@wildo-ai/saas-models 1.0.1 → 1.1.0

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js

@@ -8,26 +8,132 @@
 import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
 import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
-import { ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas.js';
+import { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas.js';
 // ── Custom Operations ────────────────────────────────────────────────
 export var SsoConnection_Operations;
 (function (SsoConnection_Operations) {
     SsoConnection_Operations["TEST_CONNECTION"] = "testConnection";
     SsoConnection_Operations["DISCOVER_ENDPOINTS"] = "discoverEndpoints";
 })(SsoConnection_Operations || (SsoConnection_Operations = {}));
+/** Final SAML diagnostic posture after all configured checks complete. */
+export var SsoConnectionTestOverallStatus;
+(function (SsoConnectionTestOverallStatus) {
+    SsoConnectionTestOverallStatus["PASS"] = "pass";
+    SsoConnectionTestOverallStatus["WARNING"] = "warning";
+    SsoConnectionTestOverallStatus["FAIL"] = "fail";
+})(SsoConnectionTestOverallStatus || (SsoConnectionTestOverallStatus = {}));
+/** Evidence source that produced a supported endpoint-discovery result. */
+export var SsoConnectionDiscoverySource;
+(function (SsoConnectionDiscoverySource) {
+    SsoConnectionDiscoverySource["SAML_METADATA"] = "saml-metadata";
+})(SsoConnectionDiscoverySource || (SsoConnectionDiscoverySource = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
-export const SsoConnection_TestConnectionRequestDto = z.object({
-    connectionId: z.string().optional(),
-});
-export const SsoConnection_DiscoverEndpointsRequestDto = z.object({
-    issuerUrl: z.url().optional(),
-    metadataUrl: z.url().optional(),
+/**
+ * TEST_CONNECTION addresses the connection through the resource URL. It has no
+ * independent query/body input: accepting a second `connectionId` let callers
+ * provide two identities while the service always used `utils.currentObject`.
+ */
+export const SsoConnection_TestConnectionRequestDto = z.strictObject({});
+/**
+ * Metadata discovery needs at least one protocol-specific source. The union
+ * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
+ * runtime; an object with both sources remains valid and SAML metadata takes
+ * precedence until OIDC discovery is implemented.
+ */
+export const SsoConnection_DiscoverEndpointsRequestDto = z.union([
+    z.strictObject({
+        metadataUrl: z.url(),
+        issuerUrl: z.url().optional(),
+    }),
+    z.strictObject({
+        issuerUrl: z.url(),
+        metadataUrl: z.url().optional(),
+    }),
+]);
+const SsoConnection_CertificateTestResultDto = z.strictObject({
+    index: z.number().int().nonnegative(),
+    valid: z.boolean(),
+    expiresAt: z.string(),
+    daysRemaining: z.number().int(),
+    algorithm: z.string(),
+    fingerprint: z.string(),
+    warnings: z.array(z.string()),
 });
+/**
+ * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a
+ * real implementation; OIDC deliberately reports its unavailable test path as
+ * data instead of returning an ambiguous `{ message }` success payload.
+ */
+export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [
+    z.strictObject({
+        protocol: z.literal(SsoProtocol.SAML),
+        supported: z.literal(true),
+        entityIdConfigured: z.boolean(),
+        ssoUrlReachable: z.boolean(),
+        ssoUrlStatus: z.number().int().optional(),
+        certificates: z.array(SsoConnection_CertificateTestResultDto),
+        sloUrlReachable: z.boolean().optional(),
+        sloUrlStatus: z.number().int().optional(),
+        spMetadataValid: z.boolean(),
+        overallStatus: z.enum(SsoConnectionTestOverallStatus),
+        errors: z.array(z.string()),
+        warnings: z.array(z.string()),
+    }),
+    z.strictObject({
+        protocol: z.literal(SsoProtocol.OIDC),
+        supported: z.literal(false),
+        message: z.string().min(1),
+    }),
+]);
+/**
+ * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns
+ * discovered metadata only; it never persists or enriches a connection row.
+ */
+export const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [
+    z.strictObject({
+        protocol: z.literal(SsoProtocol.SAML),
+        supported: z.literal(true),
+        entityId: z.string().min(1),
+        ssoUrl: z.url(),
+        sloUrl: z.url().optional(),
+        x509Certificates: z.array(z.string()),
+        nameIdFormat: z.string().optional(),
+        source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),
+    }),
+    z.strictObject({
+        protocol: z.literal(SsoProtocol.OIDC),
+        supported: z.literal(false),
+        message: z.string().min(1),
+    }),
+]);
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(ssoConnectionPolymorphicDeclaration, {
     isSystemResource: true,
+    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC
+    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves
+    // the target connection BEFORE any user is authenticated, so the caller holds
+    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore
+    // reads the connection through the sanctioned request-triggered ACL-bypass
+    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`
+    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in
+    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;
+    // connection mutation stays admin-gated over the HTTP surface. Mirrors the
+    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.
+    //
+    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED
+    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)
+    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is
+    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via
+    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →
+    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO
+    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.
+    systemAccessPolicy: {
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+    },
     customOperation: SsoConnection_Operations,
     coreOperations: [
         CoreResourceOperation.READ,
@@ -38,15 +144,25 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
     ],
     operationsConfiguration: {
         [CoreResourceOperation.READ]: {
-            variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+            variants: [
+                {
+                    // Service-transport default. The enterprise SSO login-initiation
+                    // resolver reads a single connection PRE-AUTH via `readAsSystem`,
+                    // which resolves the READ path through `getServiceOperationPathDefault`
+                    // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a
+                    // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no
+                    // public HTTP surface — admins list connections via the API_CALL LIST)
+                    // gives the system read a resolvable service-transport path. Gated by
+                    // `systemAccessPolicy.read = ALLOWED` above.
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
-                }],
+                }
+            ],
         },
         [CoreResourceOperation.LIST]: {
             variants: [{
@@ -59,9 +175,30 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
         },
+        // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the
+        // service transport is the only tier that carries the connection's write
+        // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`
+        // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.
+        //
+        // As REPOSITORY_ONLY these three were unreachable in both directions: no system
+        // write could resolve a service op-path, AND `doOperation` throws outright on a
+        // REPOSITORY_ONLY operation, so the custom implementations carrying the actual
+        // write semantics never ran — `connectionId` minting, SAML
+        // `x509CertificatePem` → `x509Certificates` normalization, nested
+        // `oidc.clientSecret` write-only-secret preservation, and the DELETE
+        // last-connection / in-use guards. They are now reachable.
+        //
+        // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register
+        // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list
+        // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.
+        //
+        // The `onParentDelete` cascade is unaffected — it deletes through
+        // `childRepository.delete(...)` after a `supportsOperation` check that matches on
+        // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.
+        // That path still bypasses the service tier and the DELETE custom impl by design.
         [CoreResourceOperation.CREATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -72,7 +209,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
         },
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -83,7 +220,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
         },
         [CoreResourceOperation.DELETE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -103,6 +240,9 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.READ,
                     requestDto: SsoConnection_TestConnectionRequestDto,
+                    // Borrows READ for its route/verb but returns protocol-discriminated
+                    // diagnostics, not the SSO-connection row.
+                    customResponseDto: SsoConnection_TestConnectionResponseDto,
                 }],
         },
         [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {
@@ -116,8 +256,11 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
                     resourceOperationLike: CoreResourceOperation.CREATE,
                     requestDto: SsoConnection_DiscoverEndpointsRequestDto,
+                    // Borrows CREATE for its route/verb but returns discovered metadata,
+                    // not a created or updated SSO-connection row.
+                    customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,
                 }],
         },
     },
 });
-//# sourceMappingURL=sso-connection.shared.resources-config.schemas.js.map
+//# sourceMappingURL=sso-connection.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC"}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Connection Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConnectionPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n  TEST_CONNECTION = 'testConnection',\n  DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/** Final SAML diagnostic posture after all configured checks complete. */\nexport enum SsoConnectionTestOverallStatus {\n  PASS = 'pass',\n  WARNING = 'warning',\n  FAIL = 'fail',\n}\n\n/** Evidence source that produced a supported endpoint-discovery result. */\nexport enum SsoConnectionDiscoverySource {\n  SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/**\n * TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n */\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/**\n * Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n */\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n  z.strictObject({\n    metadataUrl: z.url(),\n    issuerUrl: z.url().optional(),\n  }),\n  z.strictObject({\n    issuerUrl: z.url(),\n    metadataUrl: z.url().optional(),\n  }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n  index: z.number().int().nonnegative(),\n  valid: z.boolean(),\n  expiresAt: z.string(),\n  daysRemaining: z.number().int(),\n  algorithm: z.string(),\n  fingerprint: z.string(),\n  warnings: z.array(z.string()),\n});\n\n/**\n * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n */\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityIdConfigured: z.boolean(),\n    ssoUrlReachable: z.boolean(),\n    ssoUrlStatus: z.number().int().optional(),\n    certificates: z.array(SsoConnection_CertificateTestResultDto),\n    sloUrlReachable: z.boolean().optional(),\n    sloUrlStatus: z.number().int().optional(),\n    spMetadataValid: z.boolean(),\n    overallStatus: z.enum(SsoConnectionTestOverallStatus),\n    errors: z.array(z.string()),\n    warnings: z.array(z.string()),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n/**\n * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n */\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityId: z.string().min(1),\n    ssoUrl: z.url(),\n    sloUrl: z.url().optional(),\n    x509Certificates: z.array(z.string()),\n    nameIdFormat: z.string().optional(),\n    source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConnectionPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n    // the target connection BEFORE any user is authenticated, so the caller holds\n    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n    // reads the connection through the sanctioned request-triggered ACL-bypass\n    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n    // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n    //\n    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    customOperation: SsoConnection_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            // Service-transport default. The enterprise SSO login-initiation\n            // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n            // which resolves the READ path through `getServiceOperationPathDefault`\n            // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n            // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n            // public HTTP surface — admins list connections via the API_CALL LIST)\n            // gives the system read a resolvable service-transport path. Gated by\n            // `systemAccessPolicy.read = ALLOWED` above.\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n      // service transport is the only tier that carries the connection's write\n      // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`\n      // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n      //\n      // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n      // write could resolve a service op-path, AND `doOperation` throws outright on a\n      // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n      // write semantics never ran — `connectionId` minting, SAML\n      // `x509CertificatePem` → `x509Certificates` normalization, nested\n      // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n      // last-connection / in-use guards. They are now reachable.\n      //\n      // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n      // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n      // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n      //\n      // The `onParentDelete` cascade is unaffected — it deletes through\n      // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n      // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n      // That path still bypasses the service tier and the DELETE custom impl by design.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SsoConnection_Operations.TEST_CONNECTION]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: SsoConnection_TestConnectionRequestDto,\n          // Borrows READ for its route/verb but returns protocol-discriminated\n          // diagnostics, not the SSO-connection row.\n          customResponseDto: SsoConnection_TestConnectionResponseDto,\n        }],\n      },\n      [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n          // Borrows CREATE for its route/verb but returns discovered metadata,\n          // not a created or updated SSO-connection row.\n          customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}