@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts

@@ -22,17 +22,17 @@ export declare const SSOAuditLevel: {
 };
 export declare const SsoConfigBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         requireSSO: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         allowPasswordFallback: z.ZodDefault<z.ZodBoolean>;
         enforceForAdmins: z.ZodDefault<z.ZodBoolean>;
         graceLoginAttempts: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>>;
     domains: z.ZodObject<{
-        verifiedDomains: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        ssoEnabledDomains: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        verifiedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         domainHinting: z.ZodDefault<z.ZodBoolean>;
-        allowExternalDomains: z.ZodDefault<z.ZodBoolean>;
+        allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         domainVerificationStatus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
@@ -40,29 +40,29 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
             readonly EXPIRED: "expired";
         }>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    provisioning: z.ZodObject<{
+    }, z.core.$strip>;
+    provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
         autoUpdateUsers: z.ZodDefault<z.ZodBoolean>;
         autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
         defaultRole: z.ZodOptional<z.ZodString>;
         requiredAttributes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    sessionSettings: z.ZodObject<{
+    }, z.core.$strip>>;
+    sessionSettings: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         ssoSessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
         requireReauthForSensitive: z.ZodDefault<z.ZodBoolean>;
         singleLogoutEnabled: z.ZodDefault<z.ZodBoolean>;
         maxConcurrentSessions: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    auditConfig: z.ZodObject<{
+    }, z.core.$strip>>;
+    auditConfig: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         logAllSSOEvents: z.ZodDefault<z.ZodBoolean>;
         logProviderSwitching: z.ZodDefault<z.ZodBoolean>;
         logRoleMapping: z.ZodDefault<z.ZodBoolean>;
         complianceReporting: z.ZodDefault<z.ZodBoolean>;
         retentionDays: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    emergencyAccess: z.ZodObject<{
+    }, z.core.$strip>>;
+    emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         requireApproval: z.ZodDefault<z.ZodBoolean>;
@@ -72,36 +72,36 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
             readonly STANDARD: "standard";
             readonly VERBOSE: "verbose";
         }>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    oauth2ProviderRestrictions: z.ZodObject<{
+    }, z.core.$strip>>;
+    oauth2ProviderRestrictions: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         allowedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;
         blockedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;
         requireEnterpriseSSOOnly: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
     socialCredentialOverrides: z.ZodDefault<z.ZodArray<z.ZodObject<{
         providerRef: z.ZodString;
         clientId: z.ZodString;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         signedJwtKeyId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
         signedJwtTeamId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    }, z.core.$strip>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;
-export declare const ssoConfigPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+export declare const ssoConfigPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         requireSSO: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         allowPasswordFallback: z.ZodDefault<z.ZodBoolean>;
         enforceForAdmins: z.ZodDefault<z.ZodBoolean>;
         graceLoginAttempts: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+    }, z.core.$strip>>>;
     domains: z.ZodObject<{
-        verifiedDomains: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        ssoEnabledDomains: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        verifiedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         domainHinting: z.ZodDefault<z.ZodBoolean>;
-        allowExternalDomains: z.ZodDefault<z.ZodBoolean>;
+        allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         domainVerificationStatus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
@@ -109,29 +109,29 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../../index.js"
             readonly EXPIRED: "expired";
         }>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    provisioning: z.ZodObject<{
+    }, z.core.$strip>;
+    provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
         autoUpdateUsers: z.ZodDefault<z.ZodBoolean>;
         autoDeactivateUsers: z.ZodDefault<z.ZodBoolean>;
         defaultRole: z.ZodOptional<z.ZodString>;
         requiredAttributes: z.ZodDefault<z.ZodArray<z.ZodString>>;
         syncFrequencyHours: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    sessionSettings: z.ZodObject<{
+    }, z.core.$strip>>;
+    sessionSettings: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         ssoSessionDurationMinutes: z.ZodDefault<z.ZodNumber>;
         requireReauthForSensitive: z.ZodDefault<z.ZodBoolean>;
         singleLogoutEnabled: z.ZodDefault<z.ZodBoolean>;
         maxConcurrentSessions: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    auditConfig: z.ZodObject<{
+    }, z.core.$strip>>;
+    auditConfig: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         logAllSSOEvents: z.ZodDefault<z.ZodBoolean>;
         logProviderSwitching: z.ZodDefault<z.ZodBoolean>;
         logRoleMapping: z.ZodDefault<z.ZodBoolean>;
         complianceReporting: z.ZodDefault<z.ZodBoolean>;
         retentionDays: z.ZodDefault<z.ZodNumber>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    emergencyAccess: z.ZodObject<{
+    }, z.core.$strip>>;
+    emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodString>>;
         requireApproval: z.ZodDefault<z.ZodBoolean>;
@@ -141,20 +141,20 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../../index.js"
             readonly STANDARD: "standard";
             readonly VERBOSE: "verbose";
         }>>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
-    oauth2ProviderRestrictions: z.ZodObject<{
+    }, z.core.$strip>>;
+    oauth2ProviderRestrictions: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         allowedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;
         blockedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;
         requireEnterpriseSSOOnly: z.ZodDefault<z.ZodBoolean>;
-    }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip>>;
     socialCredentialOverrides: z.ZodDefault<z.ZodArray<z.ZodObject<{
         providerRef: z.ZodString;
         clientId: z.ZodString;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         signedJwtKeyId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
         signedJwtTeamId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
-    }, z.core.$strip, core.$ZodObjectExtra>>>;
+    }, z.core.$strip>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=sso-config.shared.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA4F9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAM1C,CAAC"}
+{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js

@@ -24,17 +24,41 @@ export const SSOAuditLevel = {
 };
 export const SsoConfigBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────
+    // Every block below decides WHO may authenticate into this tenant and with what standing, so a
+    // change to one is an authorization change even though no role is named: weakening `requireSSO`,
+    // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a
+    // break-glass account each widen access tenant-wide. The generic resource-operation audit event
+    // records the changed field NAMES for free; the marker is what makes the before/after VALUES
+    // survive, and without values "someone changed the SSO enforcement" proves nothing.
+    //
+    // These are configuration flags, domains and role names — NOT personal data — so recording their
+    // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps
+    // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be
+    // scrubbed).
+    //
+    // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are
+    // permitted to authenticate at all.
     enforcement: z.object({
         requireSSO: z.boolean().default(false).isSummaryField(),
         allowPasswordFallback: z.boolean().default(true),
         enforceForAdmins: z.boolean().default(true),
         graceLoginAttempts: z.number().min(0).max(10).default(3),
-    }).isSummaryField(),
+    }).isSummaryField().isAuditEvidence(),
+    // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is
+    // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object
+    // before/after, so marking `domains` would copy live verification tokens into audit rows that
+    // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant
+    // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which
+    // keeps the secret out by construction rather than by reviewer vigilance.
+    //
+    // Read this before marking any other container: a block is safe to mark WHOLESALE only when no
+    // descendant is `.isBackendOnly()` or personal data.
     domains: z.object({
-        verifiedDomains: z.array(z.string()).default([]),
-        ssoEnabledDomains: z.array(z.string()).default([]),
+        verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),
+        ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),
         domainHinting: z.boolean().default(true),
-        allowExternalDomains: z.boolean().default(false),
+        allowExternalDomains: z.boolean().default(false).isAuditEvidence(),
         domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}),
         domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),
     }),
@@ -45,32 +69,37 @@ export const SsoConfigBaseSchema = z.object({
         defaultRole: z.string().optional(),
         requiredAttributes: z.array(z.string()).default(['email']),
         syncFrequencyHours: z.number().min(1).max(168).default(24),
-    }),
+    }).isAuditEvidence(),
     sessionSettings: z.object({
         ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),
         requireReauthForSensitive: z.boolean().default(true),
         singleLogoutEnabled: z.boolean().default(true),
         maxConcurrentSessions: z.number().min(1).max(50).default(5),
-    }),
+    }).isAuditEvidence(),
+    // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or
+    // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the
+    // one change the trail cannot evidence.
+    // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.
     auditConfig: z.object({
         logAllSSOEvents: z.boolean().default(true),
         logProviderSwitching: z.boolean().default(true),
         logRoleMapping: z.boolean().default(true),
         complianceReporting: z.boolean().default(false),
         retentionDays: z.number().min(1).max(2555).default(365),
-    }),
+    }).isAuditEvidence(),
+    // `breakGlassAccounts` is an authority LIST — adding an entry grants emergency bypass.
     emergencyAccess: z.object({
         enabled: z.boolean().default(true),
         breakGlassAccounts: z.array(z.string()).default([]),
         requireApproval: z.boolean().default(true),
         maxDurationHours: z.number().min(1).max(72).default(24),
         auditLevel: z.enum(SSOAuditLevel).default(SSOAuditLevel.VERBOSE),
-    }),
+    }).isAuditEvidence(),
     oauth2ProviderRestrictions: z.object({
         allowedProviders: z.array(z.string()).default([]),
         blockedProviders: z.array(z.string()).default([]),
         requireEnterpriseSSOOnly: z.boolean().default(false),
-    }),
+    }).isAuditEvidence(),
     /**
      * Per-scope social provider credential overrides (P3).
      *
@@ -87,8 +116,19 @@ export const SsoConfigBaseSchema = z.object({
      * Developer Team ID and Key ID that are bound to the private key.
      * When omitted, the app-level values from the secrets store are used.
      *
-     * All secret fields are `.isBackendOnly()` — never sent to the frontend.
-     * The UPDATE custom-impl merges them from the existing record on save.
+     * Secret handling (two distinct contracts, on purpose):
+     * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it
+     *   stays writable AND stays in the response DTO where the framework redacts it to
+     *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`
+     *   via `readAsSystem`) keep the real value.
+     * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the
+     *   frontend at all (stripped from every client DTO).
+     *
+     * Because these secrets live inside an ARRAY, neither the central write-only-secret
+     * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository
+     * replaces the entire array with no deep merge. The UPDATE custom-impl therefore
+     * matches each incoming override to the stored record by `providerRef` and
+     * re-injects any secret that arrived absent or as the `••••••••` mask.
      *
      * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c
      * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler
@@ -96,7 +136,7 @@ export const SsoConfigBaseSchema = z.object({
     socialCredentialOverrides: z.array(z.object({
         providerRef: z.string().min(1),
         clientId: z.string().min(1),
-        clientSecret: z.string().min(1).isBackendOnly(),
+        clientSecret: z.string().min(1).isWriteOnlySecret(),
         signedJwtKeyId: z.string().optional().isBackendOnly(),
         signedJwtTeamId: z.string().optional().isBackendOnly(),
     })).default([]).refine((arr) => new Set(arr.map(o => o.providerRef)).size === arr.length, { message: 'Duplicate providerRef in socialCredentialOverrides' }),
@@ -110,4 +150,4 @@ export const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({
     baseSchema: SsoConfigBaseSchema,
     variants: AUTH_SCOPE_VARIANTS,
 });
-//# sourceMappingURL=sso-config.shared.schemas.js.map
+//# sourceMappingURL=sso-config.shared.schemas.js.map

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE;IAEnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAChD,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC;IAEF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC;IAEF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC;IAEF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC;KACjE,CAAC;IAEF,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}
+{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC;KACjE,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SSOAuditLevel = {\n  MINIMAL: 'minimal',\n  STANDARD: 'standard',\n  VERBOSE: 'verbose',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    enforceForAdmins: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n  // keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    domainHinting: z.boolean().default(true),\n    allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}),\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  provisioning: z.object({\n    autoCreateUsers: z.boolean().default(true),\n    autoUpdateUsers: z.boolean().default(true),\n    autoDeactivateUsers: z.boolean().default(false),\n    defaultRole: z.string().optional(),\n    requiredAttributes: z.array(z.string()).default(['email']),\n    syncFrequencyHours: z.number().min(1).max(168).default(24),\n  }).isAuditEvidence(),\n\n  sessionSettings: z.object({\n    ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n    requireReauthForSensitive: z.boolean().default(true),\n    singleLogoutEnabled: z.boolean().default(true),\n    maxConcurrentSessions: z.number().min(1).max(50).default(5),\n  }).isAuditEvidence(),\n\n  // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n  // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n  // one change the trail cannot evidence.\n  // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n  auditConfig: z.object({\n    logAllSSOEvents: z.boolean().default(true),\n    logProviderSwitching: z.boolean().default(true),\n    logRoleMapping: z.boolean().default(true),\n    complianceReporting: z.boolean().default(false),\n    retentionDays: z.number().min(1).max(2555).default(365),\n  }).isAuditEvidence(),\n\n  // `breakGlassAccounts` is an authority LIST — adding an entry grants emergency bypass.\n  emergencyAccess: z.object({\n    enabled: z.boolean().default(true),\n    breakGlassAccounts: z.array(z.string()).default([]),\n    requireApproval: z.boolean().default(true),\n    maxDurationHours: z.number().min(1).max(72).default(24),\n    auditLevel: z.enum(SSOAuditLevel).default(SSOAuditLevel.VERBOSE),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts

@@ -6,17 +6,89 @@
  *   ...ssoConnectionPolymorphicFactories
  */
 import { z } from 'zod';
-import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
+import { SsoProtocol } from './sso-connection.shared.schemas';
 export declare enum SsoConnection_Operations {
     TEST_CONNECTION = "testConnection",
     DISCOVER_ENDPOINTS = "discoverEndpoints"
 }
-export declare const SsoConnection_TestConnectionRequestDto: z.ZodObject<{
-    connectionId: z.ZodOptional<z.ZodString>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const SsoConnection_DiscoverEndpointsRequestDto: z.ZodObject<{
+/** Final SAML diagnostic posture after all configured checks complete. */
+export declare enum SsoConnectionTestOverallStatus {
+    PASS = "pass",
+    WARNING = "warning",
+    FAIL = "fail"
+}
+/** Evidence source that produced a supported endpoint-discovery result. */
+export declare enum SsoConnectionDiscoverySource {
+    SAML_METADATA = "saml-metadata"
+}
+/**
+ * TEST_CONNECTION addresses the connection through the resource URL. It has no
+ * independent query/body input: accepting a second `connectionId` let callers
+ * provide two identities while the service always used `utils.currentObject`.
+ */
+export declare const SsoConnection_TestConnectionRequestDto: z.ZodObject<{}, z.core.$strict>;
+/**
+ * Metadata discovery needs at least one protocol-specific source. The union
+ * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
+ * runtime; an object with both sources remains valid and SAML metadata takes
+ * precedence until OIDC discovery is implemented.
+ */
+export declare const SsoConnection_DiscoverEndpointsRequestDto: z.ZodUnion<readonly [z.ZodObject<{
+    metadataUrl: z.ZodURL;
     issuerUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>, z.ZodObject<{
+    issuerUrl: z.ZodURL;
     metadataUrl: z.ZodOptional<z.ZodURL>;
-}, z.core.$strip, core.$ZodObjectExtra>;
-export declare const ssoConnectionPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof SsoConnection_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+}, z.core.$strict>]>;
+/**
+ * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a
+ * real implementation; OIDC deliberately reports its unavailable test path as
+ * data instead of returning an ambiguous `{ message }` success payload.
+ */
+export declare const SsoConnection_TestConnectionResponseDto: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocol: z.ZodLiteral<SsoProtocol.SAML>;
+    supported: z.ZodLiteral<true>;
+    entityIdConfigured: z.ZodBoolean;
+    ssoUrlReachable: z.ZodBoolean;
+    ssoUrlStatus: z.ZodOptional<z.ZodNumber>;
+    certificates: z.ZodArray<z.ZodObject<{
+        index: z.ZodNumber;
+        valid: z.ZodBoolean;
+        expiresAt: z.ZodString;
+        daysRemaining: z.ZodNumber;
+        algorithm: z.ZodString;
+        fingerprint: z.ZodString;
+        warnings: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    sloUrlReachable: z.ZodOptional<z.ZodBoolean>;
+    sloUrlStatus: z.ZodOptional<z.ZodNumber>;
+    spMetadataValid: z.ZodBoolean;
+    overallStatus: z.ZodEnum<typeof SsoConnectionTestOverallStatus>;
+    errors: z.ZodArray<z.ZodString>;
+    warnings: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<SsoProtocol.OIDC>;
+    supported: z.ZodLiteral<false>;
+    message: z.ZodString;
+}, z.core.$strict>], "protocol">;
+/**
+ * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns
+ * discovered metadata only; it never persists or enriches a connection row.
+ */
+export declare const SsoConnection_DiscoverEndpointsResponseDto: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocol: z.ZodLiteral<SsoProtocol.SAML>;
+    supported: z.ZodLiteral<true>;
+    entityId: z.ZodString;
+    ssoUrl: z.ZodURL;
+    sloUrl: z.ZodOptional<z.ZodURL>;
+    x509Certificates: z.ZodArray<z.ZodString>;
+    nameIdFormat: z.ZodOptional<z.ZodString>;
+    source: z.ZodLiteral<SsoConnectionDiscoverySource>;
+}, z.core.$strict>, z.ZodObject<{
+    protocol: z.ZodLiteral<SsoProtocol.OIDC>;
+    supported: z.ZodLiteral<false>;
+    message: z.ZodString;
+}, z.core.$strict>], "protocol">;
+export declare const ssoConnectionPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof SsoConnection_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=sso-connection.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAID,eAAO,MAAM,sCAAsC;;uCAEjD,CAAC;AAEH,eAAO,MAAM,yCAAyC;;;uCAGpD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QAgG7C,CAAC"}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;gCAoBlD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}