@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js

@@ -11,20 +11,173 @@
 import { z } from 'zod';
 import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
 import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
+import { CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
+import { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls.js';
+import { DomainVerificationStatus } from '../sso/sso-config.shared.schemas.js';
+import { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared.js';
+/**
+ * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a
+ * path expression resolved against the SCIM body at push time by the backend
+ * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload
+ * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.
+ * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never
+ * customises this behaves identically to the hardcoded normalisation it replaces.
+ *
+ * Supported path grammar (what `resolveScimAttributePath` understands):
+ * - dotted traversal — `name.givenName`
+ * - array index — `emails[0].value`
+ * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;
+ *   also `emails[type eq "work"].value`) — the SCIM-style selector the spec examples use.
+ */
 export const ScimAttributeMappingSchema = z.object({
     email: z.string().default('emails[0].value'),
     firstName: z.string().default('name.givenName'),
     lastName: z.string().default('name.familyName'),
     displayName: z.string().default('displayName'),
 });
+/**
+ * The scope FKs the polymorphism engine injects onto the two variants. Declared here
+ * (rather than read off a variant schema) because this BASE schema's virtual fields run
+ * for both variants and must discover which scope the row belongs to at read time.
+ */
+const SCIM_SCOPE_FK_TO_SSO_CONFIG = [
+    ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],
+    ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],
+];
 export const ScimProvisioningConfigBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    scimEnabled: z.boolean().default(false).isSummaryField(),
-    autoCreateUsers: z.boolean().default(true),
+    // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a
+    // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —
+    // the authority the app-global MOUNT gate and the SCIM controller auth gate
+    // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and
+    // the invite-accept credential block key instead on per-org ACTIVE management (the
+    // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /
+    // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope
+    // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from
+    // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.
+    // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do
+    // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM
+    // provisions through an internal execution context, so it is NOT bounded by any caller's role
+    // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is
+    // exactly the class of change an auditor must be able to reconstruct with before/after values.
+    // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.
+    // None of these is personal data — they are flags and role names — so recording their values
+    // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.
+    // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and
+    // deprovision access.
+    autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),
     autoVerifyEmail: z.boolean().default(true),
-    autoDeactivateUsers: z.boolean().default(true),
-    defaultRole: z.string().optional(),
+    autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),
+    defaultRole: z.string().optional().isAuditEvidence(),
     attributeMapping: ScimAttributeMappingSchema.optional(),
+    /**
+     * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.
+     *
+     * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority
+     * for which unit a member belongs to.
+     *
+     * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a
+     * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique
+     * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.
+     * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.
+     *
+     * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push
+     * replaces the member's assignments with exactly what the directory says, so leaving a department
+     * actually revokes its access — and assignments made BY HAND in the application are removed too.
+     * An organization that wants manual unit assignments should leave this empty. Reconciliation only
+     * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}
+     * is set, so an organization that never opted in can never have assignments deleted by a push.
+     */
+    // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments
+    // (see the warning above), so the mapping list is an authorization surface, not preferences.
+    organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),
+    /**
+     * The role every SCIM-created unit assignment carries.
+     *
+     * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the
+     * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over
+     * different row sets; one field meaning both would merge two scopes that the whole narrowing model
+     * exists to keep apart.
+     *
+     * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a
+     * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which
+     * is organization-admin-gated. Treat configuring it as granting the role.
+     */
+    // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the
+    // JSDoc above says it plainly: treat configuring it as granting the role.
+    defaultUnitRole: z.string().optional().isAuditEvidence(),
+    /**
+     * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.
+     *
+     * VIRTUAL (computed per read, never persisted, never accepted on write) because it is
+     * derived deployment routing — not tenant data. Storing it would let a row drift from the
+     * route the server actually mounts, which is precisely the class of lie this field replaces:
+     * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,
+     * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from
+     * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a
+     * future mount change moves this field with it instead of stranding a literal.
+     *
+     * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,
+     * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —
+     * unreachable from this shared package without inverting the dependency direction. `publicUrl`
+     * is also optional, so an absolute form would frequently resolve to nothing. Callers that need
+     * the absolute endpoint compose it against their own API base (the frontend already knows it).
+     *
+     * Identical on both scope variants: the SCIM controller mounts ONE app-global router and
+     * separates tenants by bearer token, not by path.
+     */
+    scimEndpointUrl: z.string().optional().isVirtual({
+        calculate: () => `${MAIN_API_BASE_PATH}/scim/v2`,
+    }),
+    /**
+     * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at
+     * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile
+     * whose email domain is absent from this list.
+     *
+     * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are
+     * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row
+     * would denormalize a security-relevant allow-list and let it go stale against the owner —
+     * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path
+     * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS
+     * verification has actually passed, so `verifiedDomains` is filtered by
+     * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`
+     * union used by domain→org lookup — widening this list would widen a security gate.
+     *
+     * `[]` and `undefined` are DISTINCT and both meaningful:
+     * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement
+     *   check is skipped entirely when the list is empty). This is the honest reading of the value.
+     * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here
+     *   would render an unread config as "unrestricted", overstating what we know.
+     *
+     * Fail-safe: never throws — this is a display mirror, not the enforcement point.
+     */
+    allowedDomains: z.array(z.string()).optional().isVirtual({
+        dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),
+        calculate: async ({ currentObject, utils }) => {
+            const row = currentObject;
+            const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG
+                .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))
+                .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);
+            if (!scope)
+                return undefined;
+            const scopeId = String(scope.value);
+            const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);
+            if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function')
+                return undefined;
+            try {
+                const rowsByScopeId = await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);
+                const domains = rowsByScopeId.get(scopeId)?.['domains'];
+                if (!domains)
+                    return undefined;
+                const verificationStatus = domains.domainVerificationStatus ?? {};
+                return (domains.verifiedDomains ?? []).filter((domain) => verificationStatus[domain] === DomainVerificationStatus.VERIFIED);
+            }
+            catch (error) {
+                utils?.logger?.warn?.(`[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`, error);
+                return undefined;
+            }
+        },
+    }),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
 });
@@ -35,4 +188,4 @@ export const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSc
     baseSchema: ScimProvisioningConfigBaseSchema,
     variants: AUTH_SCOPE_VARIANTS,
 });
-//# sourceMappingURL=scim-provisioning-config.shared.schemas.js.map
+//# sourceMappingURL=scim-provisioning-config.shared.schemas.js.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;IACxD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,kBAAkB,UAAU;KACjD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,MAAM,kBAAkB,GAAG,OAAO,CAAC,wBAAwB,IAAI,EAAE,CAAC;gBAClE,OAAO,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC7E,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { DomainVerificationStatus } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => `${MAIN_API_BASE_PATH}/scim/v2`,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        const verificationStatus = domains.domainVerificationStatus ?? {};\n        return (domains.verifiedDomains ?? []).filter(\n          (domain) => verificationStatus[domain] === DomainVerificationStatus.VERIFIED,\n        );\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts

@@ -1,12 +1,12 @@
 /**
  * SCIM Tokens Resource Configuration — Polymorphic
  *
- * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Produces the organization-scoped factory used by the SCIM bearer protocol.
  * Spread into the registry factory map:
  *   ...scimTokensPolymorphicFactories
  */
 import { z } from 'zod';
-import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
 export declare enum ScimTokens_Operations {
     GENERATE_TOKEN = "generateToken",
     REVOKE_TOKEN = "revokeToken",
@@ -14,12 +14,24 @@ export declare enum ScimTokens_Operations {
 }
 export declare const ScimTokens_GenerateTokenRequestDto: z.ZodObject<{
     displayName: z.ZodString;
-    description: z.ZodOptional<z.ZodString>;
     expiresAt: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const ScimTokens_RevokeTokenRequestDto: z.ZodObject<{}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const ScimTokens_RotateTokenRequestDto: z.ZodObject<{
-    overlapHours: z.ZodDefault<z.ZodNumber>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const scimTokensPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof ScimTokens_Operations, CoreResourceOperation.READ | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+}, z.core.$strict>;
+export declare const ScimTokens_RevokeTokenRequestDto: z.ZodObject<{}, z.core.$strict>;
+/**
+ * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.
+ * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.
+ */
+export declare const ScimTokens_RotateTokenRequestDto: z.ZodObject<{}, z.core.$strict>;
+export declare const ScimTokens_RevokeTokenResponseDto: z.ZodObject<{
+    isActive: z.ZodBoolean;
+    revokedAt: z.ZodDate;
+    message: z.ZodString;
+}, z.core.$strict>;
+export declare const ScimTokens_RotateTokenResponseDto: z.ZodObject<{
+    newToken: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    newTokenId: z.ZodString;
+    newTokenHash: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strict>;
+export declare const scimTokensPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof ScimTokens_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=scim-tokens.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;;uCAI7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,sDAAe,CAAC;AAE7D,eAAO,MAAM,gCAAgC;;uCAE3C,CAAC;AAIH,eAAO,MAAM,8BAA8B,0OAiG1C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQA8J1C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js

@@ -1,16 +1,17 @@
 /**
  * SCIM Tokens Resource Configuration — Polymorphic
  *
- * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Produces the organization-scoped factory used by the SCIM bearer protocol.
  * Spread into the registry factory map:
  *   ...scimTokensPolymorphicFactories
  */
 import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
-import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
-import { scimTokensPolymorphicDeclaration } from './scim-tokens.shared.schemas.js';
+import { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas.js';
+import { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var ScimTokens_Operations;
 (function (ScimTokens_Operations) {
@@ -19,33 +20,60 @@ export var ScimTokens_Operations;
     ScimTokens_Operations["ROTATE_TOKEN"] = "rotateToken";
 })(ScimTokens_Operations || (ScimTokens_Operations = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
-export const ScimTokens_GenerateTokenRequestDto = z.object({
+export const ScimTokens_GenerateTokenRequestDto = z.strictObject({
     displayName: z.string().min(1),
-    description: z.string().optional(),
     expiresAt: z.string().datetime().optional(),
 });
-export const ScimTokens_RevokeTokenRequestDto = z.object({});
-export const ScimTokens_RotateTokenRequestDto = z.object({
-    overlapHours: z.number().min(0).max(72).default(0),
+export const ScimTokens_RevokeTokenRequestDto = z.strictObject({});
+/**
+ * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.
+ * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.
+ */
+export const ScimTokens_RotateTokenRequestDto = z.strictObject({});
+export const ScimTokens_RevokeTokenResponseDto = z.strictObject({
+    isActive: z.boolean(),
+    revokedAt: z.date(),
+    message: z.string(),
+});
+export const ScimTokens_RotateTokenResponseDto = z.strictObject({
+    newToken: z.string().isEphemeral(),
+    newTokenId: z.string(),
+    newTokenHash: z.string(),
+    message: z.string(),
 });
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(scimTokensPolymorphicDeclaration, {
     isSystemResource: true,
     customOperation: ScimTokens_Operations,
+    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`
+    // on EVERY /scim/v2/* request via a system-context read (see
+    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`
+    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS
+    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the
+    // enterprise SSO-connection resolver's pre-auth read.
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+    },
     coreOperations: [
         CoreResourceOperation.READ,
         CoreResourceOperation.LIST,
         CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
         CoreResourceOperation.DELETE,
     ],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).
+                    // The bearer-auth token lookup reads this through the service layer
+                    // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which
+                    // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a
+                    // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`
+                    // and 500s every SCIM request. Same fix as the SSO-connection READ.
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
@@ -56,7 +84,6 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
@@ -67,18 +94,32 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).
+                    // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on
+                    // every /scim/v2/* request via a fire-and-forget system-context update. Without a
+                    // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`
+                    // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is
+                    // internal-only; operators rotate/revoke via the dedicated custom ops.
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
         [CoreResourceOperation.DELETE]: {
             variants: [{
                     variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
@@ -89,11 +130,23 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     resourceOperationLike: CoreResourceOperation.CREATE,
                     requestDto: ScimTokens_GenerateTokenRequestDto,
+                    // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the
+                    // SCIM bearer-auth middleware resolves inbound tokens by their persisted
+                    // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.
+                    // This mirrors the api-key mint contract exactly: the response DTO is the
+                    // resource schema extended with an ephemeral secret field — NOT a bespoke
+                    // shape. The mint runs as a CREATE prefix (injects `tokenHash` +
+                    // `createdByUserId` so the core create persists) + postfix (attaches the
+                    // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.
+                    // `token` is `.isEphemeral()` (secret display, revealed once, not
+                    // persisted — same decorator api-key `plainKey` uses).
+                    customResponseDto: ScimTokenBaseSchema.extend({
+                        token: z.string().isEphemeral(),
+                    }),
                 }],
         },
         [ScimTokens_Operations.REVOKE_TOKEN]: {
@@ -102,11 +155,19 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
-                    resourceOperationLike: CoreResourceOperation.DELETE,
+                    resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: ScimTokens_RevokeTokenRequestDto,
+                    // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for
+                    // audit and merely flips `isActive` to false — so the borrowed core op must be a
+                    // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the
+                    // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core
+                    // DELETE deleted the token before the handler could intervene — the same
+                    // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The
+                    // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a
+                    // revocation acknowledgement, NOT the SCIM-token resource row.
+                    customResponseDto: ScimTokens_RevokeTokenResponseDto,
                 }],
         },
         [ScimTokens_Operations.ROTATE_TOKEN]: {
@@ -115,13 +176,26 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
-                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: ScimTokens_RotateTokenRequestDto,
+                    // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's
+                    // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —
+                    // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by
+                    // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.
+                    // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.
+                    // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially
+                    // revealed, not editable), mirroring api-key `plainKey`.
+                    //
+                    // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace
+                    // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an
+                    // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops
+                    // authenticating at once. Do not expose a migration-window request or response until a
+                    // real persisted grace-slot contract exists.
+                    customResponseDto: ScimTokens_RotateTokenResponseDto,
                 }],
         },
     },
 });
-//# sourceMappingURL=scim-tokens.shared.resources-config.schemas.js.map
+//# sourceMappingURL=scim-tokens.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,gCAAgC,EAAE,MAAM,8BAA8B,CAAC;AAEhF,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;iBAC/C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;iBAC7C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;iBAC7C,CAAC;SACH;KACF;CACF,CACF,CAAC"}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;qBAChC,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Tokens Resource Configuration — Polymorphic\n *\n * Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n *   ...scimTokensPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n  GENERATE_TOKEN = 'generateToken',\n  REVOKE_TOKEN = 'revokeToken',\n  ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n  displayName: z.string().min(1),\n  expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/**\n * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n */\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n  isActive: z.boolean(),\n  revokedAt: z.date(),\n  message: z.string(),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n  newToken: z.string().isEphemeral(),\n  newTokenId: z.string(),\n  newTokenHash: z.string(),\n  message: z.string(),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimTokensPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: ScimTokens_Operations,\n    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n    // on EVERY /scim/v2/* request via a system-context read (see\n    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n    // enterprise SSO-connection resolver's pre-auth read.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The bearer-auth token lookup reads this through the service layer\n          // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n          // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n          // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // and 500s every SCIM request. Same fix as the SSO-connection READ.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n          // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n          // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n          // internal-only; operators rotate/revoke via the dedicated custom ops.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [ScimTokens_Operations.GENERATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: ScimTokens_GenerateTokenRequestDto,\n          // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n          // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n          // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n          // This mirrors the api-key mint contract exactly: the response DTO is the\n          // resource schema extended with an ephemeral secret field — NOT a bespoke\n          // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n          // `createdByUserId` so the core create persists) + postfix (attaches the\n          // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n          // `token` is `.isEphemeral()` (secret display, revealed once, not\n          // persisted — same decorator api-key `plainKey` uses).\n          customResponseDto: ScimTokenBaseSchema.extend({\n            token: z.string().isEphemeral(),\n          }),\n        }],\n      },\n      [ScimTokens_Operations.REVOKE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RevokeTokenRequestDto,\n          // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n          // audit and merely flips `isActive` to false — so the borrowed core op must be a\n          // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n          // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n          // DELETE deleted the token before the handler could intervene — the same\n          // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n          // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n          // revocation acknowledgement, NOT the SCIM-token resource row.\n          customResponseDto: ScimTokens_RevokeTokenResponseDto,\n        }],\n      },\n      [ScimTokens_Operations.ROTATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RotateTokenRequestDto,\n          // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n          // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n          // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n          // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n          // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n          // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n          // revealed, not editable), mirroring api-key `plainKey`.\n          //\n          // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n          // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n          // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n          // authenticating at once. Do not expose a migration-window request or response until a\n          // real persisted grace-slot contract exists.\n          customResponseDto: ScimTokens_RotateTokenResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts

@@ -3,7 +3,8 @@
  *
  * API bearer tokens for SCIM provisioning endpoints.
  * Naturally flat — no structural nesting needed.
- * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ * The organization scope FK is injected by the polymorphism engine. There is deliberately
+ * no application variant because the current SCIM protocol is tenant-scoped.
  *
  * Field renames from old flat schema: label → displayName, createdBy → createdByUserId.
  *
@@ -12,25 +13,25 @@
 import { z } from 'zod';
 export declare const ScimTokenBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    tokenHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    tokenHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    createdByUserId: z.ZodString;
+    createdByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastUsedAt: z.ZodOptional<z.ZodDate>;
     expiresAt: z.ZodOptional<z.ZodDate>;
-    isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type ScimTokenBase = z.infer<typeof ScimTokenBaseSchema>;
-export declare const scimTokensPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+export declare const scimTokensPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    tokenHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    tokenHash: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
     displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    createdByUserId: z.ZodString;
+    createdByUserId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     lastUsedAt: z.ZodOptional<z.ZodDate>;
     expiresAt: z.ZodOptional<z.ZodDate>;
-    isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    isActive: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=scim-tokens.shared.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-tokens.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,mBAAmB;;;;;;;;;;uCAY9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;wCAM3C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,mBAAmB;;;;;;;;;;iBA0B9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,gCAAgC;;;;;;;;;;kBAY3C,CAAC"}