAChD,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACjF,CAAC,CAAC;gBAEH,OAAO;oBACL,SAAS;oBACT,OAAO;oBACP,WAAW,EAAE,SAAS,CAAC,WAAW;oBAClC,SAAS;oBACT,eAAe,EAAE,IAAI;oBACrB,mBAAmB,EAAE,IAAI,CAAC,QAAQ;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB,CAC/B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,gBAAwB;QAExB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,2FAA2F;QAC3F,4FAA4F;QAC5F,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;QAE3H,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;eACtE,CAAC,aAAa,IAAI,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAEvF,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAEhC,gFAAgF;QAChF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QAEjD,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAA4B;gBAC3C,OAAO,EAAE,IAAI;gBACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;aACzG,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAoB,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAwB,CAAC;YACtK,MAAM,eAAe,GAAG,WAAW,IAAI,EAAE,CAAC;YAE1C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxC,IAAI,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CACnF,CAAC;YAEF,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,kDAAkD,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,yBAAyB,EAAE;YACvC,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,OAAO;YACP,mBAAmB;YACnB,UAAU,EAAE,SAAS,CAAC,WAAW,CAAC,UAAU;SAC7C,CAAC,CAAC;QAEH,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CAAC,MAA6B;QAMrD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC;QAExE,MAAM,QAAQ,GAAG,MAAM,CAAC,eAAe,CAAC;QACxC,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,kBAAkB,IAAI,aAAa;YACzD,YAAY,EAAE,QAAQ,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO;YAC5C,YAAY,EAAE,MAAM,CAAC,mBAAmB;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,KAAK,CAAC,mBAAmB,CAC9B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,KAAK,EAAE,CAAC,CAAC,mGAAmG;QAC5G,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC;QAE5B,MAAM,YAAY,GAAG,SAAS,KAAK,aAAa,CAAC,YAAY;YAC3D,CAAC,CAAC,gBAAgB,CAAC,4BAA4B;YAC/C,CAAC,CAAC,gBAAgB,CAAC,2BAA2B,CAAC;QACjD,MAAM,WAAW,GAA4B;YAC3C,OAAO,EAAE,IAAI;YACb,GAAG,CAAC,SAAS,KAAK,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;SACzG,CAAC;QAEF,IAAI,eAA8C,CAAC;QACnD,IAAI,mBAA4C,CAAC;QACjD,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAC7D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CACpC,CAAC;YACzB,MAAM,KAAK,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,eAAe,GAAG,KAAK,CAAC;gBACxB,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC;YACvC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,0DAA0D,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAElC,OAAO;YACL,SAAS;YACT,OAAO;YACP,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,SAAS;YACT,eAAe;YACf,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF,CAAA;AAjQY,+BAA+B;IAD3C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAC/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,CAAA;IACzD,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;qCAHa,aAAa;QAC2B,oCAAoC;GAL/H,+BAA+B,CAiQ3C","sourcesContent":["/*\n DomainToOrgLookupBackendService\n \n Provides domain-based organization lookup for SSO routing.\n * When a user enters their email, this service determines if their domain\n * is claimed by an organization with SSO configured.\n \n Step 14: Enterprise SSO — Domain Routing in Auth Flow\n * DI Symbol: DomainToOrgLookupService (was @optional() since Step 4, now bound)\n \n Used by:\n * - OAuth2AuthenticationBackendService.provisionOrLinkUser() — SSO enforcement check\n * - AuthenticationOrchestratorBackendService.identify() — domain-based SSO routing\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport type { ServicesRegistryHandlerBackendService } from '~wildo-backend-lib/base-classes/services/services/services-registry-handler.backend.service';\nimport {\n DomainVerificationStatus,\n isDomainVerified,\n AuthScopeType,\n CoreResourceType,\n SsoProtocol,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase, SsoConnectionBase } from '@wildo-ai/saas-models';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\n\n/\n Result of a domain-based scope lookup.\n * Returns an explicit scope discriminator supporting both organization and application scope.\n \n ⚠️ TRUST CONTRACT — `scopeId` is a DOMAIN-OWNERSHIP HINT, NEVER a security key.\n * It is the org that DNS-verified-claims the login email's domain, so it is attacker-influenceable\n * (the caller picks the email → the domain → the org). Safe uses: enforcement-TIGHTENING SSO gates\n * (which only ever BLOCK a login — the fail-safe direction) and display/branding. NEVER use it to\n * route data to the org, scope a resource read/query by tenant, derive membership/roles, grant\n * access, or gate features. For a per-user VERIFIED org, resolve active memberships\n * (`resolveActiveMemberOrgIds(userId)` → branded `VerifiedOrgId[]`). Routing the audit trail on this\n * value was the 2026-07-09 cross-tenant leak (see the `session-org-trust-sweep-audit` plan).\n /\nexport interface DomainOrgLookupResult {\n scopeType: AuthScopeType;\n /* Domain-ownership hint (DNS-verified). NEVER a routing/scoping/authz key — see the interface JSDoc. /\n scopeId: string;\n enforcement?: {\n requireSSO?: boolean;\n allowPasswordFallback?: boolean;\n graceLoginAttempts?: number;\n };\n ssoConfig: SsoConfigBase;\n /* The specific SSO provider that matches the domain (OIDC or SAML) /\n matchedProvider?: SsoConnectionBase;\n /* Provider type discriminant /\n matchedProviderType?: SsoProtocol;\n}\n\n@injectable()\nexport class DomainToOrgLookupBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n @inject(SAAS_SERVICE_TYPES.ServicesRegistryHandlerService) private readonly servicesRegistryHandler: ServicesRegistryHandlerBackendService,\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) private readonly systemAccessService: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('DomainToOrgLookup');\n this.logger.setDebugTypeLogging('DomainToOrgLookup', false);\n }\n\n /\n Find the scope (organization or application) that claims the given email domain for SSO.\n \n Uses an indexed query on `allowedDomains` for connections with explicit domain restrictions,\n * then falls back to the per-scope loop for wildcard connections (empty allowedDomains).\n * Returns scope discriminator ({ scopeType, scopeId }) instead of bare organizationId.\n /\n public async findOrgByDomain(ec: ExecutionContext<any>, domain: string): Promise<DomainOrgLookupResult \| null> {\n const normalizedDomain = domain.toLowerCase();\n this.logDebug('Looking up scope by email domain', { domain: normalizedDomain });\n\n // 1. Fast path: indexed query for connections with explicit domain match\n for (const scopeType of [AuthScopeType.ORGANIZATION, AuthScopeType.APPLICATION]) {\n const result = await this._findConnectionByDomain(ec, scopeType, normalizedDomain);\n if (result) return result;\n }\n\n // 2. Fallback: iterate scopes for wildcard connections (empty allowedDomains)\n const orgIds = this.orgConfigService.getAllOrganizationIds();\n for (const orgId of orgIds) {\n const result = await this._matchDomainInScope(ec, AuthScopeType.ORGANIZATION, orgId, normalizedDomain);\n if (result) return result;\n }\n\n const appIds = this.orgConfigService.getAllApplicationIds?.() ?? [];\n for (const appId of appIds) {\n const result = await this._matchDomainInScope(ec, AuthScopeType.APPLICATION, appId, normalizedDomain);\n if (result) return result;\n }\n\n this.logDebug('No scope claims this domain', { domain: normalizedDomain });\n return null;\n }\n\n /\n Indexed cross-scope query: find enabled connections that explicitly list this domain\n * in allowedDomains, then verify DNS status via the SSO config for the matched scope.\n /\n private async _findConnectionByDomain(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n normalizedDomain: string,\n ): Promise<DomainOrgLookupResult \| null> {\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n try {\n const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, {\n enabled: true,\n allowedDomains: normalizedDomain,\n }, undefined, { paginated: false }) as SsoConnectionBase[];\n const connectionsList = connections ?? [];\n\n for (const conn of connectionsList) {\n const scopeId = scopeType === AuthScopeType.ORGANIZATION\n ? (conn as Record<string, unknown>).organizationId as string\n : (conn as Record<string, unknown>).applicationId as string;\n if (!scopeId) continue;\n\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) continue;\n\n /\n * The CLAIMED half goes through the one derivation (#457); the `ssoEnabledDomains` half\n * keeps its own status gate, because that list is a separate claim channel with the same\n * requirement. Exactly equivalent to the hand-written join it replaces — `isDomainVerified`\n * already carries the status check for its own list.\n /\n const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n \|\| (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n if (!domainMatches) continue;\n\n this.logDebug('Domain matched via indexed query', {\n domain: normalizedDomain, scopeType, scopeId, matchedProviderType: conn.protocol,\n });\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider: conn,\n matchedProviderType: conn.protocol,\n };\n }\n } catch {\n this.logDebug('SsoConnection repository not available for indexed query', { scopeType });\n }\n\n return null;\n }\n\n /\n Try to match a domain against a specific scope's SSO config.\n /\n private async _matchDomainInScope(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n normalizedDomain: string,\n ): Promise<DomainOrgLookupResult \| null> {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return null;\n\n // H4: Only trust domains that have passed DNS verification. Same shape as the indexed path\n // above — the claimed half through the derivation, the ssoEnabled half status-gated (#457).\n const isDnsVerified = ssoConfig.domains.domainVerificationStatus?.[normalizedDomain] === DomainVerificationStatus.VERIFIED;\n\n const domainMatches = isDomainVerified(ssoConfig.domains, normalizedDomain)\n \|\| (isDnsVerified && ssoConfig.domains.ssoEnabledDomains.includes(normalizedDomain));\n\n if (!domainMatches) return null;\n\n // Find the matching SSO connection for this domain from SsoConnection resources\n let matchedProvider: SsoConnectionBase \| undefined;\n let matchedProviderType: SsoProtocol \| undefined;\n\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n\n try {\n const scopeFilter: Record<string, unknown> = {\n enabled: true,\n ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n };\n const connections = await this.servicesRegistryHandler.list<SsoConnectionBase>(resourceType, ec, scopeFilter, undefined, { paginated: false }) as SsoConnectionBase[];\n const connectionsList = connections ?? [];\n\n const match = connectionsList.find(conn =>\n conn.allowedDomains.length === 0 \|\| conn.allowedDomains.includes(normalizedDomain),\n );\n\n if (match) {\n matchedProvider = match;\n matchedProviderType = match.protocol;\n }\n } catch {\n this.logDebug('SsoConnection repository not available for scope', { scopeType, scopeId });\n }\n\n this.logDebug('Domain matched to scope', {\n domain: normalizedDomain,\n scopeType,\n scopeId,\n matchedProviderType,\n requireSSO: ssoConfig.enforcement.requireSSO,\n });\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider,\n matchedProviderType,\n };\n }\n\n /\n Get the SSO provider info needed for the identification response.\n * Called by identify() when a domain match is found.\n /\n public getSSOProviderInfo(result: DomainOrgLookupResult): {\n displayName: string;\n providerRef: string;\n connectionId: string;\n providerType: SsoProtocol;\n } \| null {\n if (!result.matchedProvider \|\| !result.matchedProviderType) return null;\n\n const provider = result.matchedProvider;\n return {\n displayName: provider.displayName,\n providerRef: provider.externalProviderId \|\| 'custom-oidc',\n connectionId: provider._id \|\| result.scopeId,\n providerType: result.matchedProviderType,\n };\n }\n\n /\n Scope-keyed lookup — the domain-INDEPENDENT counterpart of\n * {@link findOrgByDomain}. Given a KNOWN scope (organization or application) id,\n * resolve its active SSO connection into a {@link DomainOrgLookupResult}, so a\n * surface that already knows the scope (notably the public invitation-accept\n * screen, keyed by the invitation's `organizationId`) can enrich ORG_SAML /\n * ORG_OPENID_CONNECT methods with the SAME per-connection `ssoIds`/`config` that\n * `identify()` produces — with no email→domain gate.\n \n System-access seam: the canonical (and only) caller is the PUBLIC, NON-consuming invitation\n * discovery endpoint under an UNAUTHENTICATED pre-auth EC. `ssoConfig` is read via\n * `readSSOConfigIfExists` — a pure READ (through the ACL-independent `readAsSystem` door) that\n * NEVER lazily creates a default config row, unlike `loadSSOConfig` (read-then-create): a public\n * GET discovery endpoint must not WRITE. The SSO CONNECTIONS are org-scoped and their plain LIST\n * door would fail-closed here, so they are listed via `listAsSystem` (the SSO-connection resource\n * opts into system LIST via `systemAccessPolicy.read = ALLOWED`). Returns `null` when the scope has\n * no SSO config or no enabled connection (→ caller drops the SSO methods, as today).\n */\n public async buildLookupForScope(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n ): Promise<DomainOrgLookupResult \| null> {\n void ec; // read-only (no lazy-create) path below no longer needs the EC; retained for signature continuity.\n const ssoConfig = await this.orgConfigService.readSSOConfigIfExists(scopeType, scopeId);\n if (!ssoConfig) return null;\n\n const resourceType = scopeType === AuthScopeType.ORGANIZATION\n ? CoreResourceType.ORGANIZATION_SSO_CONNECTIONS\n : CoreResourceType.APPLICATION_SSO_CONNECTIONS;\n const scopeFilter: Record<string, unknown> = {\n enabled: true,\n ...(scopeType === AuthScopeType.ORGANIZATION ? { organizationId: scopeId } : { applicationId: scopeId }),\n };\n\n let matchedProvider: SsoConnectionBase \| undefined;\n let matchedProviderType: SsoProtocol \| undefined;\n try {\n // System-access LIST (no domain gate): take the scope's active connection.\n const connections = await this.systemAccessService.listAsSystem<SsoConnectionBase>(\n resourceType, scopeFilter, undefined, { paginated: false },\n ) as SsoConnectionBase[];\n const match = (connections ?? [])[0];\n if (match) {\n matchedProvider = match;\n matchedProviderType = match.protocol;\n }\n } catch {\n this.logDebug('SSO connections not readable for scope via system access', { scopeType, scopeId });\n }\n if (!matchedProvider) return null;\n\n return {\n scopeType,\n scopeId,\n enforcement: ssoConfig.enforcement,\n ssoConfig,\n matchedProvider,\n matchedProviderType,\n };\n }\n}\n"]}

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-verification.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACmB,aAAa,EAAgE,MAAM,uBAAuB,CAAC;AACrI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAExD,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAQD,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClG;;;;OAIG;IACyD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAVnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC;IACxI;;;;OAIG;IAC0E,mBAAmB,CAAC,EAAE,0BAA0B;IAoB/H;;;;;;;OAOG;IACI,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe;IAqClF;;;;OAIG;IACI,uBAAuB,CAC5B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAChB,gBAAgB;IAWnB;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAaxF,6EAA6E;IACtE,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1F,6DAA6D;IACtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIlD;;;;;OAKG;IACU,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAChF,QAAQ,EAAE,OAAO,CAAC;QAClB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAQF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACU,oBAAoB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAuC5C;;;;;;;OAOG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAsBF;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC;IAiDpC;;OAEG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAOnB;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;OAEG;YACW,kBAAkB;CAyBjC"}
1	+ {"version":3,"file":"domain-verification.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,kBAAkB,CAAC;AAI1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAE7F,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACmB,aAAa,EAAgE,MAAM,uBAAuB,CAAC;AACrI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAClI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qEAAqE,CAAC;AAE5G,8CAA8C;AAC9C,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,4FAA4F;AAC5F,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;AAExD,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAC;IAC1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;CACxB;AAQD,qBACa,gCAAgC;IAIN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACO,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAClG;;;;OAIG;IACyD,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAVnG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACS,gBAAgB,EAAE,oCAAoC;IACxI;;;;OAIG;IAC0E,mBAAmB,CAAC,EAAE,0BAA0B;IAoB/H;;;;;;;OAOG;IACI,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe;IAqClF;;;;OAIG;IACI,uBAAuB,CAC5B,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,OAAO,GAChB,gBAAgB;IAWnB;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,gBAAgB;IAaxF,6EAA6E;IACtE,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAI1F,6DAA6D;IACtD,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAIlD;;;;;OAKG;IACU,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;QAChF,QAAQ,EAAE,OAAO,CAAC;QAClB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IAQF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACU,oBAAoB,CAC/B,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;IAuC5C;;;;;;;OAOG;IACU,0BAA0B,CACrC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QACT,iBAAiB,EAAE,MAAM,CAAC;QAC1B,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IAsBF;;;OAGG;IACU,qBAAqB,CAChC,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,wBAAwB,CAAC;IAiDpC;;OAEG;IACU,gBAAgB,CAC3B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAOnB;;;OAGG;IACU,kBAAkB,CAC7B,EAAE,EAAE,gBAAgB,CAAC,GAAG,CAAC,EACzB,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;OAEG;YACW,kBAAkB;CAyBjC"}

package/dist/esm/security/authentications/services/admin-config/domain-verification.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-verification.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACL,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA8BrI,qCAAqC;AACrC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAG9C,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAIW;IAC8B;IAML;IAV9D,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAM3D,mBAAgD;QAPzE,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAM3D,wBAAmB,GAAnB,mBAAmB,CAA6B;QAE7H,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,6CAA6C;IAC7C,uEAAuE;IACvE,EAAE;IACF,8FAA8F;IAC9F,2FAA2F;IAC3F,2FAA2F;IAC3F,6EAA6E;IAC7E,8CAA8C;IAC9C,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,wBAAwB;IAExB;;;;;;;OAOG;IACI,eAAe,CAAC,OAAyB,EAAE,MAAc;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;QAEvC;;;;;;;;;;;WAWG;QACH,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACjE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC9B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAClD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,OAAO;iBACrD;gBACD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB;iBACtC;aACF;YACD,iBAAiB;YACjB,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YACnD,cAAc,EAAE,GAAG,mBAAmB,GAAG,iBAAiB,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAC5B,OAAyB,EACzB,MAAc,EACd,QAAiB;QAEjB,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,OAAO;YACV,wBAAwB,EAAE;gBACxB,GAAG,OAAO,CAAC,wBAAwB;gBACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;aACnG;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACpG,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACnG,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YACtF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YAC1F,wBAAwB,EAAE,eAAe;YACzC,wBAAwB,EAAE,eAAe;SAC1C,CAAC;IACJ,CAAC;IAED,6EAA6E;IACtE,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,OAAO,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,6DAA6D;IACtD,mBAAmB,CAAC,MAAc;QACvC,OAAO,GAAG,sBAAsB,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAIrE,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,cAAc;IACd,uEAAuE;IAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACI,KAAK,CAAC,oBAAoB,CAC/B,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8EAA8E;kBAC5E,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAoG;YAChH,EAAE,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB,EAAE,UAAU,EAAE,gBAAgB,EAAE;YAC/H,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB,EAAE,UAAU,EAAE,eAAe,EAAE;SAC7H,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACtD,OAAO,CAAC,YAAqB,EAC7B,EAAE,EACF,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACF,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAI,GAA0C,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;oBAAE,SAAS;gBACxE,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,SAAS;gBAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC;oBAAE,SAAS;gBAC/D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,wBAAwB;IACxB,uEAAuE;IAEvE;;;;;;;OAOG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAMd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;eAC/E,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAS,CAAC;QAE/E,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAEpG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;IACrF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE1B,6FAA6F;QAC7F,6FAA6F;QAC7F,gCAAgC;QAChC,OAAO,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAIpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,aAAa,GAAG,GAAG,mBAAmB,GAAG,aAAa,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAErD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;gBAC5C,MAAM;gBACN,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAA;AAhYY,gCAAgC;IAD5C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAM/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAPC,aAAa;QAC2B,oCAAoC;GAL/H,gCAAgC,CAgY5C","sourcesContent":["/*\n DomainVerificationBackendService — H4 fix\n \n DNS TXT record verification for domain ownership claims.\n * Prevents domain takeover by requiring orgs to prove they own\n * domains before those domains are trusted for SSO routing.\n \n Verification flow:\n * 1. Admin claims a domain → service generates a unique verification token\n * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`\n * 3. Admin triggers verification → service resolves DNS TXT and compares tokens\n * 4. On match, domain status becomes 'verified'; on failure, 'failed'\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject, optional } from 'inversify';\nimport { randomUUID } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport {\n resolveVerifiedDomains, AuthScopeType, CoreResourceType, DomainVerificationStatus, isDomainVerified } from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/* Result of a domain verification attempt /\nexport interface DomainVerificationResult {\n domain: string;\n status: 'pending' \| 'verified' \| 'failed' \| 'expired';\n verificationToken: string;\n dnsRecordsFound: string[];\n}\n\n/* The `domains` block of an SSO config — the only part of the row these planners touch. /\nexport type SsoConfigDomains = SsoConfigBase['domains'];\n\n/* The scope that already holds a domain VERIFIED, when one does. /\nexport interface DomainExclusivityConflict {\n scopeType: AuthScopeType;\n scopeId: string;\n}\n\n/* A minted challenge plus the `domains` block that records it. /\nexport interface DomainClaimPlan {\n domains: SsoConfigDomains;\n verificationToken: string;\n dnsName: string;\n dnsRecordValue: string;\n}\n\n/* Expected DNS TXT record prefix /\nconst VERIFICATION_PREFIX = 'wildo-domain-verification=';\n\n/* DNS TXT record subdomain /\nconst VERIFICATION_SUBDOMAIN = '_wildo-verification';\n\n@injectable()\nexport class DomainVerificationBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n /\n The exclusivity probe reads OTHER scopes' SSO configs, which no tenant-scoped context may do.\n * `@optional()` so a minimal test container that binds neither still constructs; the probe\n * itself fails CLOSED when it is absent rather than reporting \"no conflict\".\n /\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) @optional() private readonly systemAccessService?: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('DomainVerification');\n this.logger.setDebugTypeLogging('DomainVerification', false);\n }\n\n // ════════════════════════════════════════════════════════════════════\n // PLANNERS — pure, and the reason they exist\n // ════════════════════════════════════════════════════════════════════\n //\n // The three methods below compute a NEW `domains` block and write nothing. That split is what\n // lets the public `claimDomain` / `verifyDomain` / `revokeDomain` operations (#424) run as\n // resource-operation PREFIX hooks: the hook returns the patch and the framework's own core\n // UPDATE persists it, inside the operation's transaction and in front of the\n // `RESOURCE_OPERATION_PERFORMED` audit event.\n //\n // The self-writing wrappers underneath are kept for callers that hold no operation — they simply\n // load, plan and save. Both paths go through one implementation, so a rule applied to one cannot\n // drift from the other.\n\n /\n Mint a challenge for `domain` and return the `domains` block that records it as `pending`.\n \n Re-claiming an already-claimed domain is legal and deliberate: it mints a FRESH nonce and\n * resets the status to `pending`. The stored nonce is `.isBackendOnly()` and is disclosed exactly\n * once, in the claim response, so re-claiming is the only way to recover a lost record value —\n * and it invalidates the previous one, which is the right direction.\n /\n public planDomainClaim(domains: SsoConfigDomains, domain: string): DomainClaimPlan {\n const normalizedDomain = domain.toLowerCase();\n const verificationToken = randomUUID();\n\n /\n * ─── THIS is where `verifiedDomains` stops meaning what its name says (#457) ─────────────────\n \n A domain enters the list at CLAIM time, with status `pending`. So the stored array holds every\n * CLAIMED domain and the real answer is the join with `domainVerificationStatus` — which is why\n * `resolveVerifiedDomains` / `isDomainVerified` exist beside the field and every READER goes\n * through them.\n \n If you add a write here, write the STATUS in the same step. A domain in the list with no\n * status entry is claimed-but-unknowable, and every reader treats that as unverified — which is\n * safe, and silently loses the claim.\n /\n return {\n domains: {\n ...domains,\n verifiedDomains: domains.verifiedDomains.includes(normalizedDomain)\n ? [...domains.verifiedDomains]\n : [...domains.verifiedDomains, normalizedDomain],\n domainVerificationStatus: {\n ...domains.domainVerificationStatus,\n [normalizedDomain]: DomainVerificationStatus.PENDING,\n },\n domainVerificationTokens: {\n ...domains.domainVerificationTokens,\n [normalizedDomain]: verificationToken,\n },\n },\n verificationToken,\n dnsName: this.verificationDnsName(normalizedDomain),\n dnsRecordValue: `${VERIFICATION_PREFIX}${verificationToken}`,\n };\n }\n\n /\n Record the outcome of a challenge check. `verified` decides between `verified` and `failed`;\n * there is no third answer, because a check that could not resolve DNS has already been reported\n * as not-verified by {@link checkDomainChallenge}.\n /\n public planVerificationOutcome(\n domains: SsoConfigDomains,\n domain: string,\n verified: boolean,\n ): SsoConfigDomains {\n const normalizedDomain = domain.toLowerCase();\n return {\n ...domains,\n domainVerificationStatus: {\n ...domains.domainVerificationStatus,\n [normalizedDomain]: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n },\n };\n }\n\n /\n Remove every trace of a domain from a scope: the claim, its status, its nonce — and its entry\n * in `ssoEnabledDomains`.\n \n That last one is the half a revocation forgets. `ssoEnabledDomains` is a SECOND claim channel\n * that the sign-in router consults with its own status gate\n * (`domain-to-org-lookup.backend.service.ts`), so leaving the domain there while deleting the\n * status entry produces a half-revoked domain: harmless today, and one status write away from\n * routing again under a claim nobody believes they still hold.\n /\n public planDomainRevocation(domains: SsoConfigDomains, domain: string): SsoConfigDomains {\n const normalizedDomain = domain.toLowerCase();\n const { [normalizedDomain]: _removedStatus, ...remainingStatus } = domains.domainVerificationStatus;\n const { [normalizedDomain]: _removedToken, ...remainingTokens } = domains.domainVerificationTokens;\n return {\n ...domains,\n verifiedDomains: domains.verifiedDomains.filter((entry) => entry !== normalizedDomain),\n ssoEnabledDomains: domains.ssoEnabledDomains.filter((entry) => entry !== normalizedDomain),\n domainVerificationStatus: remainingStatus,\n domainVerificationTokens: remainingTokens,\n };\n }\n\n /* The challenge nonce a scope holds for a domain, if it has claimed one. /\n public getVerificationToken(domains: SsoConfigDomains, domain: string): string \| undefined {\n return domains.domainVerificationTokens?.[domain.toLowerCase()];\n }\n\n /* The DNS name the operator publishes the TXT record on. /\n public verificationDnsName(domain: string): string {\n return `${VERIFICATION_SUBDOMAIN}.${domain.toLowerCase()}`;\n }\n\n /\n Resolve the challenge record and say whether it carries the expected nonce.\n \n Public because the operation that verifies a domain must run the check and persist the outcome\n * as ONE resource UPDATE; a method that did both would have to write on its own.\n /\n public async checkDomainChallenge(domain: string, expectedToken: string): Promise<{\n verified: boolean;\n recordsFound: string[];\n }> {\n return this._checkDnsTxtRecord(domain.toLowerCase(), expectedToken);\n }\n\n // ════════════════════════════════════════════════════════════════════\n // EXCLUSIVITY\n // ════════════════════════════════════════════════════════════════════\n\n /\n The scope OTHER than `(scopeType, scopeId)` that already holds `domain` VERIFIED, if any.\n \n ## Why exclusivity is enforced at all\n \n `DomainToOrgLookupBackendService.findOrgByDomain` returns the FIRST scope whose config matches.\n * Two scopes holding one domain therefore means a `@customer.com` sign-in routes to whichever the\n * lookup reaches first — an answer that can change between processes. Nothing prevented that\n * before, only the fact that reaching the verified state required an out-of-band database write\n * by two different tenants. A public route makes it reachable.\n \n ## What this is NOT protecting against\n \n Worth stating precisely, because it decides how much this check is load-bearing. DNS is already\n * the defence against TAKEOVER: only whoever controls `customer.com` can publish the nonce, so a\n * rogue tenant's claim can never be verified. What remains is the real owner verifying the same\n * domain under two of their own scopes — an ambiguity, not an attack. This check makes that\n * refuse instead of silently deciding.\n \n ## Why the scan is exhaustive, and why it is not filtered\n \n It reads every SSO config row of both scope variants and joins in memory. Two cheaper options\n * were rejected:\n * - `getAllOrganizationIds()` enumerates a warm in-memory cache, so on a cold process it\n * reports fewer scopes than exist. An exclusivity check built on it answers \"nobody else\n * holds it\" from an incomplete population;\n * - a repository filter on `domains.verifiedDomains` is a nested-array predicate. It works on\n * the MongoDB adapter and is not portable to the SQL one, where the block is a JSON column —\n * so it would return nothing rather than fail, in the direction that produces a false\n * \"available\".\n * The cost is bounded by tenant count and paid only on claim and verify, which are rare admin\n * acts. If it ever stops being cheap, the answer is an indexed projection of the verified set,\n * not a filter nobody can prove is portable.\n \n Returns `null` when no other scope holds it. THROWS when it cannot answer — a probe that cannot\n * read must not be mistaken for a probe that found nothing.\n /\n public async findConflictingScope(\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<DomainExclusivityConflict \| null> {\n const normalizedDomain = domain.toLowerCase();\n\n if (!this.systemAccessService) {\n throw new Error(\n 'Domain exclusivity cannot be established without the system-access service; '\n + 'refusing rather than reporting that no other scope holds this domain.',\n );\n }\n\n const variants: ReadonlyArray<{ scopeType: AuthScopeType; resourceType: CoreResourceType; scopeField: string }> = [\n { scopeType: AuthScopeType.ORGANIZATION, resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG, scopeField: 'organizationId' },\n { scopeType: AuthScopeType.APPLICATION, resourceType: CoreResourceType.APPLICATION_SSO_CONFIG, scopeField: 'applicationId' },\n ];\n\n for (const variant of variants) {\n const rows = await this.systemAccessService.listAsSystem<SsoConfigBase>(\n variant.resourceType as never,\n {},\n undefined,\n { paginated: false },\n ) as SsoConfigBase[];\n\n for (const row of rows ?? []) {\n const rowScopeId = (row as unknown as Record<string, unknown>)[variant.scopeField];\n if (variant.scopeType === scopeType && rowScopeId === scopeId) continue;\n if (!row.domains) continue;\n if (!isDomainVerified(row.domains, normalizedDomain)) continue;\n return { scopeType: variant.scopeType, scopeId: String(rowScopeId ?? '') };\n }\n }\n\n return null;\n }\n\n // ════════════════════════════════════════════════════════════════════\n // SELF-WRITING WRAPPERS\n // ════════════════════════════════════════════════════════════════════\n\n /\n Initiate domain verification: generate a token and store it in the scope's SSO config.\n * Returns the token the admin must add as a DNS TXT record.\n \n Does NOT check exclusivity — see {@link findConflictingScope}, which the public operation calls\n * before this planner's patch is persisted. A caller reaching this method directly is asserting\n * it has already answered that question.\n /\n public async initiateDomainVerification(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<{\n verificationToken: string;\n dnsRecord: string;\n dnsName: string;\n }> {\n const normalizedDomain = domain.toLowerCase();\n const ssoConfig = (await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId))\n ?? (this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId) as any);\n\n const plan = this.planDomainClaim(ssoConfig.domains, normalizedDomain);\n ssoConfig.domains = plan.domains;\n await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n this.logDebug('Domain verification initiated', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n });\n\n return {\n verificationToken: plan.verificationToken,\n dnsRecord: plan.dnsRecordValue,\n dnsName: plan.dnsName,\n };\n }\n\n /\n Verify domain ownership by checking DNS TXT records.\n * Updates the domain's verification status in the scope's SSO config.\n /\n public async verifyDomainOwnership(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<DomainVerificationResult> {\n const normalizedDomain = domain.toLowerCase();\n\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n return {\n domain: normalizedDomain,\n status: 'failed',\n verificationToken: '',\n dnsRecordsFound: [],\n };\n }\n\n const expectedToken = this.getVerificationToken(ssoConfig.domains, normalizedDomain);\n if (!expectedToken) {\n this.logDebug('No verification token found for domain', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n });\n return {\n domain: normalizedDomain,\n status: 'failed',\n verificationToken: '',\n dnsRecordsFound: [],\n };\n }\n\n const { verified, recordsFound } = await this.checkDomainChallenge(normalizedDomain, expectedToken);\n\n ssoConfig.domains = this.planVerificationOutcome(ssoConfig.domains, normalizedDomain, verified);\n await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n this.logDebug('Domain verification result', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n status: verified ? 'verified' : 'failed',\n recordsFound: recordsFound.length,\n });\n\n return {\n domain: normalizedDomain,\n status: verified ? 'verified' : 'failed',\n verificationToken: expectedToken,\n dnsRecordsFound: recordsFound,\n };\n }\n\n /\n Check if a domain is verified for the given scope.\n /\n public async isDomainVerified(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<boolean> {\n const normalizedDomain = domain.toLowerCase();\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return false;\n return ssoConfig.domains.domainVerificationStatus[normalizedDomain] === 'verified';\n }\n\n /\n Get the list of verified domains for the given scope.\n * Only returns domains with verificationStatus === 'verified'.\n /\n public async getVerifiedDomains(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n ): Promise<string[]> {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return [];\n\n // The one derivation (#457). This service is also the WRITER that puts a claimed domain into\n // `verifiedDomains` with status `pending`, so it is the last place that should re-derive the\n // join it creates the need for.\n return resolveVerifiedDomains(ssoConfig.domains);\n }\n\n /\n Resolve DNS TXT records for the verification subdomain and check for the expected token.\n */\n private async _checkDnsTxtRecord(domain: string, expectedToken: string): Promise<{\n verified: boolean;\n recordsFound: string[];\n }> {\n try {\n const { Resolver } = await import('node:dns/promises');\n const resolver = new Resolver();\n resolver.setServers(['8.8.8.8', '1.1.1.1']);\n\n const lookupHost = `${VERIFICATION_SUBDOMAIN}.${domain}`;\n const records = await resolver.resolveTxt(lookupHost);\n const flat = records.map(r => r.join(''));\n\n const expectedValue = `${VERIFICATION_PREFIX}${expectedToken}`;\n const verified = flat.some(r => r === expectedValue);\n\n return { verified, recordsFound: flat };\n } catch (error) {\n this.logDebug('DNS TXT record lookup failed', {\n domain,\n error: describeCaughtError(error),\n });\n return { verified: false, recordsFound: [] };\n }\n }\n}\n"]}
1	+ {"version":3,"file":"domain-verification.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/domain-verification.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;AAEH,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,8EAA8E,CAAC;AACnH,OAAO,EAAE,oCAAoC,EAAE,MAAM,2GAA2G,CAAC;AACjK,OAAO,EACL,sBAAsB,EAAE,aAAa,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AA8BrI,qCAAqC;AACrC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,+BAA+B;AAC/B,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAG9C,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAIW;IAC8B;IAML;IAV9D,QAAQ,CAA+D;IAExF,YACsD,MAAqB,EACS,gBAAsD,EAM3D,mBAAgD;QAPzE,WAAM,GAAN,MAAM,CAAe;QACS,qBAAgB,GAAhB,gBAAgB,CAAsC;QAM3D,wBAAmB,GAAnB,mBAAmB,CAA6B;QAE7H,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;IAC/D,CAAC;IAED,uEAAuE;IACvE,6CAA6C;IAC7C,uEAAuE;IACvE,EAAE;IACF,8FAA8F;IAC9F,2FAA2F;IAC3F,2FAA2F;IAC3F,6EAA6E;IAC7E,8CAA8C;IAC9C,EAAE;IACF,iGAAiG;IACjG,iGAAiG;IACjG,wBAAwB;IAExB;;;;;;;OAOG;IACI,eAAe,CAAC,OAAyB,EAAE,MAAc;QAC9D,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,iBAAiB,GAAG,UAAU,EAAE,CAAC;QAEvC;;;;;;;;;;;WAWG;QACH,OAAO;YACL,OAAO,EAAE;gBACP,GAAG,OAAO;gBACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,gBAAgB,CAAC;oBACjE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;oBAC9B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC;gBAClD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,OAAO;iBACrD;gBACD,wBAAwB,EAAE;oBACxB,GAAG,OAAO,CAAC,wBAAwB;oBACnC,CAAC,gBAAgB,CAAC,EAAE,iBAAiB;iBACtC;aACF;YACD,iBAAiB;YACjB,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YACnD,cAAc,EAAE,GAAG,mBAAmB,GAAG,iBAAiB,EAAE;SAC7D,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,uBAAuB,CAC5B,OAAyB,EACzB,MAAc,EACd,QAAiB;QAEjB,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,OAAO;YACV,wBAAwB,EAAE;gBACxB,GAAG,OAAO,CAAC,wBAAwB;gBACnC,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;aACnG;SACF,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACI,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,cAAc,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACpG,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,wBAAwB,CAAC;QACnG,OAAO;YACL,GAAG,OAAO;YACV,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YACtF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,gBAAgB,CAAC;YAC1F,wBAAwB,EAAE,eAAe;YACzC,wBAAwB,EAAE,eAAe;SAC1C,CAAC;IACJ,CAAC;IAED,6EAA6E;IACtE,oBAAoB,CAAC,OAAyB,EAAE,MAAc;QACnE,OAAO,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,6DAA6D;IACtD,mBAAmB,CAAC,MAAc;QACvC,OAAO,GAAG,sBAAsB,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;IAC7D,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,oBAAoB,CAAC,MAAc,EAAE,aAAqB;QAIrE,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,cAAc;IACd,uEAAuE;IAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACI,KAAK,CAAC,oBAAoB,CAC/B,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,8EAA8E;kBAC5E,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAoG;YAChH,EAAE,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB,EAAE,UAAU,EAAE,gBAAgB,EAAE;YAC/H,EAAE,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB,EAAE,UAAU,EAAE,eAAe,EAAE;SAC7H,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,YAAY,CACtD,OAAO,CAAC,YAAqB,EAC7B,EAAE,EACF,SAAS,EACT,EAAE,SAAS,EAAE,KAAK,EAAE,CACF,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAAI,GAA0C,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBACnF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,KAAK,OAAO;oBAAE,SAAS;gBACxE,IAAI,CAAC,GAAG,CAAC,OAAO;oBAAE,SAAS;gBAC3B,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC;oBAAE,SAAS;gBAC/D,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,wBAAwB;IACxB,uEAAuE;IAEvE;;;;;;;OAOG;IACI,KAAK,CAAC,0BAA0B,CACrC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAMd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;eAC/E,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,SAAS,EAAE,OAAO,CAAS,CAAC;QAE/E,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvE,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,+BAA+B,EAAE;YAC7C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;SACzB,CAAC,CAAC;QAEH,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,SAAS,EAAE,IAAI,CAAC,cAAc;YAC9B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,qBAAqB,CAChC,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACrF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,QAAQ,CAAC,wCAAwC,EAAE;gBACtD,SAAS;gBACT,OAAO;gBACP,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,OAAO;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;aACpB,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;QAEpG,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAE7E,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE;YAC1C,SAAS;YACT,OAAO;YACP,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,YAAY,EAAE,YAAY,CAAC,MAAM;SAClC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ;YACxC,iBAAiB,EAAE,aAAa;YAChC,eAAe,EAAE,YAAY;SAC9B,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,gBAAgB,CAC3B,EAAyB,EACzB,SAAwB,EACxB,OAAe,EACf,MAAc;QAEd,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,OAAO,SAAS,CAAC,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC;IACrF,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,kBAAkB,CAC7B,EAAyB,EACzB,SAAwB,EACxB,OAAe;QAEf,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAE1B,6FAA6F;QAC7F,6FAA6F;QAC7F,gCAAgC;QAChC,OAAO,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,aAAqB;QAIpE,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;YAChC,QAAQ,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;YAE5C,MAAM,UAAU,GAAG,GAAG,sBAAsB,IAAI,MAAM,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAE1C,MAAM,aAAa,GAAG,GAAG,mBAAmB,GAAG,aAAa,EAAE,CAAC;YAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC;YAErD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,8BAA8B,EAAE;gBAC5C,MAAM;gBACN,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF,CAAA;AAhYY,gCAAgC;IAD5C,UAAU,EAAE;IAKR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,oCAAoC,CAAC,CAAA;IAM/D,WAAA,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,CAAA;IAAE,WAAA,QAAQ,EAAE,CAAA;qCAPC,aAAa;QAC2B,oCAAoC;GAL/H,gCAAgC,CAgY5C","sourcesContent":["/*\n DomainVerificationBackendService — H4 fix\n \n DNS TXT record verification for domain ownership claims.\n * Prevents domain takeover by requiring orgs to prove they own\n * domains before those domains are trusted for SSO routing.\n \n Verification flow:\n * 1. Admin claims a domain → service generates a unique verification token\n * 2. Admin adds a DNS TXT record: `_wildo-verification.<domain>` = `wildo-domain-verification=<token>`\n * 3. Admin triggers verification → service resolves DNS TXT and compares tokens\n * 4. On match, domain status becomes 'verified'; on failure, 'failed'\n /\n\nimport 'reflect-metadata';\nimport { injectable, inject, optional } from 'inversify';\nimport { randomUUID } from 'crypto';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { describeCaughtError } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport { AuthOrganizationConfigurationService } from '~wildo-backend-lib/security/authentications/services/admin-config/auth-organization-configuration.service';\nimport {\n resolveVerifiedDomains, AuthScopeType, CoreResourceType, DomainVerificationStatus, isDomainVerified } from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { SystemAccessBackendService } from '~wildo-backend-lib/base-classes/services/services/system-access.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n/* Result of a domain verification attempt /\nexport interface DomainVerificationResult {\n domain: string;\n status: 'pending' \| 'verified' \| 'failed' \| 'expired';\n verificationToken: string;\n dnsRecordsFound: string[];\n}\n\n/* The `domains` block of an SSO config — the only part of the row these planners touch. /\nexport type SsoConfigDomains = SsoConfigBase['domains'];\n\n/* The scope that already holds a domain VERIFIED, when one does. /\nexport interface DomainExclusivityConflict {\n scopeType: AuthScopeType;\n scopeId: string;\n}\n\n/* A minted challenge plus the `domains` block that records it. /\nexport interface DomainClaimPlan {\n domains: SsoConfigDomains;\n verificationToken: string;\n dnsName: string;\n dnsRecordValue: string;\n}\n\n/* Expected DNS TXT record prefix /\nconst VERIFICATION_PREFIX = 'wildo-domain-verification=';\n\n/* DNS TXT record subdomain /\nconst VERIFICATION_SUBDOMAIN = '_wildo-verification';\n\n@injectable()\nexport class DomainVerificationBackendService {\n private readonly logDebug: (message: string, context?: Record<string, unknown>) => void;\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AuthOrganizationConfigurationService) private readonly orgConfigService: AuthOrganizationConfigurationService,\n /\n The exclusivity probe reads OTHER scopes' SSO configs, which no tenant-scoped context may do.\n * `@optional()` so a minimal test container that binds neither still constructs; the probe\n * itself fails CLOSED when it is absent rather than reporting \"no conflict\".\n /\n @inject(SAAS_SERVICE_TYPES.SystemAccessService) @optional() private readonly systemAccessService?: SystemAccessBackendService,\n ) {\n this.logDebug = this.logger.debugByType('DomainVerification');\n this.logger.setDebugTypeLogging('DomainVerification', false);\n }\n\n // ════════════════════════════════════════════════════════════════════\n // PLANNERS — pure, and the reason they exist\n // ════════════════════════════════════════════════════════════════════\n //\n // The three methods below compute a NEW `domains` block and write nothing. That split is what\n // lets the public `claimDomain` / `verifyDomain` / `revokeDomain` operations (#424) run as\n // resource-operation PREFIX hooks: the hook returns the patch and the framework's own core\n // UPDATE persists it, inside the operation's transaction and in front of the\n // `RESOURCE_OPERATION_PERFORMED` audit event.\n //\n // The self-writing wrappers underneath are kept for callers that hold no operation — they simply\n // load, plan and save. Both paths go through one implementation, so a rule applied to one cannot\n // drift from the other.\n\n /\n Mint a challenge for `domain` and return the `domains` block that records it as `pending`.\n \n Re-claiming an already-claimed domain is legal and deliberate: it mints a FRESH nonce and\n * resets the status to `pending`. The stored nonce is `.isBackendOnly()` and is disclosed exactly\n * once, in the claim response, so re-claiming is the only way to recover a lost record value —\n * and it invalidates the previous one, which is the right direction.\n /\n public planDomainClaim(domains: SsoConfigDomains, domain: string): DomainClaimPlan {\n const normalizedDomain = domain.toLowerCase();\n const verificationToken = randomUUID();\n\n /\n * ─── THIS is where `verifiedDomains` stops meaning what its name says (#457) ─────────────────\n \n A domain enters the list at CLAIM time, with status `pending`. So the stored array holds every\n * CLAIMED domain and the real answer is the join with `domainVerificationStatus` — which is why\n * `resolveVerifiedDomains` / `isDomainVerified` exist beside the field and every READER goes\n * through them.\n \n If you add a write here, write the STATUS in the same step. A domain in the list with no\n * status entry is claimed-but-unknowable, and every reader treats that as unverified — which is\n * safe, and silently loses the claim.\n /\n return {\n domains: {\n ...domains,\n verifiedDomains: domains.verifiedDomains.includes(normalizedDomain)\n ? [...domains.verifiedDomains]\n : [...domains.verifiedDomains, normalizedDomain],\n domainVerificationStatus: {\n ...domains.domainVerificationStatus,\n [normalizedDomain]: DomainVerificationStatus.PENDING,\n },\n domainVerificationTokens: {\n ...domains.domainVerificationTokens,\n [normalizedDomain]: verificationToken,\n },\n },\n verificationToken,\n dnsName: this.verificationDnsName(normalizedDomain),\n dnsRecordValue: `${VERIFICATION_PREFIX}${verificationToken}`,\n };\n }\n\n /\n Record the outcome of a challenge check. `verified` decides between `verified` and `failed`;\n * there is no third answer, because a check that could not resolve DNS has already been reported\n * as not-verified by {@link checkDomainChallenge}.\n /\n public planVerificationOutcome(\n domains: SsoConfigDomains,\n domain: string,\n verified: boolean,\n ): SsoConfigDomains {\n const normalizedDomain = domain.toLowerCase();\n return {\n ...domains,\n domainVerificationStatus: {\n ...domains.domainVerificationStatus,\n [normalizedDomain]: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n },\n };\n }\n\n /\n Remove every trace of a domain from a scope: the claim, its status, its nonce — and its entry\n * in `ssoEnabledDomains`.\n \n That last one is the half a revocation forgets. `ssoEnabledDomains` is a SECOND claim channel\n * that the sign-in router consults with its own status gate\n * (`domain-to-org-lookup.backend.service.ts`), so leaving the domain there while deleting the\n * status entry produces a half-revoked domain: harmless today, and one status write away from\n * routing again under a claim nobody believes they still hold.\n /\n public planDomainRevocation(domains: SsoConfigDomains, domain: string): SsoConfigDomains {\n const normalizedDomain = domain.toLowerCase();\n const { [normalizedDomain]: _removedStatus, ...remainingStatus } = domains.domainVerificationStatus;\n const { [normalizedDomain]: _removedToken, ...remainingTokens } = domains.domainVerificationTokens;\n return {\n ...domains,\n verifiedDomains: domains.verifiedDomains.filter((entry) => entry !== normalizedDomain),\n ssoEnabledDomains: domains.ssoEnabledDomains.filter((entry) => entry !== normalizedDomain),\n domainVerificationStatus: remainingStatus,\n domainVerificationTokens: remainingTokens,\n };\n }\n\n /* The challenge nonce a scope holds for a domain, if it has claimed one. /\n public getVerificationToken(domains: SsoConfigDomains, domain: string): string \| undefined {\n return domains.domainVerificationTokens?.[domain.toLowerCase()];\n }\n\n /* The DNS name the operator publishes the TXT record on. /\n public verificationDnsName(domain: string): string {\n return `${VERIFICATION_SUBDOMAIN}.${domain.toLowerCase()}`;\n }\n\n /\n Resolve the challenge record and say whether it carries the expected nonce.\n \n Public because the operation that verifies a domain must run the check and persist the outcome\n * as ONE resource UPDATE; a method that did both would have to write on its own.\n /\n public async checkDomainChallenge(domain: string, expectedToken: string): Promise<{\n verified: boolean;\n recordsFound: string[];\n }> {\n return this._checkDnsTxtRecord(domain.toLowerCase(), expectedToken);\n }\n\n // ════════════════════════════════════════════════════════════════════\n // EXCLUSIVITY\n // ════════════════════════════════════════════════════════════════════\n\n /\n The scope OTHER than `(scopeType, scopeId)` that already holds `domain` VERIFIED, if any.\n \n ## Why exclusivity is enforced at all\n \n `DomainToOrgLookupBackendService.findOrgByDomain` returns the FIRST scope whose config matches.\n * Two scopes holding one domain therefore means a `@customer.com` sign-in routes to whichever the\n * lookup reaches first — an answer that can change between processes. Nothing prevented that\n * before, only the fact that reaching the verified state required an out-of-band database write\n * by two different tenants. A public route makes it reachable.\n \n ## What this is NOT protecting against\n \n Worth stating precisely, because it decides how much this check is load-bearing. DNS is already\n * the defence against TAKEOVER: only whoever controls `customer.com` can publish the nonce, so a\n * rogue tenant's claim can never be verified. What remains is the real owner verifying the same\n * domain under two of their own scopes — an ambiguity, not an attack. This check makes that\n * refuse instead of silently deciding.\n \n ## Why the scan is exhaustive, and why it is not filtered\n \n It reads every SSO config row of both scope variants and joins in memory. Two cheaper options\n * were rejected:\n * - `getAllOrganizationIds()` enumerates a warm in-memory cache, so on a cold process it\n * reports fewer scopes than exist. An exclusivity check built on it answers \"nobody else\n * holds it\" from an incomplete population;\n * - a repository filter on `domains.verifiedDomains` is a nested-array predicate. It works on\n * the MongoDB adapter and is not portable to the SQL one, where the block is a JSON column —\n * so it would return nothing rather than fail, in the direction that produces a false\n * \"available\".\n * The cost is bounded by tenant count and paid only on claim and verify, which are rare admin\n * acts. If it ever stops being cheap, the answer is an indexed projection of the verified set,\n * not a filter nobody can prove is portable.\n \n Returns `null` when no other scope holds it. THROWS when it cannot answer — a probe that cannot\n * read must not be mistaken for a probe that found nothing.\n /\n public async findConflictingScope(\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<DomainExclusivityConflict \| null> {\n const normalizedDomain = domain.toLowerCase();\n\n if (!this.systemAccessService) {\n throw new Error(\n 'Domain exclusivity cannot be established without the system-access service; '\n + 'refusing rather than reporting that no other scope holds this domain.',\n );\n }\n\n const variants: ReadonlyArray<{ scopeType: AuthScopeType; resourceType: CoreResourceType; scopeField: string }> = [\n { scopeType: AuthScopeType.ORGANIZATION, resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG, scopeField: 'organizationId' },\n { scopeType: AuthScopeType.APPLICATION, resourceType: CoreResourceType.APPLICATION_SSO_CONFIG, scopeField: 'applicationId' },\n ];\n\n for (const variant of variants) {\n const rows = await this.systemAccessService.listAsSystem<SsoConfigBase>(\n variant.resourceType as never,\n {},\n undefined,\n { paginated: false },\n ) as SsoConfigBase[];\n\n for (const row of rows ?? []) {\n const rowScopeId = (row as unknown as Record<string, unknown>)[variant.scopeField];\n if (variant.scopeType === scopeType && rowScopeId === scopeId) continue;\n if (!row.domains) continue;\n if (!isDomainVerified(row.domains, normalizedDomain)) continue;\n return { scopeType: variant.scopeType, scopeId: String(rowScopeId ?? '') };\n }\n }\n\n return null;\n }\n\n // ════════════════════════════════════════════════════════════════════\n // SELF-WRITING WRAPPERS\n // ════════════════════════════════════════════════════════════════════\n\n /\n Initiate domain verification: generate a token and store it in the scope's SSO config.\n * Returns the token the admin must add as a DNS TXT record.\n \n Does NOT check exclusivity — see {@link findConflictingScope}, which the public operation calls\n * before this planner's patch is persisted. A caller reaching this method directly is asserting\n * it has already answered that question.\n /\n public async initiateDomainVerification(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<{\n verificationToken: string;\n dnsRecord: string;\n dnsName: string;\n }> {\n const normalizedDomain = domain.toLowerCase();\n const ssoConfig = (await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId))\n ?? (this.orgConfigService.createDefaultSSOConfig(scopeType, scopeId) as any);\n\n const plan = this.planDomainClaim(ssoConfig.domains, normalizedDomain);\n ssoConfig.domains = plan.domains;\n await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n this.logDebug('Domain verification initiated', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n });\n\n return {\n verificationToken: plan.verificationToken,\n dnsRecord: plan.dnsRecordValue,\n dnsName: plan.dnsName,\n };\n }\n\n /\n Verify domain ownership by checking DNS TXT records.\n * Updates the domain's verification status in the scope's SSO config.\n /\n public async verifyDomainOwnership(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<DomainVerificationResult> {\n const normalizedDomain = domain.toLowerCase();\n\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) {\n return {\n domain: normalizedDomain,\n status: 'failed',\n verificationToken: '',\n dnsRecordsFound: [],\n };\n }\n\n const expectedToken = this.getVerificationToken(ssoConfig.domains, normalizedDomain);\n if (!expectedToken) {\n this.logDebug('No verification token found for domain', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n });\n return {\n domain: normalizedDomain,\n status: 'failed',\n verificationToken: '',\n dnsRecordsFound: [],\n };\n }\n\n const { verified, recordsFound } = await this.checkDomainChallenge(normalizedDomain, expectedToken);\n\n ssoConfig.domains = this.planVerificationOutcome(ssoConfig.domains, normalizedDomain, verified);\n await this.orgConfigService.saveSSOConfig(ec, scopeType, scopeId, ssoConfig);\n\n this.logDebug('Domain verification result', {\n scopeType,\n scopeId,\n domain: normalizedDomain,\n status: verified ? 'verified' : 'failed',\n recordsFound: recordsFound.length,\n });\n\n return {\n domain: normalizedDomain,\n status: verified ? 'verified' : 'failed',\n verificationToken: expectedToken,\n dnsRecordsFound: recordsFound,\n };\n }\n\n /\n Check if a domain is verified for the given scope.\n /\n public async isDomainVerified(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n domain: string,\n ): Promise<boolean> {\n const normalizedDomain = domain.toLowerCase();\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return false;\n return ssoConfig.domains.domainVerificationStatus[normalizedDomain] === 'verified';\n }\n\n /\n Get the list of verified domains for the given scope.\n * Only returns domains with verificationStatus === 'verified'.\n /\n public async getVerifiedDomains(\n ec: ExecutionContext<any>,\n scopeType: AuthScopeType,\n scopeId: string,\n ): Promise<string[]> {\n const ssoConfig = await this.orgConfigService.loadSSOConfig(ec, scopeType, scopeId);\n if (!ssoConfig) return [];\n\n // The one derivation (#457). This service is also the WRITER that puts a claimed domain into\n // `verifiedDomains` with status `pending`, so it is the last place that should re-derive the\n // join it creates the need for.\n return resolveVerifiedDomains(ssoConfig.domains);\n }\n\n /\n Resolve DNS TXT records for the verification subdomain and check for the expected token.\n */\n private async _checkDnsTxtRecord(domain: string, expectedToken: string): Promise<{\n verified: boolean;\n recordsFound: string[];\n }> {\n try {\n const { Resolver } = await import('node:dns/promises');\n const resolver = new Resolver();\n resolver.setServers(['8.8.8.8', '1.1.1.1']);\n\n const lookupHost = `${VERIFICATION_SUBDOMAIN}.${domain}`;\n const records = await resolver.resolveTxt(lookupHost);\n const flat = records.map(r => r.join(''));\n\n const expectedValue = `${VERIFICATION_PREFIX}${expectedToken}`;\n const verified = flat.some(r => r === expectedValue);\n\n return { verified, recordsFound: flat };\n } catch (error) {\n this.logDebug('DNS TXT record lookup failed', {\n domain,\n error: describeCaughtError(error),\n });\n return { verified: false, recordsFound: [] };\n }\n }\n}\n"]}

package/dist/esm/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"enterprise-user-provisioning.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAOjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAEhJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAE/H,OAAO,EAQL,IAAI,EAQL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAQlK,OAAO,KAAK,EAEV,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC7B,MAAM,mFAAmF,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAKtB,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAEzG,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAMO,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IA9BzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EACpE,WAAW,EAAE,6BAA6B,EACzC,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACpC,UAAU,EAAE,4BAA4B,EAO1C,mBAAmB,EAAE,0BAA0B,EAKjC,0BAA0B,EAAE,wCAAwC,EAElI,6BAA6B,EAAE,2CAA2C,EAMrB,iBAAiB,EAAE,+BAA+B;IAU1H;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,6BAA6B,EACzC,kBAAkB,EAAE,4BAA4B,EAChD,aAAa,GAAE,mCAAwC,GACtD,OAAO,CAAC,yBAAyB,CAAC;IAkRrC;;;;;;OAMG;YACW,8BAA8B;IA2C5C;;;;;;OAMG;YACW,qBAAqB;IAuKnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,iDAAiD;IA+B/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,6CAA6C;IAoB3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACU,sCAAsC,CACjD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,6BAA6B,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAuDjG;;;OAGG;IACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EAC/F,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,IAAI,CAAC;IAkChB;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,4BAA4B,GAC/C,OAAO,CAAC,IAAI,CAAC;IAoFhB;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAqB9G;;;;;OAKG;YACW,mBAAmB;IA+IjC;;;;;OAKG;YACW,6BAA6B;YAiD7B,kBAAkB;IAqGhC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;YACW,2BAA2B;CAG1C"}
1	+ {"version":3,"file":"enterprise-user-provisioning.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/admin-config/enterprise-user-provisioning.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,kBAAkB,CAAC;AAG1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AAC9G,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,6FAA6F,CAAC;AACzJ,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iFAAiF,CAAC;AAElI,OAAO,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAChK,OAAO,KAAK,EACV,2CAA2C,EAC5C,MAAM,yFAAyF,CAAC;AAOjG,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,wFAAwF,CAAC;AAC5I,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,6FAA6F,CAAC;AAEhJ,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAKpH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gFAAgF,CAAC;AAEzH,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAE/H,OAAO,EAQL,IAAI,EAQL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,mGAAmG,CAAC;AAQlK,OAAO,KAAK,EAEV,qBAAqB,EACrB,6BAA6B,EAC7B,4BAA4B,EAC7B,MAAM,mFAAmF,CAAC;AAE3F,0DAA0D;AAC1D,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,OAAO,CAAC;IACf,2FAA2F;IAC3F,gBAAgB,EAAE,OAAO,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,mCAAmC;IAClD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IACV,OAAO,CAAC,QAAQ,CAAC,YAAY;IAClB,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAO7B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAKtB,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAEzG,OAAO,CAAC,QAAQ,CAAC,6BAA6B;IAMO,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IA9BzF,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+D;gBAGlC,MAAM,EAAE,aAAa,EACR,YAAY,EAAE,0BAA0B,EAC7B,uBAAuB,EAAE,qCAAqC,EACjE,aAAa,EAAE,yCAAyC,EACpE,WAAW,EAAE,6BAA6B,EACzC,gBAAgB,EAAE,uBAAuB,EACzC,gBAAgB,EAAE,uBAAuB,EACpC,UAAU,EAAE,4BAA4B,EAO1C,mBAAmB,EAAE,0BAA0B,EAKjC,0BAA0B,EAAE,wCAAwC,EAElI,6BAA6B,EAAE,2CAA2C,EAMrB,iBAAiB,EAAE,+BAA+B;IAU1H;;;;;;;;;;OAUG;IACU,uBAAuB,CAClC,OAAO,EAAE,qBAAqB,EAC9B,UAAU,EAAE,6BAA6B,EACzC,kBAAkB,EAAE,4BAA4B,EAChD,aAAa,GAAE,mCAAwC,GACtD,OAAO,CAAC,yBAAyB,CAAC;IAkRrC;;;;;;OAMG;YACW,8BAA8B;IA2C5C;;;;;;OAMG;YACW,qBAAqB;IAuKnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;YACW,iDAAiD;IA+B/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,OAAO,CAAC,+BAA+B;IASvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;YACW,6CAA6C;IAoB3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkDG;IACU,sCAAsC,CACjD,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,6BAA6B,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAuDjG;;;OAGG;IACU,aAAa,CACxB,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EAC/F,UAAU,EAAE,4BAA4B,GACvC,OAAO,CAAC,IAAI,CAAC;IAkChB;;;OAGG;IACU,iBAAiB,CAC5B,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,4BAA4B,GAC/C,OAAO,CAAC,IAAI,CAAC;IAoFhB;;;;;;;;;;;OAWG;IACI,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;IAqB9G;;;;;OAKG;YACW,mBAAmB;IA+IjC;;;;;OAKG;YACW,6BAA6B;YAiD7B,kBAAkB;IAqGhC;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAmB9B;;;;;OAKG;YACW,2BAA2B;CAG1C"}