@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts

@@ -0,0 +1,91 @@
+/**
+ * SCIM directory value → organization-unit assignment (WS-C).
+ *
+ * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to
+ * an organization unit, and keeps that binding authoritative rather than accumulating.
+ *
+ * ## What this decides, and why it is EXPLICIT rather than inferred
+ *
+ * An IdP pushes a flat string (`department: "Sales"`). Units live in a TREE where `code` is unique
+ * only among siblings and `name` is freeform, so "Sales" can legitimately match several nodes. Since
+ * units became an authorization axis, resolving that string to the wrong node does not mislabel a
+ * user — it grants them the wrong data.
+ *
+ * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin
+ * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding
+ * is IGNORED. The person who owns the org chart is the one who says what "Sales" means; nothing here
+ * guesses on their behalf.
+ *
+ * ## Authoritative reconciliation
+ *
+ * Each push replaces the member's unit assignments with exactly what the directory currently says
+ * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege
+ * accretion, where access only ever grows and an offboarded department is never actually left.
+ *
+ * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application
+ * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than
+ * over a subset it can distinguish as its own. An organization that wants manual unit assignments
+ * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}
+ * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that
+ * never opted in can never have its assignments deleted by a push.
+ */
+import { z } from 'zod';
+/**
+ * One declared binding: the directory's own value for a department, and the unit it means.
+ *
+ * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately
+ * not normalised beyond whitespace — case and punctuation are part of what a directory actually
+ * pushes, and silently folding them would make two distinct departments collide onto one unit.
+ */
+export declare const ScimOrganizationUnitMappingEntrySchema: z.ZodObject<{
+    directoryValue: z.ZodString;
+    organizationUnitId: z.ZodString;
+}, z.core.$strip>;
+export type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;
+/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */
+export type ScimOrganizationUnitManagementSignal = {
+    readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;
+    readonly defaultUnitRole?: string | null;
+};
+/**
+ * Is this organization managing unit assignments through SCIM at all?
+ *
+ * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a
+ * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate
+ * exists to prevent: a half-configured row must never make a push authoritative over assignments it
+ * has no way to recreate.
+ */
+export declare function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean;
+/**
+ * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing
+ * declares it.
+ *
+ * `undefined` means UNMAPPED, not "no unit": the caller treats an unmapped value as "the directory
+ * says nothing about units for this user", which under authoritative reconciliation removes their
+ * directory-managed assignments rather than inventing one.
+ */
+export declare function resolveScimOrganizationUnitId(directoryValue: string | undefined | null, mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null): string | undefined;
+/** An existing assignment row, read structurally. */
+export type ScimOrganizationUnitAssignment = {
+    readonly _id: string;
+    readonly organizationUnitId: string;
+};
+/** The writes a push must perform to make the member's assignments match the directory. */
+export type ScimOrganizationUnitReconciliation = {
+    /** Units to assign that the member does not already hold. */
+    readonly unitIdsToCreate: string[];
+    /** Assignment rows to delete — everything the directory no longer says. */
+    readonly assignmentIdsToRemove: string[];
+};
+/**
+ * Compute the exact writes that make a member's unit assignments match the directory.
+ *
+ * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
+ * re-pushes every user nightly does not churn the junction table or its audit trail.
+ *
+ * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
+ * assignment — that is the authoritative half, and it is what makes leaving a department actually
+ * revoke its access.
+ */
+export declare function resolveScimOrganizationUnitReconciliation(desiredUnitIds: readonly string[], currentAssignments: readonly ScimOrganizationUnitAssignment[]): ScimOrganizationUnitReconciliation;
+//# sourceMappingURL=scim-organization-unit-mapping.shared.d.ts.map

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-organization-unit-mapping.shared.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,sCAAsC;;;iBAKjD,CAAC;AAEH,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,0GAA0G;AAC1G,MAAM,MAAM,oCAAoC,GAAG;IACjD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,SAAS,gCAAgC,EAAE,GAAG,IAAI,CAAC;IACtF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CAAC,MAAM,EAAE,oCAAoC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAEhI;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,cAAc,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACzC,OAAO,EAAE,SAAS,gCAAgC,EAAE,GAAG,SAAS,GAAG,IAAI,GACtE,MAAM,GAAG,SAAS,CAKpB;AAED,qDAAqD;AACrD,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,2FAA2F;AAC3F,MAAM,MAAM,kCAAkC,GAAG;IAC/C,6DAA6D;IAC7D,QAAQ,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IACnC,2EAA2E;IAC3E,QAAQ,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,yCAAyC,CACvD,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,kBAAkB,EAAE,SAAS,8BAA8B,EAAE,GAC5D,kCAAkC,CAUpC"}

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js

@@ -0,0 +1,91 @@
+/**
+ * SCIM directory value → organization-unit assignment (WS-C).
+ *
+ * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to
+ * an organization unit, and keeps that binding authoritative rather than accumulating.
+ *
+ * ## What this decides, and why it is EXPLICIT rather than inferred
+ *
+ * An IdP pushes a flat string (`department: "Sales"`). Units live in a TREE where `code` is unique
+ * only among siblings and `name` is freeform, so "Sales" can legitimately match several nodes. Since
+ * units became an authorization axis, resolving that string to the wrong node does not mislabel a
+ * user — it grants them the wrong data.
+ *
+ * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin
+ * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding
+ * is IGNORED. The person who owns the org chart is the one who says what "Sales" means; nothing here
+ * guesses on their behalf.
+ *
+ * ## Authoritative reconciliation
+ *
+ * Each push replaces the member's unit assignments with exactly what the directory currently says
+ * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege
+ * accretion, where access only ever grows and an offboarded department is never actually left.
+ *
+ * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application
+ * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than
+ * over a subset it can distinguish as its own. An organization that wants manual unit assignments
+ * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}
+ * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that
+ * never opted in can never have its assignments deleted by a push.
+ */
+import { z } from 'zod';
+/**
+ * One declared binding: the directory's own value for a department, and the unit it means.
+ *
+ * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately
+ * not normalised beyond whitespace — case and punctuation are part of what a directory actually
+ * pushes, and silently folding them would make two distinct departments collide onto one unit.
+ */
+export const ScimOrganizationUnitMappingEntrySchema = z.object({
+    /** The value the directory pushes, e.g. `"Sales"`. Matched exactly, whitespace-trimmed. */
+    directoryValue: z.string().min(1).max(200),
+    /** The `ORGANIZATION_UNITS` row this value binds to. */
+    organizationUnitId: z.string().min(1),
+});
+/**
+ * Is this organization managing unit assignments through SCIM at all?
+ *
+ * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a
+ * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate
+ * exists to prevent: a half-configured row must never make a push authoritative over assignments it
+ * has no way to recreate.
+ */
+export function isScimOrganizationUnitManagementEnabled(config) {
+    return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;
+}
+/**
+ * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing
+ * declares it.
+ *
+ * `undefined` means UNMAPPED, not "no unit": the caller treats an unmapped value as "the directory
+ * says nothing about units for this user", which under authoritative reconciliation removes their
+ * directory-managed assignments rather than inventing one.
+ */
+export function resolveScimOrganizationUnitId(directoryValue, mapping) {
+    const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';
+    if (normalizedValue.length === 0)
+        return undefined;
+    return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;
+}
+/**
+ * Compute the exact writes that make a member's unit assignments match the directory.
+ *
+ * Idempotent by construction: an unchanged department produces no writes at all, so a directory that
+ * re-pushes every user nightly does not churn the junction table or its audit trail.
+ *
+ * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every
+ * assignment — that is the authoritative half, and it is what makes leaving a department actually
+ * revoke its access.
+ */
+export function resolveScimOrganizationUnitReconciliation(desiredUnitIds, currentAssignments) {
+    const desired = new Set(desiredUnitIds);
+    const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));
+    return {
+        unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),
+        assignmentIdsToRemove: currentAssignments
+            .filter((assignment) => !desired.has(assignment.organizationUnitId))
+            .map((assignment) => assignment._id),
+    };
+}
+//# sourceMappingURL=scim-organization-unit-mapping.shared.js.map

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAAiC,EACjC,kBAA6D;IAE7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5F,OAAO;QACL,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;aACnE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SCIM directory value → organization-unit assignment (WS-C).\n *\n * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n *\n * ## What this decides, and why it is EXPLICIT rather than inferred\n *\n * An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n *\n * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n *\n * ## Authoritative reconciliation\n *\n * Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n *\n * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n */\n\nimport { z } from 'zod';\n\n/**\n * One declared binding: the directory's own value for a department, and the unit it means.\n *\n * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n */\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n  /** The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. */\n  directoryValue: z.string().min(1).max(200),\n  /** The `ORGANIZATION_UNITS` row this value binds to. */\n  organizationUnitId: z.string().min(1),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */\nexport type ScimOrganizationUnitManagementSignal = {\n  readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;\n  readonly defaultUnitRole?: string | null;\n};\n\n/**\n * Is this organization managing unit assignments through SCIM at all?\n *\n * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n */\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean {\n  return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/**\n * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n *\n * `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n */\nexport function resolveScimOrganizationUnitId(\n  directoryValue: string | undefined | null,\n  mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null,\n): string | undefined {\n  const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n  if (normalizedValue.length === 0) return undefined;\n\n  return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/** An existing assignment row, read structurally. */\nexport type ScimOrganizationUnitAssignment = {\n  readonly _id: string;\n  readonly organizationUnitId: string;\n};\n\n/** The writes a push must perform to make the member's assignments match the directory. */\nexport type ScimOrganizationUnitReconciliation = {\n  /** Units to assign that the member does not already hold. */\n  readonly unitIdsToCreate: string[];\n  /** Assignment rows to delete — everything the directory no longer says. */\n  readonly assignmentIdsToRemove: string[];\n};\n\n/**\n * Compute the exact writes that make a member's unit assignments match the directory.\n *\n * Idempotent by construction: an unchanged department produces no writes at all, so a directory that\n * re-pushes every user nightly does not churn the junction table or its audit trail.\n *\n * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every\n * assignment — that is the authoritative half, and it is what makes leaving a department actually\n * revoke its access.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n  desiredUnitIds: readonly string[],\n  currentAssignments: readonly ScimOrganizationUnitAssignment[],\n): ScimOrganizationUnitReconciliation {\n  const desired = new Set(desiredUnitIds);\n  const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));\n\n  return {\n    unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),\n    assignmentIdsToRemove: currentAssignments\n      .filter((assignment) => !desired.has(assignment.organizationUnitId))\n      .map((assignment) => assignment._id),\n  };\n}\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts

@@ -5,13 +5,6 @@
  * Spread into the registry factory map:
  *   ...scimProvisioningConfigPolymorphicFactories
  */
-import { z } from 'zod';
-import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
-export declare enum ScimProvisioningConfig_Operations {
-    TEST_SCIM_CONNECTION = "testScimConnection",
-    GET_PROVISIONING_STATS = "getProvisioningStats"
-}
-export declare const ScimProvisioningConfig_TestConnectionRequestDto: z.ZodObject<{}>;
-export declare const ScimProvisioningConfig_GetStatsRequestDto: z.ZodObject<{}>;
-export declare const scimProvisioningConfigPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof ScimProvisioningConfig_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.CREATE, any>>;
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
+export declare const scimProvisioningConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
 //# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,iCAAiC;IAC3C,oBAAoB,uBAAuB;IAC3C,sBAAsB,yBAAyB;CAChD;AAID,eAAO,MAAM,+CAA+C,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAgB,CAAC;AAE7F,eAAO,MAAM,yCAAyC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAgB,CAAC;AAIvF,eAAO,MAAM,0CAA0C,yNAoEtD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA6FtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js

@@ -5,26 +5,27 @@
  * Spread into the registry factory map:
  *   ...scimProvisioningConfigPolymorphicFactories
  */
-import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
+import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
 import { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas.js';
-// ── Custom Operations ────────────────────────────────────────────────
-export var ScimProvisioningConfig_Operations;
-(function (ScimProvisioningConfig_Operations) {
-    ScimProvisioningConfig_Operations["TEST_SCIM_CONNECTION"] = "testScimConnection";
-    ScimProvisioningConfig_Operations["GET_PROVISIONING_STATS"] = "getProvisioningStats";
-})(ScimProvisioningConfig_Operations || (ScimProvisioningConfig_Operations = {}));
-// ── Request DTOs ─────────────────────────────────────────────────────
-export const ScimProvisioningConfig_TestConnectionRequestDto = z.object({});
-export const ScimProvisioningConfig_GetStatsRequestDto = z.object({});
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(scimProvisioningConfigPolymorphicDeclaration, {
     isSystemResource: true,
-    customOperation: ScimProvisioningConfig_Operations,
-    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE],
+    // SCIM provisioning loads its config via `readAsSystem` on the directory-sync
+    // path (system-driven, no end user in context) (READ). When the row is absent
+    // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`
+    // default-seed — the userless load path lazily materialises the
+    // disabled-default row via `createAsSystem` (CREATE); see
+    // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are
+    // system-context, so the resource opts BOTH verbs in.
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
+    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
             variants: [{
@@ -37,9 +38,20 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
         },
+        // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is
+        // materialised by the framework default-seed (repository tier) OR — when that
+        // was bypassed (provisioned / migrated / pre-seed org) — lazily by the
+        // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts
+        // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via
+        // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but
+        // NOT REPOSITORY_ONLY — a repository-only CREATE throws
+        // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and
+        // self-alerting on mere construction). No public HTTP create surface (config
+        // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens
+        // READ/UPDATE. Admin tier / HIGH.
         [CoreResourceOperation.CREATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -48,9 +60,23 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
+        // Internal-only (INTERNAL_CALL, NO HTTP route): SCIM provisioning edits reach this through
+        // the config service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig`
+        // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving
+        // admin audit attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
+        // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
+        // REPOSITORY_ONLY — a repository-only UPDATE throws
+        // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save
+        // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when
+        // their `save*` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less
+        // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.
+        // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-
+        // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)
+        // No public HTTP update surface (config is admin-service-owned, never self-serve). Same
+        // fix as the CREATE above + the SSO/SIEM UPDATE precedent. Admin tier / HIGH.
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -59,32 +85,22 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
-        [ScimProvisioningConfig_Operations.TEST_SCIM_CONNECTION]: {
-            variants: [{
-                    variantType: ResourceOperationVariantType.API_CALL,
-                    isDefault: true,
-                    polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
-                    },
-                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
-                    resourceOperationLike: CoreResourceOperation.READ,
-                    requestDto: ScimProvisioningConfig_TestConnectionRequestDto,
-                }],
-        },
-        [ScimProvisioningConfig_Operations.GET_PROVISIONING_STATS]: {
+        // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition
+        // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is
+        // physically removed when its owning org/app is deleted. Without a DELETE op the
+        // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope
+        // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.
+        [CoreResourceOperation.DELETE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.API_CALL,
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
-                    riskLevel: ResourceOperationRiskLevel.LOW,
-                    resourceOperationLike: CoreResourceOperation.READ,
-                    requestDto: ScimProvisioningConfig_GetStatsRequestDto,
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
     },
 });
-//# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.js.map
+//# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG,wEAAwE;AAExE,MAAM,CAAN,IAAY,iCAGX;AAHD,WAAY,iCAAiC;IAC3C,gFAA2C,CAAA;IAC3C,oFAA+C,CAAA;AACjD,CAAC,EAHW,iCAAiC,KAAjC,iCAAiC,QAG5C;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,+CAA+C,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE7F,MAAM,CAAC,MAAM,yCAAyC,GAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEvF,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,iCAAiC;IAClD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACxG,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,iCAAiC,CAAC,oBAAoB,CAAC,EAAE;YACxD,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,+CAA+C;iBAC5D,CAAC;SACH;QACD,CAAC,iCAAiC,CAAC,sBAAsB,CAAC,EAAE;YAC1D,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,0DAA0D;IAC1D,8EAA8E;IAC9E,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,kCAAkC;QAClC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,oDAAoD;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,wFAAwF;QACxF,8EAA8E;QAC9E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,sEAAsE;QACtE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...scimProvisioningConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas';\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimProvisioningConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // SCIM provisioning loads its config via `readAsSystem` on the directory-sync\n    // path (system-driven, no end user in context) (READ). When the row is absent\n    // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`\n    // default-seed — the userless load path lazily materialises the\n    // disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are\n    // system-context, so the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction). No public HTTP create surface (config\n      // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens\n      // READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): SCIM provisioning edits reach this through\n      // the config service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving\n      // admin audit attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save\n      // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when\n      // their `save*` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less\n      // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.\n      // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-\n      // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)\n      // No public HTTP update surface (config is admin-service-owned, never self-serve). Same\n      // fix as the CREATE above + the SSO/SIEM UPDATE precedent. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is\n      // physically removed when its owning org/app is deleted. Without a DELETE op the\n      // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope\n      // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts

@@ -9,43 +9,70 @@
  * @see auth-data-model-audit.md §2G
  */
 import { z } from 'zod';
+/**
+ * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a
+ * path expression resolved against the SCIM body at push time by the backend
+ * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload
+ * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.
+ * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never
+ * customises this behaves identically to the hardcoded normalisation it replaces.
+ *
+ * Supported path grammar (what `resolveScimAttributePath` understands):
+ * - dotted traversal — `name.givenName`
+ * - array index — `emails[0].value`
+ * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;
+ *   also `emails[type eq "work"].value`) — the SCIM-style selector the spec examples use.
+ */
 export declare const ScimAttributeMappingSchema: z.ZodObject<{
     email: z.ZodDefault<z.ZodString>;
     firstName: z.ZodDefault<z.ZodString>;
     lastName: z.ZodDefault<z.ZodString>;
     displayName: z.ZodDefault<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
+export type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;
 export declare const ScimProvisioningConfigBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    scimEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoCreateUsers: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
-    defaultRole: z.ZodOptional<z.ZodString>;
+    autoDeactivateUsers: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     attributeMapping: z.ZodOptional<z.ZodObject<{
         email: z.ZodDefault<z.ZodString>;
         firstName: z.ZodDefault<z.ZodString>;
         lastName: z.ZodDefault<z.ZodString>;
         displayName: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+    organizationUnitMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        directoryValue: z.ZodString;
+        organizationUnitId: z.ZodString;
+    }, z.core.$strip>>>>;
+    defaultUnitRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    scimEndpointUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;
-export declare const scimProvisioningConfigPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+export declare const scimProvisioningConfigPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    scimEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoCreateUsers: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
-    defaultRole: z.ZodOptional<z.ZodString>;
+    autoDeactivateUsers: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     attributeMapping: z.ZodOptional<z.ZodObject<{
         email: z.ZodDefault<z.ZodString>;
         firstName: z.ZodDefault<z.ZodString>;
         lastName: z.ZodDefault<z.ZodString>;
         displayName: z.ZodDefault<z.ZodString>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>;
+    organizationUnitMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodObject<{
+        directoryValue: z.ZodString;
+        organizationUnitId: z.ZodString;
+    }, z.core.$strip>>>>;
+    defaultUnitRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    scimEndpointUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=scim-provisioning-config.shared.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,0BAA0B;;;;;uCAKrC,CAAC;AAGH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;uCAY3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;wCAMvD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}