npm - @wildo-ai/saas-backend-lib - Versions diffs - 1.1.3 → 1.1.4 - Mend

@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1056) hide show

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cimd-client-metadata.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../~~src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAU7F,OAAO,EAEL,mBAAmB,EACnB,eAAe,EAQf,KAAK,kBAAkB,EACxB,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAa/G,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kGAAkG;IAClG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gCAAgC;IAmBN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAnBhF;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;gBAGL,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;;;;OAYG;IACI,uBAAuB,IAAI,iBAAiB;IAQnD,6FAA6F;IACtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAsF9G;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC;IAe9C;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAIrF;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAWzE;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oBAAoB;IAalC;;;;;OAKG;YACW,gBAAgB;IAU9B;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;YAgBtB,aAAa;IAsD3B;;;;;;;;;;OAUG;YACW,eAAe;IA8B7B,2FAA2F;IAC3F,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,MAAM;CAGf"}
1	+ {"version":3,"file":"cimd-client-metadata.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAU7F,OAAO,EAEL,mBAAmB,EACnB,eAAe,EAQf,KAAK,kBAAkB,EACxB,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAa/G,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,kGAAkG;IAClG,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,gCAAgC;IAmBN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAnBhF;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;gBAGL,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,uBAAuB;IAGzG;;;;;;;;;;;;OAYG;IACI,uBAAuB,IAAI,iBAAiB;IAQnD,6FAA6F;IACtF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,SAAa,GAAG,OAAO,CAAC,cAAc,CAAC;IAsF9G;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,YAAY;IAYpB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,sCAAsC;IAe9C;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAIrF;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO;IAWzE;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oBAAoB;IAalC;;;;;OAKG;YACW,gBAAgB;IAU9B;;;;;;;;;;;;;;;OAeG;YACW,sBAAsB;YAgBtB,aAAa;IAsD3B;;;;;;;;;;OAUG;YACW,eAAe;IA8B7B,2FAA2F;IAC3F,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,MAAM;CAGf"}

package/dist/esm/security/authentications/services/cimd-client-metadata.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"cimd-client-metadata.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wCAAwC,EACxC,2CAA2C,GAE5C,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAe9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAmBW;IACU;IAnBhE;;;;;;;;;;;;;;OAcG;IACc,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,YACsD,MAAqB,EACX,gBAAyC;QADnD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACI,uBAAuB;QAC5B,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAuF,EAAE,IAAI,CAAC;QAC9I,OAAO;YACL,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe,CAAC,QAAQ;YACpD,YAAY,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,6FAA6F;IACtF,cAAc,CAAC,QAAgB;QACpC,OAAO,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,MAAyB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAC1G,CAAC;QAED,6FAA6F;QAC7F,6GAA6G;QAC7G,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACvG,CAAC;QAED,gCAAgC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;QAC7G,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,6FAA6F;QAC7F,4CAA4C;QAC5C,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/C,iBAAiB;QACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sFAAsF;YACtF,6FAA6F;YAC7F,aAAa;YACb,mEAAmE;YACnE,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QACjH,CAAC;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,sBAAsB;QACtB,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iBAAiB,EACrC,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,WAAmB,EAAE,KAAa;QAChG,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,CAAC,QAA4B;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,wCAAwC;YAAE,OAAO,SAAS,CAAC;QACtG,IAAI,2CAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iCAAiC,EACrD,iCAAiC,QAAQ,iDAAiD,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,+BAA+B,EACnD,iCAAiC,QAAQ,sDAAsD,CAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAA4B,EAAE,WAAmB;QACzE,OAAO,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAA4B;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa,CAAC,GAAQ,EAAE,OAA0B;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,CAAC,CAAC,KAAK,KAAK,QAAQ;gBACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAQ;QACzC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,SAAS,CAAC;YACnB,KAAK,wBAAwB,CAAC,YAAY;gBACxC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;YACzF,KAAK,wBAAwB,CAAC,QAAQ;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAQ;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,iBAAiB,EAAE,uBAAuB;YAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAClD,+FAA+F;YAC/F,0FAA0F;YAC1F,0FAA0F;YAC1F,qFAAqF;YACrF,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAQ;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,2FAA2F;YAC3F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,yDAAyD;YACzD,EAAE;YACF,+FAA+F;YAC/F,kDAAkD;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,uBAAuB,EAAE,CAAC;gBAChF,yFAAyF;gBACzF,wFAAwF;gBACxF,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEtC,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/G,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf;;;;;;;;eAQG;YACH,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAClE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAAC,QAAkB;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAQ,MAAqC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,uBAAuB;gBAC9D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC;gBACrG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAI,MAAqC,CAAC,SAAS,EAAE,CAAC;QAClE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACpC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,2FAA2F;IACnF,iBAAiB,CAAC,YAA2B;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,qBAAqB,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,MAAM,CAAC,MAA2B,EAAE,MAAc;QACxD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF,CAAA;AAzcY,gCAAgC;IAD5C,UAAU,EAAE;IAoBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;qCADgB,aAAa;QACO,uBAAuB;GApB9F,gCAAgC,CAyc5C","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { lookup as dnsLookup } from 'node:dns/promises';\nimport { isIP } from 'node:net';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n OutboundTargetResolution,\n resolvesOnlyToPublicAddresses,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n OutboundTargetRefusedError,\n pinnedOutboundFetch,\n} from '~wildo-backend-lib/security/ssrf/pinned-outbound-fetch.backend.utils';\nimport {\n CimdClientMetadataSchema,\n CimdRejectionReason,\n CimdTrustPolicy,\n CIMD_CACHE_MAX_TTL_MS,\n CIMD_CACHE_MIN_TTL_MS,\n CIMD_FETCH_TIMEOUT_MS,\n CIMD_MAX_DOCUMENT_BYTES,\n CIMD_MAX_CACHE_ENTRIES,\n CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD,\n CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS,\n type CimdClientMetadata,\n} from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\n\n/*\n The scheme the egress client will issue on.\n \n A `client_id` that is not `https:` is already refused at shape time (`refuseMalformedClientId`),\n * so this restates a decision rather than making a new one — deliberately. The pinned client takes\n * the scheme policy as a required input precisely so no caller can inherit a permissive default, and\n * a second statement at the egress point costs one line and survives a future refactor that moves\n * the shape check.\n /\nconst CIMD_ADMITTED_PROTOCOLS: readonly string[] = ['https:'];\n\n/* The deployment's CIMD posture, resolved from application config. /\nexport interface CimdConfiguration {\n policy: CimdTrustPolicy;\n /* Hosts accepted under {@link CimdTrustPolicy.ALLOWLIST}. Exact host match, case-insensitive. /\n allowedHosts?: readonly string[];\n}\n\nexport type CimdResolution =\n \| { kind: 'ok'; metadata: CimdClientMetadata }\n \| { kind: 'rejected'; reason: CimdRejectionReason; detail: string };\n\ninterface CachedDocument { metadata: CimdClientMetadata; expiresAtMs: number }\n\n/\n Resolve an HTTPS `client_id` URL into validated client metadata (CIMD).\n \n ## What makes this different from every other lookup in the provider\n \n Every other client resolution reads a row this application minted. This one takes a URL from an\n * UNAUTHENTICATED stranger and makes an outbound request to it. That inverts the usual trust\n * direction, and the draft is explicit about the consequence:\n \n \"The authorization server takes a URL as input from an unknown client and fetches that URL. A\n * malicious client could use this to trigger the authorization server to make requests to\n * arbitrary URLs, such as requests to private administration endpoints the authorization server\n * has access to.\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security\n \n So the order of operations is itself a control: POLICY first (is this deployment even accepting\n * stranger URLs?), then SHAPE, then the SSRF target check, and only then a bounded fetch. Every\n * cheap refusal happens before anything leaves the process.\n \n ## What this deliberately does NOT do\n \n It does not decide whether the caller may have a token. It resolves an IDENTITY and the redirect\n * URIs that identity claims; consent, scope and audience remain the caller's own gates. A client\n * that resolves here is a client whose NAME the consent screen may show — nothing more.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity is bound to a\n * domain the client demonstrably controls\n /\n@injectable()\nexport class CimdClientMetadataBackendService {\n /\n In-process, per-pod. Deliberately not Redis.\n \n The document is public by construction — anyone can fetch it — so a shared cache buys only\n * fewer outbound requests, at the cost of a shared mutable surface keyed on attacker-supplied\n * strings. A per-pod cache cannot be poisoned across pods and disappears on restart, which is also\n * the crudest revocation path available.\n \n It is bounded by {@link CIMD_MAX_CACHE_ENTRIES}, and that bound is load-bearing. An earlier\n * revision of this comment claimed the cache was bounded when nothing bounded it: the key is an\n * attacker-supplied URL, entries were only SKIPPED when stale and never reclaimed, and there was\n * no ceiling — so the map grew for the life of the pod. Insertion order is eviction order (a Map\n * preserves it), which is the right policy here because every entry has a short, bounded TTL: the\n * oldest entry is also the closest to expiry.\n /\n private readonly cache = new Map<string, CachedDocument>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n ) {}\n\n /\n The deployment's CIMD posture, read from `auth.cimd` in the application configuration.\n \n One reader, deliberately. Two facts must never disagree: what the discovery document\n * ADVERTISES (`client_id_metadata_document_supported`) and what the authorize path ACCEPTS. When\n * each read the config for itself, a divergence between them would be invisible — the server would\n * advertise a capability it refuses, or refuse one it advertises, and every client would blame its\n * own implementation. Both now call this.\n \n Defaults to `DISABLED` when unconfigured: nothing fetches a stranger's URL until an application\n * opts in. A framework that shipped `OPEN` by default would open an SSRF surface on every\n * deployment that never asked for one.\n /\n public deploymentConfiguration(): CimdConfiguration {\n const authored = (this.appConfigService.config?.auth as { cimd?: { policy?: CimdTrustPolicy; allowedClients?: string[] } } \| undefined)?.cimd;\n return {\n policy: authored?.policy ?? CimdTrustPolicy.DISABLED,\n allowedHosts: authored?.allowedClients ?? [],\n };\n }\n\n /* Does this `client_id` even look like a CIMD identifier? Cheap, allocation-free triage. /\n public isCimdClientId(clientId: string): boolean {\n return clientId.startsWith('https://');\n }\n\n public async resolve(clientId: string, config: CimdConfiguration, nowMs = Date.now()): Promise<CimdResolution> {\n // 1 — POLICY, before anything else. A disabled deployment must not even parse the URL, let\n // alone resolve DNS for it: refusing later would still have leaked that this server looks.\n if (config.policy === CimdTrustPolicy.DISABLED) {\n return this.reject(CimdRejectionReason.POLICY_DISABLED, 'client id metadata documents are not enabled');\n }\n\n // 2 — SHAPE. \"The `client_id` URL MUST use the \"https\" scheme and contain a path component\".\n // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n // The path requirement is not cosmetic: it stops a bare origin being an identity, so one\n // compromised host cannot claim to be every client on that host.\n let url: URL;\n try {\n url = new URL(clientId);\n } catch {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id is not a URL');\n }\n if (url.protocol !== 'https:') {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must use the https scheme');\n }\n if (url.pathname === '/' \|\| url.pathname === '') {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must contain a path component');\n }\n if (url.hash) {\n // A fragment is never sent to the server, so two client_ids differing only by fragment would\n // fetch the same document and then fail the identity comparison — confusing, and pointless.\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must not contain a fragment');\n }\n\n // 3 — TRUST POLICY on the host.\n if (config.policy === CimdTrustPolicy.ALLOWLIST && !this.isAllowListed(url, config.allowedHosts ?? [])) {\n return this.reject(CimdRejectionReason.HOST_NOT_ALLOWED, 'client_id is not on this deployment allow-list');\n }\n\n // 4 — CACHE, keyed on the exact URL. Read before the SSRF check because a cached document was\n // already validated against every gate above at the time it was stored, and the policy\n // gates above have already re-run on THIS request.\n const cached = this.cache.get(url.toString());\n if (cached && cached.expiresAtMs > nowMs) {\n return { kind: 'ok', metadata: cached.metadata };\n }\n\n // 5 — SSRF. Resolved BEFORE the fetch: \"Authorization servers SHOULD avoid fetching any URLs\n // using private or loopback addresses\".\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 6.5\n const ssrf = await this.refuseInternalTarget(url);\n if (ssrf) return ssrf;\n\n // 6 — Bounded fetch.\n const fetched = await this.fetchDocument(url);\n if (fetched.kind !== 'fetched') return fetched;\n\n // 7 — STRUCTURE.\n const parsed = CimdClientMetadataSchema.safeParse(fetched.body);\n if (!parsed.success) {\n // NOT cached: \"The authorization server MUST NOT cache documents which are invalid or\n // malformed.\" Caching a malformed document would let one bad deploy pin a client out for the\n // whole TTL.\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'document is not a valid client metadata document');\n }\n\n // 8 — IDENTITY. \"The client metadata document MUST contain a `client_id` property whose value\n // MUST match the URL of the document using simple string comparison as defined in RFC 3986\n // Section 6.2.1.\"\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n //\n // This is the load-bearing check of the whole mechanism: without it, anyone who can host a\n // JSON file could claim any other client's identity by naming it.\n if (parsed.data.client_id !== url.toString()) {\n return this.reject(\n CimdRejectionReason.IDENTITY_MISMATCH,\n 'the document\\'s client_id does not match the URL it was fetched from',\n );\n }\n\n // 9 — CLIENT AUTHENTICATION. Checked BEFORE the cache write, alongside structure and identity,\n // for the same reason those are: a document this server will never accept must not occupy a\n // cache slot, and must not be re-served to a later request as though it had been validated.\n const authMethod = this.refuseUnacceptableClientAuthentication(parsed.data);\n if (authMethod) return authMethod;\n\n this.storeInCache(url.toString(), parsed.data, nowMs + this.resolveCacheTtlMs(fetched.cacheControl), nowMs);\n return { kind: 'ok', metadata: parsed.data };\n }\n\n /\n Write a validated document, reclaiming space first so the map cannot grow without limit.\n \n Two steps, in this order:\n \n 1. Sweep the expired. Reclaiming stale entries before evicting live ones means a steady\n * state of legitimate traffic never evicts anything — the TTL does the work, and eviction is\n * reserved for genuine pressure.\n * 2. Evict the oldest while still at the ceiling. `Map` iterates in insertion order, and\n * because every entry carries a short bounded TTL the oldest is also the nearest to expiry —\n * so insertion order is a good proxy for \"least valuable\" without tracking access times.\n \n There is deliberately NO delete-before-set for an existing key. A first draft had one, to move a\n * refreshed document to the end of the order — but this method is only ever reached after a cache\n * MISS: a live entry returns from `resolve` before the fetch, and an expired one is removed by the\n * sweep above. The key can never still be present, so the delete was guarding a state that cannot\n * occur, and a test written to prove it necessarily failed. Removed rather than kept as defence,\n * because dead code with a plausible comment is how the next reader is misled.\n /\n private storeInCache(key: string, metadata: CimdClientMetadata, expiresAtMs: number, nowMs: number): void {\n for (const [cachedKey, cached] of this.cache) {\n if (cached.expiresAtMs <= nowMs) this.cache.delete(cachedKey);\n }\n while (this.cache.size >= CIMD_MAX_CACHE_ENTRIES) {\n const oldest = this.cache.keys().next();\n if (oldest.done) break;\n this.cache.delete(oldest.value);\n }\n this.cache.set(key, { metadata, expiresAtMs });\n }\n\n /\n Refuse a document whose declared client authentication method this provider will not honour.\n \n Two refusals with two reasons, because they are two different facts about the world:\n \n - A SYMMETRIC method is the client violating the draft — \"the `token_endpoint_auth_method`\n * property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or\n * any other method based around a shared symmetric secret.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n * - `private_key_jwt` is permitted by § 6.2 (\"clients MAY establish credentials at the\n * authorization server by using authentication methods that use public/private key pairs, by\n * publishing the public key in their metadata document\") and simply is not implemented here.\n \n Both refuse. The alternative — accept the document and treat the client as public — is a silent\n * downgrade: the client believes it authenticates, this server never checks, and neither side can\n * observe the disagreement. An absent `token_endpoint_auth_method` IS accepted as public, which is\n * what the specification's own worked example declares (`\"token_endpoint_auth_method\": \"none\"`).\n /\n private refuseUnacceptableClientAuthentication(metadata: CimdClientMetadata): CimdResolution \| undefined {\n const declared = metadata.token_endpoint_auth_method;\n if (declared === undefined \|\| declared === CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD) return undefined;\n if (CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS.includes(declared)) {\n return this.reject(\n CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION,\n `client authentication method '${declared}' is not supported by this authorization server`,\n );\n }\n return this.reject(\n CimdRejectionReason.FORBIDDEN_CLIENT_AUTHENTICATION,\n `client authentication method '${declared}' is not permitted for a client id metadata document`,\n );\n }\n\n /\n Is a redirect URI one this client actually claims?\n \n \"MUST validate redirect URIs presented in an authorization request against those in the metadata\n * document.\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n \n EXACT string comparison, not prefix or origin matching: a prefix rule turns one claimed\n * `https://app.example/cb` into authority over `https://app.example/cb.attacker/...`, and OAuth\n * 2.1 requires exact redirect matching independently of CIMD.\n /\n public permitsRedirectUri(metadata: CimdClientMetadata, redirectUri: string): boolean {\n return metadata.redirect_uris.includes(redirectUri);\n }\n\n /\n Does this client's claimed redirect set consist ONLY of loopback URIs?\n \n Callers use this to decide whether the consent screen needs a stronger warning. CIMD \"cannot\n * prevent `localhost` URL impersonation by themselves\": an attacker presents the LEGITIMATE\n * client's metadata URL, binds any localhost port, and receives the code — while the user sees the\n * legitimate client's name.\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost Redirect URI Risks\n \n Reported rather than refused: loopback redirects are how every CLI and desktop MCP client works,\n * so refusing them would exclude the majority of real callers. The mitigation the spec names is\n * display, and display needs this signal.\n /\n public claimsOnlyLoopbackRedirects(metadata: CimdClientMetadata): boolean {\n return metadata.redirect_uris.every((uri) => {\n try {\n const host = new URL(uri).hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n } catch {\n return false;\n }\n });\n }\n\n /\n Is this `client_id` admitted by the deployment's allow-list?\n \n An entry is matched at ONE OF TWO precisions, decided by the entry itself:\n \n - A full `https://…` URL matches that exact `client_id` and nothing else.\n * - A bare host matches every `client_id` on that host.\n \n Both exist because they answer different questions. Clerk's CIMD admission is per-Client-ID-URL,\n * and that is the stricter and usually correct grain: a host entry admits EVERY client hosted\n * there, which is wrong the moment the domain is a shared platform hosting many vendors' metadata —\n * allow-listing one vendor would silently admit all of them. The host form is kept for the common\n * case where a deployment trusts a vendor's whole domain and does not want to re-edit config each\n * time that vendor publishes a new client.\n \n The first implementation offered ONLY the host form. Checking it against a shipping\n * implementation is what surfaced the shared-domain hole.\n /\n private isAllowListed(url: URL, entries: readonly string[]): boolean {\n const clientId = url.toString();\n const host = url.hostname.toLowerCase();\n return entries.some((entry) => {\n const value = entry.trim();\n if (!value) return false;\n return value.includes('://')\n ? value === clientId\n : value.toLowerCase() === host;\n });\n }\n\n /\n Refuse a target that resolves to an address this server can reach but the public internet\n * cannot.\n \n DNS is resolved HERE rather than trusting the hostname, because `internal.example.com` may be a\n * public name with a private A record — the attack the guard exists for. Every resolved address is\n * checked, not just the first: a hostile resolver can return one public and one private address\n * and rely on the client picking the other.\n \n This is a check-then-fetch, and on its own it would leave DNS rebinding open — a name that\n * answers a public address to THIS resolution and a private one to the connection. That residual\n * is now closed one layer down rather than here: {@link fetchDocument} connects through\n * `pinnedOutboundFetch`, which classifies inside the connection's `lookup` hook, so the address\n * validated and the address connected to are the same value in the same event.\n \n This check is KEPT rather than folded into the pinned client, for two reasons. It refuses before\n * anything leaves the process, which is this service's stated order of operations (\"every cheap\n * refusal happens before anything leaves the process\"). And it is the only place that can tell\n * UNRESOLVABLE from INTERNAL — the pinned client's hook sees a resolver failure as a transport\n * failure, and collapsing the two would report a NXDOMAIN as an SSRF attempt.\n /\n private async refuseInternalTarget(url: URL): Promise<CimdResolution \| undefined> {\n const resolution = await resolvesOnlyToPublicAddresses(url.hostname, (hostname) => this.resolveAddresses(hostname));\n\n switch (resolution) {\n case OutboundTargetResolution.PUBLIC:\n return undefined;\n case OutboundTargetResolution.UNRESOLVABLE:\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client_id host does not resolve');\n case OutboundTargetResolution.INTERNAL:\n return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host resolves to a non-public address');\n }\n }\n\n /\n Throws on failure rather than returning `undefined`, because the shared resolver distinguishes\n * \"the resolver refused\" (UNRESOLVABLE) from \"the resolver answered with nothing usable\"\n * (INTERNAL) — collapsing both into an empty array would turn a NXDOMAIN into an SSRF verdict and\n * lose the diagnostic the caller reports.\n /\n private async resolveAddresses(hostname: string): Promise<string[]> {\n try {\n const records = await dnsLookup(hostname, { all: true });\n return records.map((record) => record.address);\n } catch (error) {\n this.logger.debug('[cimd] client_id host did not resolve', { hostname, ...projectCaughtErrorLogFields(error) });\n throw error;\n }\n }\n\n /\n The outbound request itself, isolated behind one method so a test can substitute it exactly as\n * it substitutes {@link resolveAddresses}. Those two together are the whole external world this\n * service touches.\n \n `pinnedOutboundFetch`, not `fetch`, and the difference is the point. It classifies inside the\n * connection's `lookup` hook, so a `client_id` host that answers a public address to\n * {@link refuseInternalTarget} and a private one to the connection — DNS rebinding, the residual\n * this service documented and could not close — never gets a socket. It also cannot follow a\n * redirect at all, which is strictly stronger than the `redirect: 'error'` this call used to pass:\n * following one would re-point the request at a target no check ever saw.\n \n The resolver is the service's OWN {@link resolveAddresses}, so the pre-check and the connection\n * ask the same resolver — a substituted resolver therefore drives both, which is what makes a\n * rebinding pin expressible at all.\n /\n private async performOutboundRequest(url: URL): Promise<Response> {\n return pinnedOutboundFetch(url.toString(), {\n admittedProtocols: CIMD_ADMITTED_PROTOCOLS,\n headers: { accept: 'application/json' },\n signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),\n // Never `admitPrivateAddresses` here, under any configuration. A `client_id` URL comes from an\n // UNAUTHENTICATED stranger, so an escape on this path would be an operator declaring that\n // strangers may address the deployment's internal network — a sentence with no legitimate\n // reading. The escape exists only for a target class an operator authors themselves.\n resolveAddresses: async (hostname) => {\n const addresses = await this.resolveAddresses(hostname);\n return addresses.map((address) => ({ address, family: isIP(address) }));\n },\n });\n }\n\n private async fetchDocument(url: URL): Promise<{ kind: 'fetched'; body: unknown; cacheControl: string \| null } \| CimdResolution> {\n try {\n const response = await this.performOutboundRequest(url);\n if (!response.ok) {\n return this.reject(CimdRejectionReason.UNREACHABLE, `client metadata document responded ${response.status}`);\n }\n\n // ── SIZE, enforced DURING the read rather than after it ─────────────────────────────────\n //\n // The previous implementation did `await response.text()` and then measured — which buffers\n // the ENTIRE body first, so a hostile URL returning a gigabyte was fully downloaded and held\n // in memory before being rejected. The cap existed and bounded nothing; the denial-of-service\n // primitive it was written to remove was still there, and the 5 s timeout does not substitute\n // because a fast server delivers a great deal inside it.\n //\n // It also measured `text.length` — UTF-16 code units — against a constant named `_BYTES`, so a\n // multi-byte document read as smaller than it is.\n const declaredLength = Number(response.headers.get('content-length'));\n if (Number.isFinite(declaredLength) && declaredLength > CIMD_MAX_DOCUMENT_BYTES) {\n // Cheapest possible refusal: the server told us, so nothing needs to be read at all. Not\n // TRUSTED — a lying or absent header just falls through to the streaming counter below.\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n }\n\n const read = await this.readBoundedBody(response);\n if (read.kind !== 'read') return read;\n\n try {\n return { kind: 'fetched', body: JSON.parse(read.text), cacheControl: response.headers.get('cache-control') };\n } catch {\n return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'client metadata document is not valid JSON');\n }\n } catch (error) {\n /\n A connect-time SSRF refusal is NOT \"unreachable\", and collapsing the two would lose the\n * signal this whole guard exists to produce. `SSRF_TARGET_REFUSED` is counted and alerted on —\n * the enum's own JSDoc says an operator watching a spike in it \"is watching an attack, not a\n * misconfiguration\" — while `UNREACHABLE` is ordinary noise from strangers' broken hosts.\n \n A rebind lands HERE rather than at {@link refuseInternalTarget}, because by construction it\n * passed that check. This branch is the only place it can be named.\n /\n if (error instanceof OutboundTargetRefusedError) {\n this.logger.debug('[cimd] outbound target refused at connect time', {\n clientId: url.toString(),\n rejection: error.rejection,\n refusedAddress: error.refusedAddress,\n });\n return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host connects to a non-public address');\n }\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document could not be fetched');\n }\n }\n\n /\n Read the body with a running BYTE counter, abandoning the transfer the moment it exceeds the cap.\n \n This is the half that actually bounds memory: the counter is checked per chunk, so the most that\n * is ever retained is the cap plus one chunk, whatever the server intended to send. `reader.cancel()`\n * tears the connection down rather than politely draining a body we have already refused.\n \n Falls back to `response.text()` when the response exposes no stream. That is not a test\n * accommodation — `fetch` may legitimately yield a null body (a 204, or a HEAD-like response) — and\n * the byte length is still measured properly there, via `Buffer.byteLength` rather than `String.length`.\n /\n private async readBoundedBody(response: Response): Promise<{ kind: 'read'; text: string } \| CimdResolution> {\n const stream = response.body;\n if (!stream \|\| typeof (stream as ReadableStream<Uint8Array>).getReader !== 'function') {\n const text = await response.text();\n return Buffer.byteLength(text, 'utf8') > CIMD_MAX_DOCUMENT_BYTES\n ? this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size')\n : { kind: 'read', text };\n }\n\n const reader = (stream as ReadableStream<Uint8Array>).getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n try {\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n if (!value) continue;\n total += value.byteLength;\n if (total > CIMD_MAX_DOCUMENT_BYTES) {\n await reader.cancel().catch(() => undefined);\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n }\n chunks.push(value);\n }\n } finally {\n reader.releaseLock?.();\n }\n return { kind: 'read', text: Buffer.concat(chunks).toString('utf8') };\n }\n\n /* Honour `max-age`, bounded at both ends. See the constants for why each bound exists. /\n private resolveCacheTtlMs(cacheControl: string \| null): number {\n const maxAge = cacheControl?.match(/max-age\\s=\\s(\\d+)/i);\n if (!maxAge) return CIMD_CACHE_MIN_TTL_MS;\n const requested = Number(maxAge[1]) 1000;\n if (!Number.isFinite(requested)) return CIMD_CACHE_MIN_TTL_MS;\n return Math.min(CIMD_CACHE_MAX_TTL_MS, Math.max(CIMD_CACHE_MIN_TTL_MS, requested));\n }\n\n private reject(reason: CimdRejectionReason, detail: string): CimdResolution {\n return { kind: 'rejected', reason, detail };\n }\n}\n"]}
1	+ {"version":3,"file":"cimd-client-metadata.backend.service.js","sourceRoot":"","sources":["../../../../../src/security/authentications/services/cimd-client-metadata.backend.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8EAA8E,CAAC;AAC3H,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,wCAAwC,EACxC,2CAA2C,GAE5C,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,sEAAsE,CAAC;AAE/G;;;;;;;;GAQG;AACH,MAAM,uBAAuB,GAAsB,CAAC,QAAQ,CAAC,CAAC;AAe9D;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAmBW;IACU;IAnBhE;;;;;;;;;;;;;;OAcG;IACc,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,YACsD,MAAqB,EACX,gBAAyC;QADnD,WAAM,GAAN,MAAM,CAAe;QACX,qBAAgB,GAAhB,gBAAgB,CAAyB;IACtG,CAAC;IAEJ;;;;;;;;;;;;OAYG;IACI,uBAAuB;QAC5B,MAAM,QAAQ,GAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAuF,EAAE,IAAI,CAAC;QAC9I,OAAO;YACL,MAAM,EAAE,QAAQ,EAAE,MAAM,IAAI,eAAe,CAAC,QAAQ;YACpD,YAAY,EAAE,QAAQ,EAAE,cAAc,IAAI,EAAE;SAC7C,CAAC;IACJ,CAAC;IAED,6FAA6F;IACtF,cAAc,CAAC,QAAgB;QACpC,OAAO,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,MAAyB,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;QAClF,2FAA2F;QAC3F,+FAA+F;QAC/F,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,QAAQ,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,eAAe,EAAE,8CAA8C,CAAC,CAAC;QAC1G,CAAC;QAED,6FAA6F;QAC7F,6GAA6G;QAC7G,6FAA6F;QAC7F,qEAAqE;QACrE,IAAI,GAAQ,CAAC;QACb,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,qCAAqC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACb,6FAA6F;YAC7F,4FAA4F;YAC5F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,uCAAuC,CAAC,CAAC;QACvG,CAAC;QAED,gCAAgC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,CAAC;YACvG,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,gDAAgD,CAAC,CAAC;QAC7G,CAAC;QAED,8FAA8F;QAC9F,2FAA2F;QAC3F,uDAAuD;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9C,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,GAAG,KAAK,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACnD,CAAC;QAED,6FAA6F;QAC7F,4CAA4C;QAC5C,uEAAuE;QACvE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC;QAE/C,iBAAiB;QACjB,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,sFAAsF;YACtF,6FAA6F;YAC7F,aAAa;YACb,mEAAmE;YACnE,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QACjH,CAAC;QAED,8FAA8F;QAC9F,+FAA+F;QAC/F,sBAAsB;QACtB,uEAAuE;QACvE,EAAE;QACF,+FAA+F;QAC/F,sEAAsE;QACtE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iBAAiB,EACrC,sEAAsE,CACvE,CAAC;QACJ,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,gGAAgG;QAChG,MAAM,UAAU,GAAG,IAAI,CAAC,sCAAsC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,YAAY,CAAC,GAAW,EAAE,QAA4B,EAAE,WAAmB,EAAE,KAAa;QAChG,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAsB,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,sCAAsC,CAAC,QAA4B;QACzE,MAAM,QAAQ,GAAG,QAAQ,CAAC,0BAA0B,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,wCAAwC;YAAE,OAAO,SAAS,CAAC;QACtG,IAAI,2CAA2C,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,iCAAiC,EACrD,iCAAiC,QAAQ,iDAAiD,CAC3F,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,CAAC,+BAA+B,EACnD,iCAAiC,QAAQ,sDAAsD,CAChG,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAA4B,EAAE,WAAmB;QACzE,OAAO,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,2BAA2B,CAAC,QAA4B;QAC7D,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC1C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,aAAa,CAAC,GAAQ,EAAE,OAA0B;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YACzB,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,CAAC,CAAC,KAAK,KAAK,QAAQ;gBACpB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACK,KAAK,CAAC,oBAAoB,CAAC,GAAQ;QACzC,MAAM,UAAU,GAAG,MAAM,6BAA6B,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEpH,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,wBAAwB,CAAC,MAAM;gBAClC,OAAO,SAAS,CAAC;YACnB,KAAK,wBAAwB,CAAC,YAAY;gBACxC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;YACzF,KAAK,wBAAwB,CAAC,QAAQ;gBACpC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,gBAAgB,CAAC,QAAgB;QAC7C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAChH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,sBAAsB,CAAC,GAAQ;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YACzC,iBAAiB,EAAE,uBAAuB;YAC1C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAClD,+FAA+F;YAC/F,0FAA0F;YAC1F,0FAA0F;YAC1F,qFAAqF;YACrF,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1E,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAQ;QAClC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/G,CAAC;YAED,2FAA2F;YAC3F,EAAE;YACF,4FAA4F;YAC5F,6FAA6F;YAC7F,8FAA8F;YAC9F,8FAA8F;YAC9F,yDAAyD;YACzD,EAAE;YACF,+FAA+F;YAC/F,kDAAkD;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,uBAAuB,EAAE,CAAC;gBAChF,yFAAyF;gBACzF,wFAAwF;gBACxF,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;YAC7G,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC;YAEtC,IAAI,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/G,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf;;;;;;;;eAQG;YACH,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;gBAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE;oBAClE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;gBACH,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,iDAAiD,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,+CAA+C,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,KAAK,CAAC,eAAe,CAAC,QAAkB;QAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,OAAQ,MAAqC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,uBAAuB;gBAC9D,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC;gBACrG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAED,MAAM,MAAM,GAAI,MAAqC,CAAC,SAAS,EAAE,CAAC;QAClE,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,CAAC;YACH,SAAS,CAAC;gBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACpC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,WAAW,EAAE,qDAAqD,CAAC,CAAC;gBAC7G,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,2FAA2F;IACnF,iBAAiB,CAAC,YAA2B;QACnD,MAAM,MAAM,GAAG,YAAY,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM;YAAE,OAAO,qBAAqB,CAAC;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,qBAAqB,CAAC;QAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,MAAM,CAAC,MAA2B,EAAE,MAAc;QACxD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF,CAAA;AAzcY,gCAAgC;IAD5C,UAAU,EAAE;IAoBR,WAAA,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;IACjC,WAAA,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,CAAC,CAAA;qCADgB,aAAa;QACO,uBAAuB;GApB9F,gCAAgC,CAyc5C","sourcesContent":["import 'reflect-metadata';\nimport { injectable, inject } from 'inversify';\nimport { lookup as dnsLookup } from 'node:dns/promises';\nimport { isIP } from 'node:net';\n\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport { LoggerService } from '~wildo-backend-lib/monitoring/logger/services/logger.service';\nimport { projectCaughtErrorLogFields } from '~wildo-backend-lib/errors/utils/error-log-level-classification.backend.utils';\nimport {\n OutboundTargetResolution,\n resolvesOnlyToPublicAddresses,\n} from '~wildo-backend-lib/security/ssrf/outbound-target-guard.backend.utils';\nimport {\n OutboundTargetRefusedError,\n pinnedOutboundFetch,\n} from '~wildo-backend-lib/security/ssrf/pinned-outbound-fetch.backend.utils';\nimport {\n CimdClientMetadataSchema,\n CimdRejectionReason,\n CimdTrustPolicy,\n CIMD_CACHE_MAX_TTL_MS,\n CIMD_CACHE_MIN_TTL_MS,\n CIMD_FETCH_TIMEOUT_MS,\n CIMD_MAX_DOCUMENT_BYTES,\n CIMD_MAX_CACHE_ENTRIES,\n CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD,\n CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS,\n type CimdClientMetadata,\n} from '~wildo-backend-lib/security/authentications/models/cimd.backend.schemas';\nimport { AppConfigurationService } from '~wildo-backend-lib/config/services/app-configuration.backend.service';\n\n/*\n The scheme the egress client will issue on.\n \n A `client_id` that is not `https:` is already refused at shape time (`refuseMalformedClientId`),\n * so this restates a decision rather than making a new one — deliberately. The pinned client takes\n * the scheme policy as a required input precisely so no caller can inherit a permissive default, and\n * a second statement at the egress point costs one line and survives a future refactor that moves\n * the shape check.\n /\nconst CIMD_ADMITTED_PROTOCOLS: readonly string[] = ['https:'];\n\n/* The deployment's CIMD posture, resolved from application config. /\nexport interface CimdConfiguration {\n policy: CimdTrustPolicy;\n /* Hosts accepted under {@link CimdTrustPolicy.ALLOWLIST}. Exact host match, case-insensitive. /\n allowedHosts?: readonly string[];\n}\n\nexport type CimdResolution =\n \| { kind: 'ok'; metadata: CimdClientMetadata }\n \| { kind: 'rejected'; reason: CimdRejectionReason; detail: string };\n\ninterface CachedDocument { metadata: CimdClientMetadata; expiresAtMs: number }\n\n/\n Resolve an HTTPS `client_id` URL into validated client metadata (CIMD).\n \n ## What makes this different from every other lookup in the provider\n \n Every other client resolution reads a row this application minted. This one takes a URL from an\n * UNAUTHENTICATED stranger and makes an outbound request to it. That inverts the usual trust\n * direction, and the draft is explicit about the consequence:\n \n \"The authorization server takes a URL as input from an unknown client and fetches that URL. A\n * malicious client could use this to trigger the authorization server to make requests to\n * arbitrary URLs, such as requests to private administration endpoints the authorization server\n * has access to.\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security\n \n So the order of operations is itself a control: POLICY first (is this deployment even accepting\n * stranger URLs?), then SHAPE, then the SSRF target check, and only then a bounded fetch. Every\n * cheap refusal happens before anything leaves the process.\n \n ## What this deliberately does NOT do\n \n It does not decide whether the caller may have a token. It resolves an IDENTITY and the redirect\n * URIs that identity claims; consent, scope and audience remain the caller's own gates. A client\n * that resolves here is a client whose NAME the consent screen may show — nothing more.\n \n assurance-control: WILDO.IDENTITY.CLIENT_IDENTITY_ASSERTION — a client identity is bound to a\n * domain the client demonstrably controls\n /\n@injectable()\nexport class CimdClientMetadataBackendService {\n /\n In-process, per-pod. Deliberately not Redis.\n \n The document is public by construction — anyone can fetch it — so a shared cache buys only\n * fewer outbound requests, at the cost of a shared mutable surface keyed on attacker-supplied\n * strings. A per-pod cache cannot be poisoned across pods and disappears on restart, which is also\n * the crudest revocation path available.\n \n It is bounded by {@link CIMD_MAX_CACHE_ENTRIES}, and that bound is load-bearing. An earlier\n * revision of this comment claimed the cache was bounded when nothing bounded it: the key is an\n * attacker-supplied URL, entries were only SKIPPED when stale and never reclaimed, and there was\n * no ceiling — so the map grew for the life of the pod. Insertion order is eviction order (a Map\n * preserves it), which is the right policy here because every entry has a short, bounded TTL: the\n * oldest entry is also the closest to expiry.\n /\n private readonly cache = new Map<string, CachedDocument>();\n\n constructor(\n @inject(SAAS_SERVICE_TYPES.Logger) private readonly logger: LoggerService,\n @inject(SAAS_SERVICE_TYPES.AppConfigService) private readonly appConfigService: AppConfigurationService,\n ) {}\n\n /\n The deployment's CIMD posture, read from `auth.cimd` in the application configuration.\n \n One reader, deliberately. Two facts must never disagree: what the discovery document\n * ADVERTISES (`client_id_metadata_document_supported`) and what the authorize path ACCEPTS. When\n * each read the config for itself, a divergence between them would be invisible — the server would\n * advertise a capability it refuses, or refuse one it advertises, and every client would blame its\n * own implementation. Both now call this.\n \n Defaults to `DISABLED` when unconfigured: nothing fetches a stranger's URL until an application\n * opts in. A framework that shipped `OPEN` by default would open an SSRF surface on every\n * deployment that never asked for one.\n /\n public deploymentConfiguration(): CimdConfiguration {\n const authored = (this.appConfigService.config?.auth as { cimd?: { policy?: CimdTrustPolicy; allowedClients?: string[] } } \| undefined)?.cimd;\n return {\n policy: authored?.policy ?? CimdTrustPolicy.DISABLED,\n allowedHosts: authored?.allowedClients ?? [],\n };\n }\n\n /* Does this `client_id` even look like a CIMD identifier? Cheap, allocation-free triage. /\n public isCimdClientId(clientId: string): boolean {\n return clientId.startsWith('https://');\n }\n\n public async resolve(clientId: string, config: CimdConfiguration, nowMs = Date.now()): Promise<CimdResolution> {\n // 1 — POLICY, before anything else. A disabled deployment must not even parse the URL, let\n // alone resolve DNS for it: refusing later would still have leaked that this server looks.\n if (config.policy === CimdTrustPolicy.DISABLED) {\n return this.reject(CimdRejectionReason.POLICY_DISABLED, 'client id metadata documents are not enabled');\n }\n\n // 2 — SHAPE. \"The `client_id` URL MUST use the \"https\" scheme and contain a path component\".\n // spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n // The path requirement is not cosmetic: it stops a bare origin being an identity, so one\n // compromised host cannot claim to be every client on that host.\n let url: URL;\n try {\n url = new URL(clientId);\n } catch {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id is not a URL');\n }\n if (url.protocol !== 'https:') {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must use the https scheme');\n }\n if (url.pathname === '/' \|\| url.pathname === '') {\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must contain a path component');\n }\n if (url.hash) {\n // A fragment is never sent to the server, so two client_ids differing only by fragment would\n // fetch the same document and then fail the identity comparison — confusing, and pointless.\n return this.reject(CimdRejectionReason.MALFORMED_CLIENT_ID, 'client_id must not contain a fragment');\n }\n\n // 3 — TRUST POLICY on the host.\n if (config.policy === CimdTrustPolicy.ALLOWLIST && !this.isAllowListed(url, config.allowedHosts ?? [])) {\n return this.reject(CimdRejectionReason.HOST_NOT_ALLOWED, 'client_id is not on this deployment allow-list');\n }\n\n // 4 — CACHE, keyed on the exact URL. Read before the SSRF check because a cached document was\n // already validated against every gate above at the time it was stored, and the policy\n // gates above have already re-run on THIS request.\n const cached = this.cache.get(url.toString());\n if (cached && cached.expiresAtMs > nowMs) {\n return { kind: 'ok', metadata: cached.metadata };\n }\n\n // 5 — SSRF. Resolved BEFORE the fetch: \"Authorization servers SHOULD avoid fetching any URLs\n // using private or loopback addresses\".\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 6.5\n const ssrf = await this.refuseInternalTarget(url);\n if (ssrf) return ssrf;\n\n // 6 — Bounded fetch.\n const fetched = await this.fetchDocument(url);\n if (fetched.kind !== 'fetched') return fetched;\n\n // 7 — STRUCTURE.\n const parsed = CimdClientMetadataSchema.safeParse(fetched.body);\n if (!parsed.success) {\n // NOT cached: \"The authorization server MUST NOT cache documents which are invalid or\n // malformed.\" Caching a malformed document would let one bad deploy pin a client out for the\n // whole TTL.\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.4\n return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'document is not a valid client metadata document');\n }\n\n // 8 — IDENTITY. \"The client metadata document MUST contain a `client_id` property whose value\n // MUST match the URL of the document using simple string comparison as defined in RFC 3986\n // Section 6.2.1.\"\n // spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n //\n // This is the load-bearing check of the whole mechanism: without it, anyone who can host a\n // JSON file could claim any other client's identity by naming it.\n if (parsed.data.client_id !== url.toString()) {\n return this.reject(\n CimdRejectionReason.IDENTITY_MISMATCH,\n 'the document\\'s client_id does not match the URL it was fetched from',\n );\n }\n\n // 9 — CLIENT AUTHENTICATION. Checked BEFORE the cache write, alongside structure and identity,\n // for the same reason those are: a document this server will never accept must not occupy a\n // cache slot, and must not be re-served to a later request as though it had been validated.\n const authMethod = this.refuseUnacceptableClientAuthentication(parsed.data);\n if (authMethod) return authMethod;\n\n this.storeInCache(url.toString(), parsed.data, nowMs + this.resolveCacheTtlMs(fetched.cacheControl), nowMs);\n return { kind: 'ok', metadata: parsed.data };\n }\n\n /\n Write a validated document, reclaiming space first so the map cannot grow without limit.\n \n Two steps, in this order:\n \n 1. Sweep the expired. Reclaiming stale entries before evicting live ones means a steady\n * state of legitimate traffic never evicts anything — the TTL does the work, and eviction is\n * reserved for genuine pressure.\n * 2. Evict the oldest while still at the ceiling. `Map` iterates in insertion order, and\n * because every entry carries a short bounded TTL the oldest is also the nearest to expiry —\n * so insertion order is a good proxy for \"least valuable\" without tracking access times.\n \n There is deliberately NO delete-before-set for an existing key. A first draft had one, to move a\n * refreshed document to the end of the order — but this method is only ever reached after a cache\n * MISS: a live entry returns from `resolve` before the fetch, and an expired one is removed by the\n * sweep above. The key can never still be present, so the delete was guarding a state that cannot\n * occur, and a test written to prove it necessarily failed. Removed rather than kept as defence,\n * because dead code with a plausible comment is how the next reader is misled.\n /\n private storeInCache(key: string, metadata: CimdClientMetadata, expiresAtMs: number, nowMs: number): void {\n for (const [cachedKey, cached] of this.cache) {\n if (cached.expiresAtMs <= nowMs) this.cache.delete(cachedKey);\n }\n while (this.cache.size >= CIMD_MAX_CACHE_ENTRIES) {\n const oldest = this.cache.keys().next();\n if (oldest.done) break;\n this.cache.delete(oldest.value);\n }\n this.cache.set(key, { metadata, expiresAtMs });\n }\n\n /\n Refuse a document whose declared client authentication method this provider will not honour.\n \n Two refusals with two reasons, because they are two different facts about the world:\n \n - A SYMMETRIC method is the client violating the draft — \"the `token_endpoint_auth_method`\n * property MUST NOT include `client_secret_post`, `client_secret_basic`, `client_secret_jwt`, or\n * any other method based around a shared symmetric secret.\"\n * spec-cite: draft-ietf-oauth-client-id-metadata-document-00 § 4.1\n * - `private_key_jwt` is permitted by § 6.2 (\"clients MAY establish credentials at the\n * authorization server by using authentication methods that use public/private key pairs, by\n * publishing the public key in their metadata document\") and simply is not implemented here.\n \n Both refuse. The alternative — accept the document and treat the client as public — is a silent\n * downgrade: the client believes it authenticates, this server never checks, and neither side can\n * observe the disagreement. An absent `token_endpoint_auth_method` IS accepted as public, which is\n * what the specification's own worked example declares (`\"token_endpoint_auth_method\": \"none\"`).\n /\n private refuseUnacceptableClientAuthentication(metadata: CimdClientMetadata): CimdResolution \| undefined {\n const declared = metadata.token_endpoint_auth_method;\n if (declared === undefined \|\| declared === CIMD_ACCEPTED_TOKEN_ENDPOINT_AUTH_METHOD) return undefined;\n if (CIMD_ASYMMETRIC_TOKEN_ENDPOINT_AUTH_METHODS.includes(declared)) {\n return this.reject(\n CimdRejectionReason.UNSUPPORTED_CLIENT_AUTHENTICATION,\n `client authentication method '${declared}' is not supported by this authorization server`,\n );\n }\n return this.reject(\n CimdRejectionReason.FORBIDDEN_CLIENT_AUTHENTICATION,\n `client authentication method '${declared}' is not permitted for a client id metadata document`,\n );\n }\n\n /\n Is a redirect URI one this client actually claims?\n \n \"MUST validate redirect URIs presented in an authorization request against those in the metadata\n * document.\"\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Documents → Implementation Requirements\n \n EXACT string comparison, not prefix or origin matching: a prefix rule turns one claimed\n * `https://app.example/cb` into authority over `https://app.example/cb.attacker/...`, and OAuth\n * 2.1 requires exact redirect matching independently of CIMD.\n /\n public permitsRedirectUri(metadata: CimdClientMetadata, redirectUri: string): boolean {\n return metadata.redirect_uris.includes(redirectUri);\n }\n\n /\n Does this client's claimed redirect set consist ONLY of loopback URIs?\n \n Callers use this to decide whether the consent screen needs a stronger warning. CIMD \"cannot\n * prevent `localhost` URL impersonation by themselves\": an attacker presents the LEGITIMATE\n * client's metadata URL, binds any localhost port, and receives the code — while the user sees the\n * legitimate client's name.\n * spec-cite: MCP 2025-11-25 — Authorization § Client ID Metadata Document Security → Localhost Redirect URI Risks\n \n Reported rather than refused: loopback redirects are how every CLI and desktop MCP client works,\n * so refusing them would exclude the majority of real callers. The mitigation the spec names is\n * display, and display needs this signal.\n /\n public claimsOnlyLoopbackRedirects(metadata: CimdClientMetadata): boolean {\n return metadata.redirect_uris.every((uri) => {\n try {\n const host = new URL(uri).hostname.toLowerCase();\n return host === 'localhost' \|\| host === '127.0.0.1' \|\| host === '::1' \|\| host === '[::1]';\n } catch {\n return false;\n }\n });\n }\n\n /\n Is this `client_id` admitted by the deployment's allow-list?\n \n An entry is matched at ONE OF TWO precisions, decided by the entry itself:\n \n - A full `https://…` URL matches that exact `client_id` and nothing else.\n * - A bare host matches every `client_id` on that host.\n \n Both exist because they answer different questions. Clerk's CIMD admission is per-Client-ID-URL,\n * and that is the stricter and usually correct grain: a host entry admits EVERY client hosted\n * there, which is wrong the moment the domain is a shared platform hosting many vendors' metadata —\n * allow-listing one vendor would silently admit all of them. The host form is kept for the common\n * case where a deployment trusts a vendor's whole domain and does not want to re-edit config each\n * time that vendor publishes a new client.\n \n The first implementation offered ONLY the host form. Checking it against a shipping\n * implementation is what surfaced the shared-domain hole.\n /\n private isAllowListed(url: URL, entries: readonly string[]): boolean {\n const clientId = url.toString();\n const host = url.hostname.toLowerCase();\n return entries.some((entry) => {\n const value = entry.trim();\n if (!value) return false;\n return value.includes('://')\n ? value === clientId\n : value.toLowerCase() === host;\n });\n }\n\n /\n Refuse a target that resolves to an address this server can reach but the public internet\n * cannot.\n \n DNS is resolved HERE rather than trusting the hostname, because `internal.example.com` may be a\n * public name with a private A record — the attack the guard exists for. Every resolved address is\n * checked, not just the first: a hostile resolver can return one public and one private address\n * and rely on the client picking the other.\n \n This is a check-then-fetch, and on its own it would leave DNS rebinding open — a name that\n * answers a public address to THIS resolution and a private one to the connection. That residual\n * is now closed one layer down rather than here: {@link fetchDocument} connects through\n * `pinnedOutboundFetch`, which classifies inside the connection's `lookup` hook, so the address\n * validated and the address connected to are the same value in the same event.\n \n This check is KEPT rather than folded into the pinned client, for two reasons. It refuses before\n * anything leaves the process, which is this service's stated order of operations (\"every cheap\n * refusal happens before anything leaves the process\"). And it is the only place that can tell\n * UNRESOLVABLE from INTERNAL — the pinned client's hook sees a resolver failure as a transport\n * failure, and collapsing the two would report a NXDOMAIN as an SSRF attempt.\n /\n private async refuseInternalTarget(url: URL): Promise<CimdResolution \| undefined> {\n const resolution = await resolvesOnlyToPublicAddresses(url.hostname, (hostname) => this.resolveAddresses(hostname));\n\n switch (resolution) {\n case OutboundTargetResolution.PUBLIC:\n return undefined;\n case OutboundTargetResolution.UNRESOLVABLE:\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client_id host does not resolve');\n case OutboundTargetResolution.INTERNAL:\n return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host resolves to a non-public address');\n }\n }\n\n /\n Throws on failure rather than returning `undefined`, because the shared resolver distinguishes\n * \"the resolver refused\" (UNRESOLVABLE) from \"the resolver answered with nothing usable\"\n * (INTERNAL) — collapsing both into an empty array would turn a NXDOMAIN into an SSRF verdict and\n * lose the diagnostic the caller reports.\n /\n private async resolveAddresses(hostname: string): Promise<string[]> {\n try {\n const records = await dnsLookup(hostname, { all: true });\n return records.map((record) => record.address);\n } catch (error) {\n this.logger.debug('[cimd] client_id host did not resolve', { hostname, ...projectCaughtErrorLogFields(error) });\n throw error;\n }\n }\n\n /\n The outbound request itself, isolated behind one method so a test can substitute it exactly as\n * it substitutes {@link resolveAddresses}. Those two together are the whole external world this\n * service touches.\n \n `pinnedOutboundFetch`, not `fetch`, and the difference is the point. It classifies inside the\n * connection's `lookup` hook, so a `client_id` host that answers a public address to\n * {@link refuseInternalTarget} and a private one to the connection — DNS rebinding, the residual\n * this service documented and could not close — never gets a socket. It also cannot follow a\n * redirect at all, which is strictly stronger than the `redirect: 'error'` this call used to pass:\n * following one would re-point the request at a target no check ever saw.\n \n The resolver is the service's OWN {@link resolveAddresses}, so the pre-check and the connection\n * ask the same resolver — a substituted resolver therefore drives both, which is what makes a\n * rebinding pin expressible at all.\n /\n private async performOutboundRequest(url: URL): Promise<Response> {\n return pinnedOutboundFetch(url.toString(), {\n admittedProtocols: CIMD_ADMITTED_PROTOCOLS,\n headers: { accept: 'application/json' },\n signal: AbortSignal.timeout(CIMD_FETCH_TIMEOUT_MS),\n // Never `admitPrivateAddresses` here, under any configuration. A `client_id` URL comes from an\n // UNAUTHENTICATED stranger, so an escape on this path would be an operator declaring that\n // strangers may address the deployment's internal network — a sentence with no legitimate\n // reading. The escape exists only for a target class an operator authors themselves.\n resolveAddresses: async (hostname) => {\n const addresses = await this.resolveAddresses(hostname);\n return addresses.map((address) => ({ address, family: isIP(address) }));\n },\n });\n }\n\n private async fetchDocument(url: URL): Promise<{ kind: 'fetched'; body: unknown; cacheControl: string \| null } \| CimdResolution> {\n try {\n const response = await this.performOutboundRequest(url);\n if (!response.ok) {\n return this.reject(CimdRejectionReason.UNREACHABLE, `client metadata document responded ${response.status}`);\n }\n\n // ── SIZE, enforced DURING the read rather than after it ─────────────────────────────────\n //\n // The previous implementation did `await response.text()` and then measured — which buffers\n // the ENTIRE body first, so a hostile URL returning a gigabyte was fully downloaded and held\n // in memory before being rejected. The cap existed and bounded nothing; the denial-of-service\n // primitive it was written to remove was still there, and the 5 s timeout does not substitute\n // because a fast server delivers a great deal inside it.\n //\n // It also measured `text.length` — UTF-16 code units — against a constant named `_BYTES`, so a\n // multi-byte document read as smaller than it is.\n const declaredLength = Number(response.headers.get('content-length'));\n if (Number.isFinite(declaredLength) && declaredLength > CIMD_MAX_DOCUMENT_BYTES) {\n // Cheapest possible refusal: the server told us, so nothing needs to be read at all. Not\n // TRUSTED — a lying or absent header just falls through to the streaming counter below.\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n }\n\n const read = await this.readBoundedBody(response);\n if (read.kind !== 'read') return read;\n\n try {\n return { kind: 'fetched', body: JSON.parse(read.text), cacheControl: response.headers.get('cache-control') };\n } catch {\n return this.reject(CimdRejectionReason.MALFORMED_DOCUMENT, 'client metadata document is not valid JSON');\n }\n } catch (error) {\n /\n A connect-time SSRF refusal is NOT \"unreachable\", and collapsing the two would lose the\n * signal this whole guard exists to produce. `SSRF_TARGET_REFUSED` is counted and alerted on —\n * the enum's own JSDoc says an operator watching a spike in it \"is watching an attack, not a\n * misconfiguration\" — while `UNREACHABLE` is ordinary noise from strangers' broken hosts.\n \n A rebind lands HERE rather than at {@link refuseInternalTarget}, because by construction it\n * passed that check. This branch is the only place it can be named.\n /\n if (error instanceof OutboundTargetRefusedError) {\n this.logger.debug('[cimd] outbound target refused at connect time', {\n clientId: url.toString(),\n rejection: error.rejection,\n refusedAddress: error.refusedAddress,\n });\n return this.reject(CimdRejectionReason.SSRF_TARGET_REFUSED, 'client_id host connects to a non-public address');\n }\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document could not be fetched');\n }\n }\n\n /\n Read the body with a running BYTE counter, abandoning the transfer the moment it exceeds the cap.\n \n This is the half that actually bounds memory: the counter is checked per chunk, so the most that\n * is ever retained is the cap plus one chunk, whatever the server intended to send. `reader.cancel()`\n * tears the connection down rather than politely draining a body we have already refused.\n \n Falls back to `response.text()` when the response exposes no stream. That is not a test\n * accommodation — `fetch` may legitimately yield a null body (a 204, or a HEAD-like response) — and\n * the byte length is still measured properly there, via `Buffer.byteLength` rather than `String.length`.\n /\n private async readBoundedBody(response: Response): Promise<{ kind: 'read'; text: string } \| CimdResolution> {\n const stream = response.body;\n if (!stream \|\| typeof (stream as ReadableStream<Uint8Array>).getReader !== 'function') {\n const text = await response.text();\n return Buffer.byteLength(text, 'utf8') > CIMD_MAX_DOCUMENT_BYTES\n ? this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size')\n : { kind: 'read', text };\n }\n\n const reader = (stream as ReadableStream<Uint8Array>).getReader();\n const chunks: Uint8Array[] = [];\n let total = 0;\n try {\n for (;;) {\n const { done, value } = await reader.read();\n if (done) break;\n if (!value) continue;\n total += value.byteLength;\n if (total > CIMD_MAX_DOCUMENT_BYTES) {\n await reader.cancel().catch(() => undefined);\n return this.reject(CimdRejectionReason.UNREACHABLE, 'client metadata document exceeds the permitted size');\n }\n chunks.push(value);\n }\n } finally {\n reader.releaseLock?.();\n }\n return { kind: 'read', text: Buffer.concat(chunks).toString('utf8') };\n }\n\n /* Honour `max-age`, bounded at both ends. See the constants for why each bound exists. /\n private resolveCacheTtlMs(cacheControl: string \| null): number {\n const maxAge = cacheControl?.match(/max-age\\s=\\s(\\d+)/i);\n if (!maxAge) return CIMD_CACHE_MIN_TTL_MS;\n const requested = Number(maxAge[1]) 1000;\n if (!Number.isFinite(requested)) return CIMD_CACHE_MIN_TTL_MS;\n return Math.min(CIMD_CACHE_MAX_TTL_MS, Math.max(CIMD_CACHE_MIN_TTL_MS, requested));\n }\n\n private reject(reason: CimdRejectionReason, detail: string): CimdResolution {\n return { kind: 'rejected', reason, detail };\n }\n}\n"]}

package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-custom-implementations.backend.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAuB7K,eAAO,MAAM,yBAAyB,EAAE,0CAA0C,EAqBjF,CAAC"}
1	+ {"version":3,"file":"auth-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,0CAA0C,EAAE,MAAM,4GAA4G,CAAC;AAuB7K,eAAO,MAAM,yBAAyB,EAAE,0CAA0C,EAqBjF,CAAC"}

package/dist/esm/security/authentications/services/custom-impls/auth-custom-implementations.backend.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-custom-implementations.backend.js","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,6CAA6C,GAC9C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,0CAA0C,EAAE,MAAM,8DAA8D,CAAC;AAC1H,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,2CAA2C,CAAC;AAEnD,wEAAwE;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAiD;IACrF,4BAA4B;IAC5B,+EAA+E;IAC/E,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,0CAA0C,EAAE;IAC/C,GAAG,6CAA6C,EAAE;IAClD,wBAAwB;IACxB,GAAG,8BAA8B,EAAE;IACnC,0EAA0E;IAC1E,GAAG,0CAA0C,EAAE;IAC/C,+BAA+B;IAC/B,GAAG,iCAAiC,EAAE;IACtC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;IACnC,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;CACpC,CAAC","sourcesContent":["/*\n Auth Custom Implementations — Aggregator\n \n Exports all auth resource custom implementations for registration\n * in CoreBackend_ServiceImplementationsFactories.\n \n Only operations with real runtime behavior are registered. Unsupported\n * integration work is absent rather than exposed through placeholder success\n * handlers. No late-binding initialization is needed yet.\n */\n\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n createSsoConnectionCreateFactories,\n createSsoConnectionUpdateFactories,\n createSsoConnectionDeleteFactories,\n createSsoConnectionTestConnectionFactories,\n createSsoConnectionDiscoverEndpointsFactories,\n} from './sso-connection.custom-impl.backend.service';\nimport { createSsoConfigUpdateFactories } from './sso-config.custom-impl.backend.service';\nimport { createSsoConfigDomainVerificationFactories } from './sso-config-domain-verification.custom-impl.backend.service';\nimport {\n createSiemDlqRetrySingleFactories,\n createSiemDlqRetryAllFactories,\n createSiemDlqPurgeAllFactories,\n} from './siem-delivery-dlq.custom-impl.backend.service';\nimport {\n createScimTokenGenerateFactories,\n createScimTokenRevokeFactories,\n createScimTokenRotateFactories,\n} from './scim-tokens.custom-impl.backend.service';\n\n// ── All auth custom implementation factories ─────────────────────────\n\nexport const authCustomImplementations: ResourceCustomServiceImplementationFactory[] = [\n // SSO Connection operations\n // (READ has no custom impl — oidc.clientSecret masking is framework-driven via\n // `.isWriteOnlySecret()`; the UPDATE prefix re-injects the stored nested secret)\n ...createSsoConnectionCreateFactories(),\n ...createSsoConnectionUpdateFactories(),\n ...createSsoConnectionDeleteFactories(),\n ...createSsoConnectionTestConnectionFactories(),\n ...createSsoConnectionDiscoverEndpointsFactories(),\n // SSO Config operations\n ...createSsoConfigUpdateFactories(),\n // SSO Config domain-ownership operations (claim / verify / revoke) — #424\n ...createSsoConfigDomainVerificationFactories(),\n // SIEM Delivery DLQ operations\n ...createSiemDlqRetrySingleFactories(),\n ...createSiemDlqRetryAllFactories(),\n ...createSiemDlqPurgeAllFactories(),\n // SCIM Token operations\n ...createScimTokenGenerateFactories(),\n ...createScimTokenRevokeFactories(),\n ...createScimTokenRotateFactories(),\n];\n"]}
1	+ {"version":3,"file":"auth-custom-implementations.backend.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/auth-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,kCAAkC,EAClC,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,6CAA6C,GAC9C,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAC1F,OAAO,EAAE,0CAA0C,EAAE,MAAM,8DAA8D,CAAC;AAC1H,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACL,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC/B,MAAM,2CAA2C,CAAC;AAEnD,wEAAwE;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAiD;IACrF,4BAA4B;IAC5B,+EAA+E;IAC/E,iFAAiF;IACjF,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,kCAAkC,EAAE;IACvC,GAAG,0CAA0C,EAAE;IAC/C,GAAG,6CAA6C,EAAE;IAClD,wBAAwB;IACxB,GAAG,8BAA8B,EAAE;IACnC,0EAA0E;IAC1E,GAAG,0CAA0C,EAAE;IAC/C,+BAA+B;IAC/B,GAAG,iCAAiC,EAAE;IACtC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;IACnC,wBAAwB;IACxB,GAAG,gCAAgC,EAAE;IACrC,GAAG,8BAA8B,EAAE;IACnC,GAAG,8BAA8B,EAAE;CACpC,CAAC","sourcesContent":["/*\n Auth Custom Implementations — Aggregator\n \n Exports all auth resource custom implementations for registration\n * in CoreBackend_ServiceImplementationsFactories.\n \n Only operations with real runtime behavior are registered. Unsupported\n * integration work is absent rather than exposed through placeholder success\n * handlers. No late-binding initialization is needed yet.\n */\n\nimport type { ResourceCustomServiceImplementationFactory } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport {\n createSsoConnectionCreateFactories,\n createSsoConnectionUpdateFactories,\n createSsoConnectionDeleteFactories,\n createSsoConnectionTestConnectionFactories,\n createSsoConnectionDiscoverEndpointsFactories,\n} from './sso-connection.custom-impl.backend.service';\nimport { createSsoConfigUpdateFactories } from './sso-config.custom-impl.backend.service';\nimport { createSsoConfigDomainVerificationFactories } from './sso-config-domain-verification.custom-impl.backend.service';\nimport {\n createSiemDlqRetrySingleFactories,\n createSiemDlqRetryAllFactories,\n createSiemDlqPurgeAllFactories,\n} from './siem-delivery-dlq.custom-impl.backend.service';\nimport {\n createScimTokenGenerateFactories,\n createScimTokenRevokeFactories,\n createScimTokenRotateFactories,\n} from './scim-tokens.custom-impl.backend.service';\n\n// ── All auth custom implementation factories ─────────────────────────\n\nexport const authCustomImplementations: ResourceCustomServiceImplementationFactory[] = [\n // SSO Connection operations\n // (READ has no custom impl — oidc.clientSecret masking is framework-driven via\n // `.isWriteOnlySecret()`; the UPDATE prefix re-injects the stored nested secret)\n ...createSsoConnectionCreateFactories(),\n ...createSsoConnectionUpdateFactories(),\n ...createSsoConnectionDeleteFactories(),\n ...createSsoConnectionTestConnectionFactories(),\n ...createSsoConnectionDiscoverEndpointsFactories(),\n // SSO Config operations\n ...createSsoConfigUpdateFactories(),\n // SSO Config domain-ownership operations (claim / verify / revoke) — #424\n ...createSsoConfigDomainVerificationFactories(),\n // SIEM Delivery DLQ operations\n ...createSiemDlqRetrySingleFactories(),\n ...createSiemDlqRetryAllFactories(),\n ...createSiemDlqPurgeAllFactories(),\n // SCIM Token operations\n ...createScimTokenGenerateFactories(),\n ...createScimTokenRevokeFactories(),\n ...createScimTokenRotateFactories(),\n];\n"]}

package/dist/esm/security/authentications/services/custom-impls/scim-tokens.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"scim-tokens.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/scim-tokens.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA4BpH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CA0D/F;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CA+C7F;AAgBD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAgE7F"}
1	+ {"version":3,"file":"scim-tokens.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/scim-tokens.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA4BpH,wBAAgB,gCAAgC,IAAI,0CAA0C,EAAE,CA0D/F;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CA+C7F;AAgBD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAgE7F"}

package/dist/esm/security/authentications/services/custom-impls/siem-delivery-dlq.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"siem-delivery-dlq.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/siem-delivery-dlq.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAmBH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA6IpH,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAwFhG;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAyF7F;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAuC7F"}
1	+ {"version":3,"file":"siem-delivery-dlq.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/siem-delivery-dlq.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAmBH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AA6IpH,wBAAgB,iCAAiC,IAAI,0CAA0C,EAAE,CAwFhG;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAyF7F;AAMD,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAuC7F"}

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;~~AA+TpH~~,wBAAgB,0CAA0C,IAAI,0CAA0C,EAAE,CAMzG"}
1	+ {"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAaH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAuXpH,wBAAgB,0CAA0C,IAAI,0CAA0C,EAAE,CAMzG"}

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js CHANGED Viewed

@@ -150,6 +150,17 @@ function createClaimDomainFactory(variant) {
             isOperationDefault: true,
         },
         debugLabel: `${variant.resourceType}.claimDomain`,
+        /**
+         * The prefix WRITES `domains`, and nothing else can.
+         *
+         * Without this the repository's strict re-parse drops the key the hook just computed and the
+         * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs
+         * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.
+         * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is
+         * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block
+         * remains the three operations that own it.
+         */
+        authoritativeFields: ['domains'],
         handlers: {
             prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
                 const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);
@@ -182,6 +193,17 @@ function createVerifyDomainFactory(variant) {
             isOperationDefault: true,
         },
         debugLabel: `${variant.resourceType}.verifyDomain`,
+        /**
+         * The prefix WRITES `domains`, and nothing else can.
+         *
+         * Without this the repository's strict re-parse drops the key the hook just computed and the
+         * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs
+         * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.
+         * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is
+         * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block
+         * remains the three operations that own it.
+         */
+        authoritativeFields: ['domains'],
         handlers: {
             prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
                 const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);
@@ -230,6 +252,17 @@ function createRevokeDomainFactory(variant) {
             isOperationDefault: true,
         },
         debugLabel: `${variant.resourceType}.revokeDomain`,
+        /**
+         * The prefix WRITES `domains`, and nothing else can.
+         *
+         * Without this the repository's strict re-parse drops the key the hook just computed and the
+         * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs
+         * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.
+         * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is
+         * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block
+         * remains the three operations that own it.
+         */
+        authoritativeFields: ['domains'],
         handlers: {
             prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {
                 const { domain, domains } = resolveDomainRequest(variant, input, executionContext, utils);
@@ -237,7 +270,30 @@ function createRevokeDomainFactory(variant) {
                     || domains.domainVerificationStatus?.[domain] !== undefined
                     || domains.ssoEnabledDomains.includes(domain);
                 if (!isClaimed) {
-                    throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {
+                    /**
+                     * CONFLICT, not NOT_FOUND — corrected 2026-09-10 after the refusal was driven over HTTP
+                     * for the first time, and for three independent reasons.
+                     *
+                     * **It could not name itself.** `sanitizeErrorForClient` allow-lists a refusal's
+                     * `context` — and with it the client-branchable `code` — only for VALIDATION, CONFLICT
+                     * and RATE_LIMIT; every other type has its context stripped whole. So as a NOT_FOUND
+                     * this answered a bare `not_found` and `SSO_DOMAIN_NOT_CLAIMED` reached no client. A
+                     * status and a name that cannot both be delivered is not a contract.
+                     *
+                     * **Its SIBLING already answers 409 for the same condition.** `verifyDomain` refuses a
+                     * domain with no challenge as a CONFLICT, eight hundred lines up in this same file. One
+                     * condition, two verbs, two answers — the shape
+                     * `.claude/rules/invariant-call-site-enumeration.md` exists for.
+                     *
+                     * **And 409 is what the framework's own rule asks for here.**
+                     * `administrative-continuity-floors.md`: refuse with CONFLICT, never 403 or 400, when
+                     * the caller IS authorized and the payload IS valid and what forbids the write is the
+                     * current STATE. The addressed row — the SSO config singleton — exists and resolved;
+                     * what does not exist is a claim inside it. A 404 on a URL that resolved is also the
+                     * exact ambiguity issue #542 records against itself: a dispatched 404 and a routing 404
+                     * are told apart by the body, not the status.
+                     */
+                    throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {
                         context: {
                             code: 'SSO_DOMAIN_NOT_CLAIMED',
                             reason: 'sso_domain_not_claimed',

package/dist/esm/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../../src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAiBpH,MAAM,yBAAyB,GAAqC;IAClE;QACE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;QACtD,SAAS,EAAE,aAAa,CAAC,YAAY;QACrC,UAAU,EAAE,gBAAgB;KAC7B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;QACrD,SAAS,EAAE,aAAa,CAAC,WAAW;QACpC,UAAU,EAAE,eAAe;KAC5B;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiE,CAAC;AAEjG;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,YAA8B,EAAE,SAAiB,EAAE,gBAAuC;IAC3G,OAAO,GAAG,YAAY,IAAI,SAAS,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAA8B;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,sBAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,OAA8B,EAC9B,KAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,SAAS,GAAI,KAA0C,EAAE,MAAM,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,4DAA4D;aACtE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAsE,CAAC;IACnG,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,iEAAiE;gBAC1E,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,4BAA4B,CAAC,SAAoB;IACxD,OAAO,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,4BAA4B,CACzC,SAAoB,EACpB,OAA8B,EAC9B,OAAe,EACf,MAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,SAAS,CAAC;SAC3D,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QACxE,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,+BAA+B;YACvC,OAAO,EACL,6FAA6F;kBAC3F,0FAA0F;YAC9F,MAAM;SACP;KACF,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,cAAc;AACd,uEAAuE;AAEvE,SAAS,wBAAwB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,YAAY;YACtD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,cAAc;QACjD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,IAAI,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAEtF,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE;oBAC/F,MAAM;oBACN,MAAM,EAAE,wBAAwB,CAAC,OAAO;oBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC,CAAC,CAAC;gBAEH,0FAA0F;gBAC1F,2FAA2F;gBAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SAClH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;gBAExD,MAAM,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACpE,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,oFAAoF;oBACpF,qFAAqF;oBACrF,0EAA0E;oBAC1E,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;wBACxE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,iFAAiF;4BAC1F,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,uFAAuF;gBACvF,yFAAyF;gBACzF,gDAAgD;gBAChD,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAE7F,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;oBACtF,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAC5C,eAAe,EAAE,YAAY;iBAC9B,CAAC,CAAC;gBAEH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;uBACrD,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS;uBACxD,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,gBAAgB,EAAE;wBACzE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,0EAA0E;4BACnF,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBAEH;;;;;;;;;;;;;;;mBAeG;gBACH,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpG,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,0CAA0C;IACxD,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,wBAAwB,CAAC,OAAO,CAAC;QACjC,yBAAyB,CAAC,OAAO,CAAC;QAClC,yBAAyB,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n SSO Config — domain-ownership operations (#424)\n \n Three public operations that turn enterprise domain routing from an out-of-band database write\n * into a self-service admin flow:\n \n claimDomain → mints a DNS-TXT challenge, records the domain as `pending`, returns the record\n * verifyDomain → resolves the record, records `verified` or `failed`\n * revokeDomain → removes the claim, its status, its nonce and its `ssoEnabledDomains` entry\n \n ## Why PREFIX, and not OVERRIDE_ALL\n \n Each handler computes the new `domains` block and returns it; the framework's own core UPDATE\n * persists it. `OVERRIDE_ALL` returns before the post-operation lane, so it emits NO\n * `RESOURCE_OPERATION_PERFORMED` audit event — and the audit row is the control that makes a\n * privileged configuration change with cross-tenant reach accountable. An operation that granted a\n * tenant SSO routing authority and left no trail would be strictly worse than the database write it\n * replaces, which at least happens where a DBA can see it.\n \n ## Where the domain-ownership rules live\n \n In `DomainVerificationBackendService`, as pure planners. This file is the door: it resolves the\n * scope, enforces the refusals, and hands the plan to the framework. Nothing here re-implements\n * what a claim or a revocation means.\n /\n\nimport {\n AuthScopeType,\n CoreResourceType,\n DomainVerificationStatus,\n ErrorType,\n ResourceOperationVariantType,\n SsoConfig_Operations,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type {\n DomainVerificationBackendService,\n SsoConfigDomains,\n} from '~wildo-backend-lib/security/authentications/services/admin-config/domain-verification.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n// ── The two scope variants, and how each names its scope ─────────────\n\ninterface SsoConfigScopeVariant {\n readonly resourceType: CoreResourceType;\n readonly scopeType: AuthScopeType;\n readonly scopeField: 'organizationId' \| 'applicationId';\n}\n\nconst SSO_CONFIG_SCOPE_VARIANTS: readonly SsoConfigScopeVariant[] = [\n {\n resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n scopeType: AuthScopeType.ORGANIZATION,\n scopeField: 'organizationId',\n },\n {\n resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,\n scopeType: AuthScopeType.APPLICATION,\n scopeField: 'applicationId',\n },\n];\n\n/\n Carries the two values a response needs that the persisted row does not hold, from the PREFIX\n * that computed them to the POSTFIX that shapes the reply.\n \n Bounded on purpose. The precedent bridges in this tree (`ROTATE_BRIDGE_BY_TARGET_ID`) delete\n * their entry in the postfix and rely on the postfix always running; a core UPDATE that throws\n * between the two leaks one entry forever. Expiring on write costs one `Date.now()` per call and\n * removes the question.\n /\nconst RESPONSE_BRIDGE_TTL_MS = 60_000;\nconst RESPONSE_BRIDGE = new Map<string, { value: Record<string, unknown>; expiresAt: number }>();\n\n/\n Keyed on the REQUEST, not on the row.\n \n The postfix receives the persisted row and the execution context — never the request body — so it\n * cannot re-derive which domain the call was about. `correlationId` is minted per request and is\n * the same value in both handlers, which makes the hand-off exact: two admins claiming two domains\n * on the same configuration row at the same instant cannot read each other's response.\n /\nfunction bridgeKey(resourceType: CoreResourceType, operation: string, executionContext: ExecutionContext<any>): string {\n return `${resourceType}\|${operation}\|${executionContext.correlationId}`;\n}\n\nfunction putBridged(key: string, value: Record<string, unknown>): void {\n const now = Date.now();\n for (const [existingKey, entry] of RESPONSE_BRIDGE) {\n if (entry.expiresAt <= now) RESPONSE_BRIDGE.delete(existingKey);\n }\n RESPONSE_BRIDGE.set(key, { value, expiresAt: now + RESPONSE_BRIDGE_TTL_MS });\n}\n\nfunction takeBridged(key: string): Record<string, unknown> \| undefined {\n const entry = RESPONSE_BRIDGE.get(key);\n RESPONSE_BRIDGE.delete(key);\n if (!entry \|\| entry.expiresAt <= Date.now()) return undefined;\n return entry.value;\n}\n\n// ── Shared request resolution ────────────────────────────────────────\n\ninterface ResolvedDomainRequest {\n readonly domain: string;\n readonly scopeId: string;\n readonly domains: SsoConfigDomains;\n}\n\n/\n The row being updated, its scope id, and the normalised domain.\n \n `utils.currentObject` is the pre-image the framework already fetched for this UPDATE, so nothing\n * here re-reads the config. The domain is lowercased HERE, once, because every stored map is keyed\n * on the lowercase form and a second normalisation site is a second place for the two to disagree.\n /\nfunction resolveDomainRequest(\n variant: SsoConfigScopeVariant,\n input: unknown,\n executionContext: ExecutionContext<any>,\n utils: ResourceOperation_CustomImplementation_Utils,\n): ResolvedDomainRequest {\n const rawDomain = (input as { domain?: unknown } \| undefined)?.domain;\n if (typeof rawDomain !== 'string' \|\| rawDomain.trim().length === 0) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n context: {\n code: 'SSO_DOMAIN_REQUIRED',\n reason: 'sso_domain_required',\n message: 'Provide `domain`: the DNS hostname this scope is claiming.',\n },\n });\n }\n\n const currentObject = utils.currentObject as (SsoConfigBase & Record<string, unknown>) \| undefined;\n const scopeId = currentObject?.[variant.scopeField];\n if (!currentObject?.domains \|\| typeof scopeId !== 'string' \|\| scopeId.length === 0) {\n // The row is addressed by its scope (a one-to-one composition), so a missing scope id means the\n // framework could not resolve the singleton — never that the caller addressed someone else.\n throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n context: {\n code: 'SSO_CONFIG_SCOPE_UNRESOLVED',\n reason: 'sso_config_scope_unresolved',\n message: 'The SSO configuration row for this scope could not be resolved.',\n resourceType: variant.resourceType,\n },\n });\n }\n\n return { domain: rawDomain.trim().toLowerCase(), scopeId, domains: currentObject.domains };\n}\n\nfunction getDomainVerificationService(container: Container): DomainVerificationBackendService {\n return container.get<DomainVerificationBackendService>(SAAS_SERVICE_TYPES.DomainVerificationService);\n}\n\n/\n Refuse when another scope already holds this domain VERIFIED.\n \n Run at CLAIM as a helpful early refusal, and again at VERIFY because that is the gate that\n * matters: a claim is not a lock, so another scope can complete its own verification in between.\n \n The holder is deliberately not named. Telling one tenant which other tenant holds a domain\n * discloses a customer's configuration to a stranger who supplied nothing but a hostname. The\n * message says what to do instead — the current holder revokes, and then the claim succeeds — which\n * is the only remedy anyway.\n /\nasync function assertDomainNotHeldElsewhere(\n container: Container,\n variant: SsoConfigScopeVariant,\n scopeId: string,\n domain: string,\n executionContext: ExecutionContext<any>,\n utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<void> {\n const conflict = await getDomainVerificationService(container)\n .findConflictingScope(variant.scopeType, scopeId, domain);\n if (!conflict) return;\n\n throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n context: {\n code: 'SSO_DOMAIN_VERIFIED_ELSEWHERE',\n reason: 'sso_domain_verified_elsewhere',\n message:\n 'This domain is already verified for another scope. A domain routes sign-ins to exactly one '\n + 'identity provider, so it must be revoked where it is held before it can be claimed here.',\n domain,\n },\n });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// claimDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createClaimDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.CLAIM_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.claimDomain`,\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n const plan = getDomainVerificationService(container).planDomainClaim(domains, domain);\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext), {\n domain,\n status: DomainVerificationStatus.PENDING,\n dnsName: plan.dnsName,\n dnsRecordValue: plan.dnsRecordValue,\n });\n\n // The ONLY key returned. The core UPDATE `$set`s what it is given, so returning the whole\n // row here would re-write every other block from a pre-image this handler never validated.\n return { domains: plan.domains };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// verifyDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createVerifyDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.VERIFY_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.verifyDomain`,\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n const service = getDomainVerificationService(container);\n\n const expectedToken = service.getVerificationToken(domains, domain);\n if (!expectedToken) {\n // A claim mints the nonce, so verifying without one is not a failed check — it is a\n // request for a challenge that was never raised. Saying so is what stops an operator\n // publishing a record and waiting for a verification that can never pass.\n throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n context: {\n code: 'SSO_DOMAIN_NOT_CLAIMED',\n reason: 'sso_domain_not_claimed',\n message: 'No verification challenge exists for this domain in this scope. Claim it first.',\n domain,\n },\n });\n }\n\n // Re-checked HERE, not only at claim: a claim takes no lock, so another scope may have\n // completed its own verification since. This is the write that confers routing authority\n // and therefore the one that must be exclusive.\n await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n const { verified, recordsFound } = await service.checkDomainChallenge(domain, expectedToken);\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext), {\n domain,\n status: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n dnsName: service.verificationDnsName(domain),\n dnsRecordsFound: recordsFound,\n });\n\n return { domains: service.planVerificationOutcome(domains, domain, verified) };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// revokeDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createRevokeDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.REVOKE_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.revokeDomain`,\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n\n const isClaimed = domains.verifiedDomains.includes(domain)\n \|\| domains.domainVerificationStatus?.[domain] !== undefined\n \|\| domains.ssoEnabledDomains.includes(domain);\n if (!isClaimed) {\n throw utils.errorBuilder.buildError(ErrorType.NOT_FOUND, executionContext, {\n context: {\n code: 'SSO_DOMAIN_NOT_CLAIMED',\n reason: 'sso_domain_not_claimed',\n message: 'This scope holds no claim on that domain, so there is nothing to revoke.',\n domain,\n },\n });\n }\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext), {\n domain,\n revoked: true,\n });\n\n /\n * ─── Sessions already routed by this domain are NOT terminated, and that is a decision ──\n \n \"Revoke the domain\" reads like \"cut the sessions\", and it must not mean that. Domain\n * routing decides where a NEW sign-in is sent; it is not a credential and confers no\n * standing — `DomainOrgLookupResult` says so explicitly, and every reader treats the\n * scope it returns as a hint that may only TIGHTEN an enforcement decision. So a session\n * established while the domain was verified was established by an identity provider that\n * really did authenticate that person; nothing about it becomes false when the routing\n * hint is withdrawn.\n \n Ending sessions is a different control with its own doors (member suspension, user\n * deactivation, the session-version fence). Folding it in here would make revocation —\n * the ordinary step in handing a domain to another scope — a mass logout of people whose\n * standing has not changed.\n */\n return { domains: getDomainVerificationService(container).planDomainRevocation(domains, domain) };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\nexport function createSsoConfigDomainVerificationFactories(): ResourceCustomServiceImplementationFactory[] {\n return SSO_CONFIG_SCOPE_VARIANTS.flatMap((variant) => [\n createClaimDomainFactory(variant),\n createVerifyDomainFactory(variant),\n createRevokeDomainFactory(variant),\n ]);\n}\n"]}
1	+ {"version":3,"file":"sso-config-domain-verification.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-config-domain-verification.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAiBpH,MAAM,yBAAyB,GAAqC;IAClE;QACE,YAAY,EAAE,gBAAgB,CAAC,uBAAuB;QACtD,SAAS,EAAE,aAAa,CAAC,YAAY;QACrC,UAAU,EAAE,gBAAgB;KAC7B;IACD;QACE,YAAY,EAAE,gBAAgB,CAAC,sBAAsB;QACrD,SAAS,EAAE,aAAa,CAAC,WAAW;QACpC,UAAU,EAAE,eAAe;KAC5B;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAiE,CAAC;AAEjG;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,YAA8B,EAAE,SAAiB,EAAE,gBAAuC;IAC3G,OAAO,GAAG,YAAY,IAAI,SAAS,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;AAC1E,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAA8B;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;YAAE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,GAAG,sBAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAUD;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,OAA8B,EAC9B,KAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,SAAS,GAAI,KAA0C,EAAE,MAAM,CAAC;IACtE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,EAAE,gBAAgB,EAAE;YAC1E,OAAO,EAAE;gBACP,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,qBAAqB;gBAC7B,OAAO,EAAE,4DAA4D;aACtE;SACF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,KAAK,CAAC,aAAsE,CAAC;IACnG,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,aAAa,EAAE,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,gGAAgG;QAChG,4FAA4F;QAC5F,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,EAAE,gBAAgB,EAAE;YAC7E,OAAO,EAAE;gBACP,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,6BAA6B;gBACrC,OAAO,EAAE,iEAAiE;gBAC1E,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,4BAA4B,CAAC,SAAoB;IACxD,OAAO,SAAS,CAAC,GAAG,CAAmC,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;AACvG,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,4BAA4B,CACzC,SAAoB,EACpB,OAA8B,EAC9B,OAAe,EACf,MAAc,EACd,gBAAuC,EACvC,KAAmD;IAEnD,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,SAAS,CAAC;SAC3D,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;QACxE,OAAO,EAAE;YACP,IAAI,EAAE,+BAA+B;YACrC,MAAM,EAAE,+BAA+B;YACvC,OAAO,EACL,6FAA6F;kBAC3F,0FAA0F;YAC9F,MAAM;SACP;KACF,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,cAAc;AACd,uEAAuE;AAEvE,SAAS,wBAAwB,CAAC,OAA8B;IAC9D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,YAAY;YACtD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,cAAc;QACjD;;;;;;;;;WASG;QACH,mBAAmB,EAAE,CAAC,SAAS,CAAC;QAChC,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,IAAI,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAEtF,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAE;oBAC/F,MAAM;oBACN,MAAM,EAAE,wBAAwB,CAAC,OAAO;oBACxC,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC,CAAC,CAAC;gBAEH,0FAA0F;gBAC1F,2FAA2F;gBAC3F,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SAClH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD;;;;;;;;;WASG;QACH,mBAAmB,EAAE,CAAC,SAAS,CAAC;QAChC,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACnG,MAAM,OAAO,GAAG,4BAA4B,CAAC,SAAS,CAAC,CAAC;gBAExD,MAAM,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACpE,IAAI,CAAC,aAAa,EAAE,CAAC;oBACnB,oFAAoF;oBACpF,qFAAqF;oBACrF,0EAA0E;oBAC1E,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;wBACxE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,iFAAiF;4BAC1F,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,uFAAuF;gBACvF,yFAAyF;gBACzF,gDAAgD;gBAChD,MAAM,4BAA4B,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAEjG,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAE7F,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM;oBACtF,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAC5C,eAAe,EAAE,YAAY;iBAC9B,CAAC,CAAC;gBAEH,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjF,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,uEAAuE;AACvE,eAAe;AACf,uEAAuE;AAEvE,SAAS,yBAAyB,CAAC,OAA8B;IAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,SAAoB,EAAE,EAAE,CACnG,yCAAyC,CAAC;QACxC,aAAa,EAAE;YACb,kBAAkB,EAAE,OAAO,CAAC,YAAY;YACxC,mBAAmB,EAAE,oBAAoB,CAAC,aAAa;YACvD,WAAW,EAAE,4BAA4B,CAAC,QAAQ;YAClD,kBAAkB,EAAE,IAAI;SACzB;QACD,UAAU,EAAE,GAAG,OAAO,CAAC,YAAY,eAAe;QAClD;;;;;;;;;WASG;QACH,mBAAmB,EAAE,CAAC,SAAS,CAAC;QAChC,QAAQ,EAAE;YACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;gBAClF,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBAE1F,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC;uBACrD,OAAO,CAAC,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS;uBACxD,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf;;;;;;;;;;;;;;;;;;;;;;uBAsBG;oBACH,MAAM,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,EAAE,gBAAgB,EAAE;wBACxE,OAAO,EAAE;4BACP,IAAI,EAAE,wBAAwB;4BAC9B,MAAM,EAAE,wBAAwB;4BAChC,OAAO,EAAE,0EAA0E;4BACnF,MAAM;yBACP;qBACF,CAAC,CAAC;gBACL,CAAC;gBAED,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,EAAE;oBAChG,MAAM;oBACN,OAAO,EAAE,IAAI;iBACd,CAAC,CAAC;gBAEH;;;;;;;;;;;;;;;mBAeG;gBACH,OAAO,EAAE,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YACpG,CAAC;YACD,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CACzF,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,oBAAoB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,IAAI,UAAU;SACnH;KACF,CAAC,CAAC;IAEL,OAAO,OAAgE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,0CAA0C;IACxD,OAAO,yBAAyB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACpD,wBAAwB,CAAC,OAAO,CAAC;QACjC,yBAAyB,CAAC,OAAO,CAAC;QAClC,yBAAyB,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n SSO Config — domain-ownership operations (#424)\n \n Three public operations that turn enterprise domain routing from an out-of-band database write\n * into a self-service admin flow:\n \n claimDomain → mints a DNS-TXT challenge, records the domain as `pending`, returns the record\n * verifyDomain → resolves the record, records `verified` or `failed`\n * revokeDomain → removes the claim, its status, its nonce and its `ssoEnabledDomains` entry\n \n ## Why PREFIX, and not OVERRIDE_ALL\n \n Each handler computes the new `domains` block and returns it; the framework's own core UPDATE\n * persists it. `OVERRIDE_ALL` returns before the post-operation lane, so it emits NO\n * `RESOURCE_OPERATION_PERFORMED` audit event — and the audit row is the control that makes a\n * privileged configuration change with cross-tenant reach accountable. An operation that granted a\n * tenant SSO routing authority and left no trail would be strictly worse than the database write it\n * replaces, which at least happens where a DBA can see it.\n \n ## Where the domain-ownership rules live\n \n In `DomainVerificationBackendService`, as pure planners. This file is the door: it resolves the\n * scope, enforces the refusals, and hands the plan to the framework. Nothing here re-implements\n * what a claim or a revocation means.\n /\n\nimport {\n AuthScopeType,\n CoreResourceType,\n DomainVerificationStatus,\n ErrorType,\n ResourceOperationVariantType,\n SsoConfig_Operations,\n} from '@wildo-ai/saas-models';\nimport type { SsoConfigBase } from '@wildo-ai/saas-models';\nimport type { Container } from 'inversify';\nimport { SAAS_SERVICE_TYPES } from '~wildo-backend-lib/inject/models/service-types';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\nimport type {\n DomainVerificationBackendService,\n SsoConfigDomains,\n} from '~wildo-backend-lib/security/authentications/services/admin-config/domain-verification.backend.service';\nimport type { ResourceOperation_CustomImplementation_Utils } from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation-base.backend.service';\nimport type { ExecutionContext } from '~wildo-backend-lib/runtime/models/execution-context.backend.schemas';\n\n// ── The two scope variants, and how each names its scope ─────────────\n\ninterface SsoConfigScopeVariant {\n readonly resourceType: CoreResourceType;\n readonly scopeType: AuthScopeType;\n readonly scopeField: 'organizationId' \| 'applicationId';\n}\n\nconst SSO_CONFIG_SCOPE_VARIANTS: readonly SsoConfigScopeVariant[] = [\n {\n resourceType: CoreResourceType.ORGANIZATION_SSO_CONFIG,\n scopeType: AuthScopeType.ORGANIZATION,\n scopeField: 'organizationId',\n },\n {\n resourceType: CoreResourceType.APPLICATION_SSO_CONFIG,\n scopeType: AuthScopeType.APPLICATION,\n scopeField: 'applicationId',\n },\n];\n\n/\n Carries the two values a response needs that the persisted row does not hold, from the PREFIX\n * that computed them to the POSTFIX that shapes the reply.\n \n Bounded on purpose. The precedent bridges in this tree (`ROTATE_BRIDGE_BY_TARGET_ID`) delete\n * their entry in the postfix and rely on the postfix always running; a core UPDATE that throws\n * between the two leaks one entry forever. Expiring on write costs one `Date.now()` per call and\n * removes the question.\n /\nconst RESPONSE_BRIDGE_TTL_MS = 60_000;\nconst RESPONSE_BRIDGE = new Map<string, { value: Record<string, unknown>; expiresAt: number }>();\n\n/\n Keyed on the REQUEST, not on the row.\n \n The postfix receives the persisted row and the execution context — never the request body — so it\n * cannot re-derive which domain the call was about. `correlationId` is minted per request and is\n * the same value in both handlers, which makes the hand-off exact: two admins claiming two domains\n * on the same configuration row at the same instant cannot read each other's response.\n /\nfunction bridgeKey(resourceType: CoreResourceType, operation: string, executionContext: ExecutionContext<any>): string {\n return `${resourceType}\|${operation}\|${executionContext.correlationId}`;\n}\n\nfunction putBridged(key: string, value: Record<string, unknown>): void {\n const now = Date.now();\n for (const [existingKey, entry] of RESPONSE_BRIDGE) {\n if (entry.expiresAt <= now) RESPONSE_BRIDGE.delete(existingKey);\n }\n RESPONSE_BRIDGE.set(key, { value, expiresAt: now + RESPONSE_BRIDGE_TTL_MS });\n}\n\nfunction takeBridged(key: string): Record<string, unknown> \| undefined {\n const entry = RESPONSE_BRIDGE.get(key);\n RESPONSE_BRIDGE.delete(key);\n if (!entry \|\| entry.expiresAt <= Date.now()) return undefined;\n return entry.value;\n}\n\n// ── Shared request resolution ────────────────────────────────────────\n\ninterface ResolvedDomainRequest {\n readonly domain: string;\n readonly scopeId: string;\n readonly domains: SsoConfigDomains;\n}\n\n/\n The row being updated, its scope id, and the normalised domain.\n \n `utils.currentObject` is the pre-image the framework already fetched for this UPDATE, so nothing\n * here re-reads the config. The domain is lowercased HERE, once, because every stored map is keyed\n * on the lowercase form and a second normalisation site is a second place for the two to disagree.\n /\nfunction resolveDomainRequest(\n variant: SsoConfigScopeVariant,\n input: unknown,\n executionContext: ExecutionContext<any>,\n utils: ResourceOperation_CustomImplementation_Utils,\n): ResolvedDomainRequest {\n const rawDomain = (input as { domain?: unknown } \| undefined)?.domain;\n if (typeof rawDomain !== 'string' \|\| rawDomain.trim().length === 0) {\n throw utils.errorBuilder.buildError(ErrorType.VALIDATION, executionContext, {\n context: {\n code: 'SSO_DOMAIN_REQUIRED',\n reason: 'sso_domain_required',\n message: 'Provide `domain`: the DNS hostname this scope is claiming.',\n },\n });\n }\n\n const currentObject = utils.currentObject as (SsoConfigBase & Record<string, unknown>) \| undefined;\n const scopeId = currentObject?.[variant.scopeField];\n if (!currentObject?.domains \|\| typeof scopeId !== 'string' \|\| scopeId.length === 0) {\n // The row is addressed by its scope (a one-to-one composition), so a missing scope id means the\n // framework could not resolve the singleton — never that the caller addressed someone else.\n throw utils.errorBuilder.buildError(ErrorType.CONFIGURATION, executionContext, {\n context: {\n code: 'SSO_CONFIG_SCOPE_UNRESOLVED',\n reason: 'sso_config_scope_unresolved',\n message: 'The SSO configuration row for this scope could not be resolved.',\n resourceType: variant.resourceType,\n },\n });\n }\n\n return { domain: rawDomain.trim().toLowerCase(), scopeId, domains: currentObject.domains };\n}\n\nfunction getDomainVerificationService(container: Container): DomainVerificationBackendService {\n return container.get<DomainVerificationBackendService>(SAAS_SERVICE_TYPES.DomainVerificationService);\n}\n\n/\n Refuse when another scope already holds this domain VERIFIED.\n \n Run at CLAIM as a helpful early refusal, and again at VERIFY because that is the gate that\n * matters: a claim is not a lock, so another scope can complete its own verification in between.\n \n The holder is deliberately not named. Telling one tenant which other tenant holds a domain\n * discloses a customer's configuration to a stranger who supplied nothing but a hostname. The\n * message says what to do instead — the current holder revokes, and then the claim succeeds — which\n * is the only remedy anyway.\n /\nasync function assertDomainNotHeldElsewhere(\n container: Container,\n variant: SsoConfigScopeVariant,\n scopeId: string,\n domain: string,\n executionContext: ExecutionContext<any>,\n utils: ResourceOperation_CustomImplementation_Utils,\n): Promise<void> {\n const conflict = await getDomainVerificationService(container)\n .findConflictingScope(variant.scopeType, scopeId, domain);\n if (!conflict) return;\n\n throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n context: {\n code: 'SSO_DOMAIN_VERIFIED_ELSEWHERE',\n reason: 'sso_domain_verified_elsewhere',\n message:\n 'This domain is already verified for another scope. A domain routes sign-ins to exactly one '\n + 'identity provider, so it must be revoked where it is held before it can be claimed here.',\n domain,\n },\n });\n}\n\n// ════════════════════════════════════════════════════════════════════\n// claimDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createClaimDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.CLAIM_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.claimDomain`,\n /\n The prefix WRITES `domains`, and nothing else can.\n \n Without this the repository's strict re-parse drops the key the hook just computed and the\n * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs\n * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.\n * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is\n * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block\n * remains the three operations that own it.\n /\n authoritativeFields: ['domains'],\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n const plan = getDomainVerificationService(container).planDomainClaim(domains, domain);\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext), {\n domain,\n status: DomainVerificationStatus.PENDING,\n dnsName: plan.dnsName,\n dnsRecordValue: plan.dnsRecordValue,\n });\n\n // The ONLY key returned. The core UPDATE `$set`s what it is given, so returning the whole\n // row here would re-write every other block from a pre-image this handler never validated.\n return { domains: plan.domains };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.CLAIM_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// verifyDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createVerifyDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.VERIFY_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.verifyDomain`,\n /\n The prefix WRITES `domains`, and nothing else can.\n \n Without this the repository's strict re-parse drops the key the hook just computed and the\n * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs\n * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.\n * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is\n * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block\n * remains the three operations that own it.\n /\n authoritativeFields: ['domains'],\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, scopeId, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n const service = getDomainVerificationService(container);\n\n const expectedToken = service.getVerificationToken(domains, domain);\n if (!expectedToken) {\n // A claim mints the nonce, so verifying without one is not a failed check — it is a\n // request for a challenge that was never raised. Saying so is what stops an operator\n // publishing a record and waiting for a verification that can never pass.\n throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n context: {\n code: 'SSO_DOMAIN_NOT_CLAIMED',\n reason: 'sso_domain_not_claimed',\n message: 'No verification challenge exists for this domain in this scope. Claim it first.',\n domain,\n },\n });\n }\n\n // Re-checked HERE, not only at claim: a claim takes no lock, so another scope may have\n // completed its own verification since. This is the write that confers routing authority\n // and therefore the one that must be exclusive.\n await assertDomainNotHeldElsewhere(container, variant, scopeId, domain, executionContext, utils);\n\n const { verified, recordsFound } = await service.checkDomainChallenge(domain, expectedToken);\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext), {\n domain,\n status: verified ? DomainVerificationStatus.VERIFIED : DomainVerificationStatus.FAILED,\n dnsName: service.verificationDnsName(domain),\n dnsRecordsFound: recordsFound,\n });\n\n return { domains: service.planVerificationOutcome(domains, domain, verified) };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.VERIFY_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\n// ════════════════════════════════════════════════════════════════════\n// revokeDomain\n// ════════════════════════════════════════════════════════════════════\n\nfunction createRevokeDomainFactory(variant: SsoConfigScopeVariant): ResourceCustomServiceImplementationFactory {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService, container: Container) =>\n createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variant.resourceType,\n operationIdentifier: SsoConfig_Operations.REVOKE_DOMAIN,\n variantType: ResourceOperationVariantType.API_CALL,\n isOperationDefault: true,\n },\n debugLabel: `${variant.resourceType}.revokeDomain`,\n /\n The prefix WRITES `domains`, and nothing else can.\n \n Without this the repository's strict re-parse drops the key the hook just computed and the\n * operation answers 200 having persisted nothing — the silent no-op the sibling lifecycle verbs\n * (`organizations.requestDeletion`, `organizationMembers.grantOwnership`) each declare against.\n * Declaring it also settles the contract in the other direction: a caller-supplied `domains` is\n * OVERWRITTEN by the hook's value rather than honoured, so the only way to move this block\n * remains the three operations that own it.\n /\n authoritativeFields: ['domains'],\n handlers: {\n prefixCoreOperations: async (_id, input, executionContext, _operationPath, utils) => {\n const { domain, domains } = resolveDomainRequest(variant, input, executionContext, utils);\n\n const isClaimed = domains.verifiedDomains.includes(domain)\n \|\| domains.domainVerificationStatus?.[domain] !== undefined\n \|\| domains.ssoEnabledDomains.includes(domain);\n if (!isClaimed) {\n /\n CONFLICT, not NOT_FOUND — corrected 2026-09-10 after the refusal was driven over HTTP\n * for the first time, and for three independent reasons.\n \n It could not name itself. `sanitizeErrorForClient` allow-lists a refusal's\n * `context` — and with it the client-branchable `code` — only for VALIDATION, CONFLICT\n * and RATE_LIMIT; every other type has its context stripped whole. So as a NOT_FOUND\n * this answered a bare `not_found` and `SSO_DOMAIN_NOT_CLAIMED` reached no client. A\n * status and a name that cannot both be delivered is not a contract.\n \n Its SIBLING already answers 409 for the same condition. `verifyDomain` refuses a\n * domain with no challenge as a CONFLICT, eight hundred lines up in this same file. One\n * condition, two verbs, two answers — the shape\n * `.claude/rules/invariant-call-site-enumeration.md` exists for.\n \n And 409 is what the framework's own rule asks for here.\n * `administrative-continuity-floors.md`: refuse with CONFLICT, never 403 or 400, when\n * the caller IS authorized and the payload IS valid and what forbids the write is the\n * current STATE. The addressed row — the SSO config singleton — exists and resolved;\n * what does not exist is a claim inside it. A 404 on a URL that resolved is also the\n * exact ambiguity issue #542 records against itself: a dispatched 404 and a routing 404\n * are told apart by the body, not the status.\n /\n throw utils.errorBuilder.buildError(ErrorType.CONFLICT, executionContext, {\n context: {\n code: 'SSO_DOMAIN_NOT_CLAIMED',\n reason: 'sso_domain_not_claimed',\n message: 'This scope holds no claim on that domain, so there is nothing to revoke.',\n domain,\n },\n });\n }\n\n putBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext), {\n domain,\n revoked: true,\n });\n\n /\n * ─── Sessions already routed by this domain are NOT terminated, and that is a decision ──\n \n \"Revoke the domain\" reads like \"cut the sessions\", and it must not mean that. Domain\n * routing decides where a NEW sign-in is sent; it is not a credential and confers no\n * standing — `DomainOrgLookupResult` says so explicitly, and every reader treats the\n * scope it returns as a hint that may only TIGHTEN an enforcement decision. So a session\n * established while the domain was verified was established by an identity provider that\n * really did authenticate that person; nothing about it becomes false when the routing\n * hint is withdrawn.\n \n Ending sessions is a different control with its own doors (member suspension, user\n * deactivation, the session-version fence). Folding it in here would make revocation —\n * the ordinary step in handing a domain to another scope — a mass logout of people whose\n * standing has not changed.\n */\n return { domains: getDomainVerificationService(container).planDomainRevocation(domains, domain) };\n },\n postfixCoreOperations: async (_id, updatedRow, executionContext, _operationPath, _utils) =>\n takeBridged(bridgeKey(variant.resourceType, SsoConfig_Operations.REVOKE_DOMAIN, executionContext)) ?? updatedRow,\n },\n });\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n}\n\nexport function createSsoConfigDomainVerificationFactories(): ResourceCustomServiceImplementationFactory[] {\n return SSO_CONFIG_SCOPE_VARIANTS.flatMap((variant) => [\n createClaimDomainFactory(variant),\n createVerifyDomainFactory(variant),\n createRevokeDomainFactory(variant),\n ]);\n}\n"]}

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-config.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAcpH,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAiE7F"}
1	+ {"version":3,"file":"sso-config.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAQH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAcpH,wBAAgB,8BAA8B,IAAI,0CAA0C,EAAE,CAiE7F"}

package/dist/esm/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-config.custom-impl.backend.service.js","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,yEAAyE;AAEzE,MAAM,6BAA6B,GAAG;IACpC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,sBAAsB;CAC/B,CAAC;AAEX,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,8DAA8D;oBAC9D,iFAAiF;oBACjF,8EAA8E;oBAC9E,8EAA8E;oBAC9E,kEAAkE;oBAClE,mFAAmF;oBACnF,6EAA6E;oBAC7E,mFAAmF;oBACnF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,mFAAmF;wBACnF,EAAE;wBACF,8EAA8E;wBAC9E,+EAA+E;wBAC/E,mEAAmE;wBACnE,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gFAAgF;wBAChF,2EAA2E;wBAC3E,6EAA6E;wBAC7E,wCAAwC;wBACxC,EAAE;wBACF,+EAA+E;wBAC/E,iFAAiF;wBACjF,mCAAmC;wBACnC,IAAI,KAAK,EAAE,yBAAyB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;4BACvF,MAAM,QAAQ,GAAI,KAAK,CAAC,aAAqB,EAAE,yBAAyB,IAAI,EAAE,CAAC;4BAC/E,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CACnE,CAAC,QAAa,EAAE,EAAE;gCAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACnD,CAAC;gCACF,IAAI,CAAC,KAAK;oCAAE,OAAO,QAAQ,CAAC;gCAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,sBAAsB,EAAE,CAAC;oCAC3E,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gCAC3C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oCACnD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gCAC/C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;oCACrD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;gCACjD,CAAC;gCACD,OAAO,MAAM,CAAC;4BAChB,CAAC,CACF,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n SSO Config Custom Implementations\n \n Implements the internal UPDATE path on SSO config polymorphic variants\n * (ORG + APP).\n \n Patterns:\n * UPDATE → PREFIX_CORE_OPERATIONS — preserves per-override secret fields in\n * socialCredentialOverrides (P3): the `.isWriteOnlySecret()`\n * clientSecret (round-tripped as the `••••••••` mask) and the\n * `.isBackendOnly()` signedJwt* ids (never sent to the frontend)\n * Domain claim / verify / revoke now EXIST, backed by `DomainVerificationBackendService`, and live\n * in `sso-config-domain-verification.custom-impl.backend.service.ts` (#424). The rule that kept them\n * out of this file still stands and is what they were held to: a placeholder 200 must never be\n * registered as an externally usable operation.\n /\n\nimport {\n CoreResourceOperation,\n CoreResourceType,\n ResourceOperationVariantType,\n WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n// ── SSO config polymorphic variant types ──────────────────────────────\n\nconst AUTH_SSO_CONFIG_VARIANT_TYPES = [\n CoreResourceType.ORGANIZATION_SSO_CONFIG,\n CoreResourceType.APPLICATION_SSO_CONFIG,\n] as const;\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConfigUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n return AUTH_SSO_CONFIG_VARIANT_TYPES.map((variantResourceType) => {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n return createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variantResourceType,\n operationIdentifier: CoreResourceOperation.UPDATE,\n // INTERNAL_CALL — MUST match the SSO-config UPDATE variant in\n // `sso-config.shared.resources-config.schemas.ts`. The custom-impl registry keys\n // registrations on the FULL operation path (variantType included), so if this\n // drifts from the config variant the dispatch never finds this PREFIX and the\n // per-override write-only secrets (`clientSecret` / signedJwt on\n // socialCredentialOverrides) are wiped on every update. Moved from REPOSITORY_ONLY\n // in lockstep with the config change that made `saveSSOConfig`'s `.update()`\n // resolvable via `getServiceOperationPathDefault` (which rejects REPOSITORY_ONLY).\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isOperationDefault: true,\n },\n handlers: {\n prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n // P3: Preserve per-override secret fields for socialCredentialOverrides on UPDATE.\n //\n // Problem: the secret fields never round-trip a usable value from the client.\n // `clientSecret` is `.isWriteOnlySecret()` — the client renders the `••••••••`\n // mask and saves it back; `signedJwtKeyId` / `signedJwtTeamId` are\n // `.isBackendOnly()` — stripped from READ responses entirely, so the client\n // sends them absent. Either way, the repository UPDATE replaces the WHOLE\n // `socialCredentialOverrides` array via `$set` (no deep merge), so without this\n // handler the stored secrets are permanently lost. The framework's central\n // write-only-secret sentinel-strip cannot rescue them either — it only helps\n // TOP-LEVEL fields, not array elements.\n //\n // Solution: match each incoming override to the existing record by providerRef\n // and re-inject any secret that arrived absent or as the `••••••••` mask, BEFORE\n // the central sentinel-strip runs.\n if (input?.socialCredentialOverrides && Array.isArray(input.socialCredentialOverrides)) {\n const existing = (utils.currentObject as any)?.socialCredentialOverrides \|\| [];\n input.socialCredentialOverrides = input.socialCredentialOverrides.map(\n (override: any) => {\n const match = existing.find(\n (e: any) => e.providerRef === override.providerRef,\n );\n if (!match) return override;\n const merged = { ...override };\n if (!merged.clientSecret \|\| merged.clientSecret === WRITE_ONLY_SECRET_MASK) {\n merged.clientSecret = match.clientSecret;\n }\n if (!merged.signedJwtKeyId && match.signedJwtKeyId) {\n merged.signedJwtKeyId = match.signedJwtKeyId;\n }\n if (!merged.signedJwtTeamId && match.signedJwtTeamId) {\n merged.signedJwtTeamId = match.signedJwtTeamId;\n }\n return merged;\n },\n );\n }\n return input;\n },\n },\n });\n };\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n });\n}\n"]}
1	+ {"version":3,"file":"sso-config.custom-impl.backend.service.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-config.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yCAAyC,GAE1C,MAAM,4GAA4G,CAAC;AAGpH,yEAAyE;AAEzE,MAAM,6BAA6B,GAAG;IACpC,gBAAgB,CAAC,uBAAuB;IACxC,gBAAgB,CAAC,sBAAsB;CAC/B,CAAC;AAEX,uEAAuE;AACvE,kCAAkC;AAClC,uEAAuE;AAEvE,MAAM,UAAU,8BAA8B;IAC5C,OAAO,6BAA6B,CAAC,GAAG,CAAC,CAAC,mBAAmB,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAG,CAAC,yBAA0D,EAAE,EAAE;YAC7E,OAAO,yCAAyC,CAAC;gBAC/C,aAAa,EAAE;oBACb,kBAAkB,EAAE,mBAAmB;oBACvC,mBAAmB,EAAE,qBAAqB,CAAC,MAAM;oBACjD,8DAA8D;oBAC9D,iFAAiF;oBACjF,8EAA8E;oBAC9E,8EAA8E;oBAC9E,kEAAkE;oBAClE,mFAAmF;oBACnF,6EAA6E;oBAC7E,mFAAmF;oBACnF,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,kBAAkB,EAAE,IAAI;iBACzB;gBACD,QAAQ,EAAE;oBACR,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE;wBACnF,mFAAmF;wBACnF,EAAE;wBACF,8EAA8E;wBAC9E,+EAA+E;wBAC/E,mEAAmE;wBACnE,4EAA4E;wBAC5E,0EAA0E;wBAC1E,gFAAgF;wBAChF,2EAA2E;wBAC3E,6EAA6E;wBAC7E,wCAAwC;wBACxC,EAAE;wBACF,+EAA+E;wBAC/E,iFAAiF;wBACjF,mCAAmC;wBACnC,IAAI,KAAK,EAAE,yBAAyB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,EAAE,CAAC;4BACvF,MAAM,QAAQ,GAAI,KAAK,CAAC,aAAqB,EAAE,yBAAyB,IAAI,EAAE,CAAC;4BAC/E,KAAK,CAAC,yBAAyB,GAAG,KAAK,CAAC,yBAAyB,CAAC,GAAG,CACnE,CAAC,QAAa,EAAE,EAAE;gCAChB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CACnD,CAAC;gCACF,IAAI,CAAC,KAAK;oCAAE,OAAO,QAAQ,CAAC;gCAC5B,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gCAC/B,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,KAAK,sBAAsB,EAAE,CAAC;oCAC3E,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;gCAC3C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;oCACnD,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;gCAC/C,CAAC;gCACD,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;oCACrD,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;gCACjD,CAAC;gCACD,OAAO,MAAM,CAAC;4BAChB,CAAC,CACF,CAAC;wBACJ,CAAC;wBACD,OAAO,KAAK,CAAC;oBACf,CAAC;iBACF;aACF,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,OAAO,OAAgE,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/*\n SSO Config Custom Implementations\n \n Implements the internal UPDATE path on SSO config polymorphic variants\n * (ORG + APP).\n \n Patterns:\n * UPDATE → PREFIX_CORE_OPERATIONS — preserves per-override secret fields in\n * socialCredentialOverrides (P3): the `.isWriteOnlySecret()`\n * clientSecret (round-tripped as the `••••••••` mask) and the\n * `.isBackendOnly()` signedJwt* ids (never sent to the frontend)\n * Domain claim / verify / revoke now EXIST, backed by `DomainVerificationBackendService`, and live\n * in `sso-config-domain-verification.custom-impl.backend.service.ts` (#424). The rule that kept them\n * out of this file still stands and is what they were held to: a placeholder 200 must never be\n * registered as an externally usable operation.\n /\n\nimport {\n CoreResourceOperation,\n CoreResourceType,\n ResourceOperationVariantType,\n WRITE_ONLY_SECRET_MASK,\n} from '@wildo-ai/saas-models';\nimport {\n createResourceCustomServiceImplementation,\n type ResourceCustomServiceImplementationFactory,\n} from '~wildo-backend-lib/base-classes/services/services/resource-operation-custom-implementation.factory.backend';\nimport type { ResourcesRegistryBackendService } from '~wildo-backend-lib/resources/services/resources-registry.backend.service';\n\n// ── SSO config polymorphic variant types ──────────────────────────────\n\nconst AUTH_SSO_CONFIG_VARIANT_TYPES = [\n CoreResourceType.ORGANIZATION_SSO_CONFIG,\n CoreResourceType.APPLICATION_SSO_CONFIG,\n] as const;\n\n// ════════════════════════════════════════════════════════════════════\n// UPDATE — PREFIX_CORE_OPERATIONS\n// ════════════════════════════════════════════════════════════════════\n\nexport function createSsoConfigUpdateFactories(): ResourceCustomServiceImplementationFactory[] {\n return AUTH_SSO_CONFIG_VARIANT_TYPES.map((variantResourceType) => {\n const factory = (_resourcesRegistryService: ResourcesRegistryBackendService) => {\n return createResourceCustomServiceImplementation({\n operationPath: {\n resourceIdentifier: variantResourceType,\n operationIdentifier: CoreResourceOperation.UPDATE,\n // INTERNAL_CALL — MUST match the SSO-config UPDATE variant in\n // `sso-config.shared.resources-config.schemas.ts`. The custom-impl registry keys\n // registrations on the FULL operation path (variantType included), so if this\n // drifts from the config variant the dispatch never finds this PREFIX and the\n // per-override write-only secrets (`clientSecret` / signedJwt on\n // socialCredentialOverrides) are wiped on every update. Moved from REPOSITORY_ONLY\n // in lockstep with the config change that made `saveSSOConfig`'s `.update()`\n // resolvable via `getServiceOperationPathDefault` (which rejects REPOSITORY_ONLY).\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isOperationDefault: true,\n },\n handlers: {\n prefixCoreOperations: async (_id, input, _executionContext, _operationPath, utils) => {\n // P3: Preserve per-override secret fields for socialCredentialOverrides on UPDATE.\n //\n // Problem: the secret fields never round-trip a usable value from the client.\n // `clientSecret` is `.isWriteOnlySecret()` — the client renders the `••••••••`\n // mask and saves it back; `signedJwtKeyId` / `signedJwtTeamId` are\n // `.isBackendOnly()` — stripped from READ responses entirely, so the client\n // sends them absent. Either way, the repository UPDATE replaces the WHOLE\n // `socialCredentialOverrides` array via `$set` (no deep merge), so without this\n // handler the stored secrets are permanently lost. The framework's central\n // write-only-secret sentinel-strip cannot rescue them either — it only helps\n // TOP-LEVEL fields, not array elements.\n //\n // Solution: match each incoming override to the existing record by providerRef\n // and re-inject any secret that arrived absent or as the `••••••••` mask, BEFORE\n // the central sentinel-strip runs.\n if (input?.socialCredentialOverrides && Array.isArray(input.socialCredentialOverrides)) {\n const existing = (utils.currentObject as any)?.socialCredentialOverrides \|\| [];\n input.socialCredentialOverrides = input.socialCredentialOverrides.map(\n (override: any) => {\n const match = existing.find(\n (e: any) => e.providerRef === override.providerRef,\n );\n if (!match) return override;\n const merged = { ...override };\n if (!merged.clientSecret \|\| merged.clientSecret === WRITE_ONLY_SECRET_MASK) {\n merged.clientSecret = match.clientSecret;\n }\n if (!merged.signedJwtKeyId && match.signedJwtKeyId) {\n merged.signedJwtKeyId = match.signedJwtKeyId;\n }\n if (!merged.signedJwtTeamId && match.signedJwtTeamId) {\n merged.signedJwtTeamId = match.signedJwtTeamId;\n }\n return merged;\n },\n );\n }\n return input;\n },\n },\n });\n };\n\n return factory as unknown as ResourceCustomServiceImplementationFactory;\n });\n}\n"]}

package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["~~../../../../../../../~~src/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqBH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;~~AAyTpH~~;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAgCjG;AAMD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAsDjG;AAkFD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAuFjG;AAMD,wBAAgB,0CAA0C,IAAI,0CAA0C,EAAE,CAmCzG;AAMD,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAqC5G"}
1	+ {"version":3,"file":"sso-connection.custom-impl.backend.service.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqBH,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAoUpH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAgCjG;AAMD,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAsDjG;AAkFD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,IAAI,0CAA0C,EAAE,CAuFjG;AAMD,wBAAgB,0CAA0C,IAAI,0CAA0C,EAAE,CAmCzG;AAMD,wBAAgB,6CAA6C,IAAI,0CAA0C,EAAE,CAqC5G"}

package/dist/esm/security/authentications/services/custom-impls/sso-connection.custom-impl.backend.service.js CHANGED Viewed

@@ -35,6 +35,16 @@ const SAML_BINDINGS = {
     POST: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
 };
 const MAX_METADATA_SIZE = 2 * 1024 * 1024; // 2MB
+/**
+ * Hard deadline for fetching an IdP's SAML metadata document.
+ *
+ * An administrator is watching: this runs while they configure an enterprise connection and press
+ * save, so an unresponsive metadata host must produce an error they can act on rather than a form
+ * that never returns. 10s — the document is XML capped by {@link MAX_METADATA_SIZE}, served by a
+ * host the administrator has just typed, and erring generous here spends their whole wait on what
+ * is most often a typo.
+ */
+const SAML_METADATA_FETCH_TIMEOUT_MS = 10_000;
 const SHA1_RSA_OID = Buffer.from('06092a864886f70d010105', 'hex');
 const ECDSA_SHA1_OID = Buffer.from('06072a8648ce3d0401', 'hex');
 const SIG_ALG_OIDS = [
@@ -622,7 +632,7 @@ async function discoverSamlEndpoints(metadataUrl, executionContext, utils) {
     try {
         const response = await fetch(metadataUrl, {
             method: 'GET',
-            signal: AbortSignal.timeout(10_000),
+            signal: AbortSignal.timeout(SAML_METADATA_FETCH_TIMEOUT_MS),
             redirect: 'follow',
         });
         if (!response.ok) {