npm - @wildo-ai/saas-models - Versions diffs - 1.0.1 → 1.1.1 - Mend

@wildo-ai/saas-models 1.0.1 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1282) hide show

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts CHANGED Viewed

@@ -3,16 +3,17 @@
  *
  * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).
  * Unified resource — `protocol` field determines which sub-object is populated.
- * SAML fields are defined but the protocol engine is NOT IMPLEMENTED (DEFERRED AUTH-2).
+ * Both OIDC and SAML protocol engines consume this shared discriminator.
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
  * @see auth-data-model-audit.md §2B
  */
 import { z } from 'zod';
-export declare const SSOProtocol: {
-    readonly OIDC: "oidc";
-    readonly SAML: "saml";
-};
+/** Interactive single-sign-on protocols supported by an SSO connection. */
+export declare enum SsoProtocol {
+    OIDC = "oidc",
+    SAML = "saml"
+}
 export declare const SSOTemplateMode: {
     readonly TEMPLATE: "template";
     readonly DISCOVERY: "discovery";
@@ -46,18 +47,15 @@ export declare const SamlNameIdFormat: {
 };
 export declare const SsoConnectionBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<{
-        readonly OIDC: "oidc";
-        readonly SAML: "saml";
-    }>>;
+    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof SsoProtocol>>;
     externalProviderId: z.ZodOptional<z.ZodString>;
     displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    isDefault: z.ZodDefault<z.ZodBoolean>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
+    isDefault: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     saml: z.ZodOptional<z.ZodObject<{
-        entityId: z.ZodString;
-        ssoUrl: z.ZodURL;
-        sloUrl: z.ZodOptional<z.ZodURL>;
+        entityId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+        ssoUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodURL>;
+        sloUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         x509CertificatePem: z.ZodOptional<z.ZodString>;
         x509Certificates: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodString>>;
         attributeMapping: z.ZodObject<{
@@ -68,53 +66,53 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             department: z.ZodOptional<z.ZodString>;
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-        signRequests: z.ZodDefault<z.ZodBoolean>;
-        wantAssertionsSigned: z.ZodDefault<z.ZodBoolean>;
-        allowedClockDrift: z.ZodDefault<z.ZodNumber>;
-        forceAuthn: z.ZodDefault<z.ZodBoolean>;
-        maxAuthAge: z.ZodOptional<z.ZodNumber>;
-        nameIdFormat: z.ZodDefault<z.ZodEnum<{
+        }, z.core.$strip>;
+        signRequests: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        wantAssertionsSigned: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+        forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
             readonly PERSISTENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
-        }>>;
-        allowIdpInitiated: z.ZodDefault<z.ZodBoolean>;
+        }>>>;
+        allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         auditSettings: z.ZodObject<{
             logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
             logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
             retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
-        templateMode: z.ZodDefault<z.ZodEnum<{
+        templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly TEMPLATE: "template";
             readonly DISCOVERY: "discovery";
             readonly MANUAL: "manual";
-        }>>;
-        templateOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        customScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        discoveryUrl: z.ZodOptional<z.ZodURL>;
-        issuer: z.ZodOptional<z.ZodURL>;
-        authorizationEndpoint: z.ZodOptional<z.ZodURL>;
-        tokenEndpoint: z.ZodOptional<z.ZodURL>;
-        userInfoEndpoint: z.ZodOptional<z.ZodURL>;
-        jwksUri: z.ZodOptional<z.ZodURL>;
-        endSessionEndpoint: z.ZodOptional<z.ZodURL>;
-        clientId: z.ZodString;
+        }>>>;
+        templateOverrides: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        customScopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        discoveryUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        issuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        authorizationEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        tokenEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        userInfoEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        jwksUri: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        endSessionEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        clientId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        responseType: z.ZodDefault<z.ZodEnum<{
+        scopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        responseType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly CODE: "code";
             readonly ID_TOKEN: "id_token";
             readonly TOKEN: "token";
-        }>>;
-        responseMode: z.ZodOptional<z.ZodEnum<{
+        }>>>;
+        responseMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{
             readonly QUERY: "query";
             readonly FRAGMENT: "fragment";
             readonly FORM_POST: "form_post";
-        }>>;
+        }>>>;
         claimsMapping: z.ZodObject<{
             email: z.ZodDefault<z.ZodString>;
             firstName: z.ZodDefault<z.ZodString>;
@@ -123,55 +121,52 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             department: z.ZodOptional<z.ZodString>;
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-        validateIssuer: z.ZodDefault<z.ZodBoolean>;
-        validateAudience: z.ZodDefault<z.ZodBoolean>;
-        clockTolerance: z.ZodDefault<z.ZodNumber>;
-        acrValues: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        maxAge: z.ZodOptional<z.ZodNumber>;
-        prompt: z.ZodOptional<z.ZodEnum<{
+        }, z.core.$strip>;
+        validateIssuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        validateAudience: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        clockTolerance: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+        acrValues: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        maxAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        prompt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{
             readonly NONE: "none";
             readonly LOGIN: "login";
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
-        }>>;
-        pkceEnabled: z.ZodDefault<z.ZodBoolean>;
-        pkceMethod: z.ZodDefault<z.ZodEnum<{
+        }>>>;
+        pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
-        }>>;
+        }>>>;
         auditSettings: z.ZodObject<{
             logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
             logTokenExchange: z.ZodDefault<z.ZodBoolean>;
             logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
             retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: z.ZodDefault<z.ZodBoolean>;
-    defaultRole: z.ZodOptional<z.ZodString>;
-    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    roleMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    groupMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>;
+}, z.core.$strip>;
 export type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;
-export declare const ssoConnectionPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+export declare const ssoConnectionPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
-    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<{
-        readonly OIDC: "oidc";
-        readonly SAML: "saml";
-    }>>;
+    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<typeof SsoProtocol>>;
     externalProviderId: z.ZodOptional<z.ZodString>;
     displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-    isDefault: z.ZodDefault<z.ZodBoolean>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
+    isDefault: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     saml: z.ZodOptional<z.ZodObject<{
-        entityId: z.ZodString;
-        ssoUrl: z.ZodURL;
-        sloUrl: z.ZodOptional<z.ZodURL>;
+        entityId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+        ssoUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodURL>;
+        sloUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
         x509CertificatePem: z.ZodOptional<z.ZodString>;
         x509Certificates: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodString>>;
         attributeMapping: z.ZodObject<{
@@ -182,53 +177,53 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../../index
             department: z.ZodOptional<z.ZodString>;
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-        signRequests: z.ZodDefault<z.ZodBoolean>;
-        wantAssertionsSigned: z.ZodDefault<z.ZodBoolean>;
-        allowedClockDrift: z.ZodDefault<z.ZodNumber>;
-        forceAuthn: z.ZodDefault<z.ZodBoolean>;
-        maxAuthAge: z.ZodOptional<z.ZodNumber>;
-        nameIdFormat: z.ZodDefault<z.ZodEnum<{
+        }, z.core.$strip>;
+        signRequests: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        wantAssertionsSigned: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+        forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
             readonly PERSISTENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
-        }>>;
-        allowIdpInitiated: z.ZodDefault<z.ZodBoolean>;
+        }>>>;
+        allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         auditSettings: z.ZodObject<{
             logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
             logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
             retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
-        templateMode: z.ZodDefault<z.ZodEnum<{
+        templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly TEMPLATE: "template";
             readonly DISCOVERY: "discovery";
             readonly MANUAL: "manual";
-        }>>;
-        templateOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-        customScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        discoveryUrl: z.ZodOptional<z.ZodURL>;
-        issuer: z.ZodOptional<z.ZodURL>;
-        authorizationEndpoint: z.ZodOptional<z.ZodURL>;
-        tokenEndpoint: z.ZodOptional<z.ZodURL>;
-        userInfoEndpoint: z.ZodOptional<z.ZodURL>;
-        jwksUri: z.ZodOptional<z.ZodURL>;
-        endSessionEndpoint: z.ZodOptional<z.ZodURL>;
-        clientId: z.ZodString;
+        }>>>;
+        templateOverrides: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+        customScopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        discoveryUrl: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        issuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        authorizationEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        tokenEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        userInfoEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        jwksUri: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        endSessionEndpoint: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodURL>>;
+        clientId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
         clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
-        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        responseType: z.ZodDefault<z.ZodEnum<{
+        scopes: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+        responseType: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly CODE: "code";
             readonly ID_TOKEN: "id_token";
             readonly TOKEN: "token";
-        }>>;
-        responseMode: z.ZodOptional<z.ZodEnum<{
+        }>>>;
+        responseMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{
             readonly QUERY: "query";
             readonly FRAGMENT: "fragment";
             readonly FORM_POST: "form_post";
-        }>>;
+        }>>>;
         claimsMapping: z.ZodObject<{
             email: z.ZodDefault<z.ZodString>;
             firstName: z.ZodDefault<z.ZodString>;
@@ -237,38 +232,38 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../../index
             department: z.ZodOptional<z.ZodString>;
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-        validateIssuer: z.ZodDefault<z.ZodBoolean>;
-        validateAudience: z.ZodDefault<z.ZodBoolean>;
-        clockTolerance: z.ZodDefault<z.ZodNumber>;
-        acrValues: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        maxAge: z.ZodOptional<z.ZodNumber>;
-        prompt: z.ZodOptional<z.ZodEnum<{
+        }, z.core.$strip>;
+        validateIssuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        validateAudience: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        clockTolerance: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
+        acrValues: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
+        maxAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        prompt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{
             readonly NONE: "none";
             readonly LOGIN: "login";
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
-        }>>;
-        pkceEnabled: z.ZodDefault<z.ZodBoolean>;
-        pkceMethod: z.ZodDefault<z.ZodEnum<{
+        }>>>;
+        pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+        pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
-        }>>;
+        }>>>;
         auditSettings: z.ZodObject<{
             logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
             logTokenExchange: z.ZodDefault<z.ZodBoolean>;
             logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
             retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip, core.$ZodObjectExtra>;
-    }, z.core.$strip, core.$ZodObjectExtra>>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: z.ZodDefault<z.ZodBoolean>;
-    defaultRole: z.ZodOptional<z.ZodString>;
-    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
-    roleMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    groupMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
-}, z.core.$strip, core.$ZodObjectExtra>>;
+}, z.core.$strip>>;
 //# sourceMappingURL=sso-connection.shared.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,~~eAAO~~,~~MAAM~~,WAAW~~;;;CAGd~~,~~CAAC~~;~~AAEX~~,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA2FlC~~,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAM9C~~,CAAC"}
1	+ {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqJlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js CHANGED Viewed

@@ -3,18 +3,20 @@
  *
  * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).
  * Unified resource — `protocol` field determines which sub-object is populated.
- * SAML fields are defined but the protocol engine is NOT IMPLEMENTED (DEFERRED AUTH-2).
+ * Both OIDC and SAML protocol engines consume this shared discriminator.
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
  * @see auth-data-model-audit.md §2B
  */
 import { z } from 'zod';
 import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
-import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
-export const SSOProtocol = {
-    OIDC: 'oidc',
-    SAML: 'saml',
-};
+import { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas.js';
+/** Interactive single-sign-on protocols supported by an SSO connection. */
+export var SsoProtocol;
+(function (SsoProtocol) {
+    SsoProtocol["OIDC"] = "oidc";
+    SsoProtocol["SAML"] = "saml";
+})(SsoProtocol || (SsoProtocol = {}));
 export const SSOTemplateMode = {
     TEMPLATE: 'template',
     DISCOVERY: 'discovery',
@@ -48,15 +50,34 @@ export const SamlNameIdFormat = {
 };
 export const SsoConnectionBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
-    protocol: z.enum(SSOProtocol).isSummaryField(),
+    protocol: z.enum(SsoProtocol).isSummaryField(),
     externalProviderId: z.string().min(1).optional(),
     displayName: z.string().min(1).isSummaryField(),
-    enabled: z.boolean().default(true).isSummaryField(),
-    isDefault: z.boolean().default(false),
+    // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides
+    // which IdP silently receives logins. Marked individually rather than on any parent: this
+    // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records
+    // the WHOLE object into rows that replicate to an unerasable ledger.
+    // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP
+    // decide which identity provider is trusted to authenticate this tenant.
+    enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),
+    isDefault: z.boolean().default(false).isAuditEvidence(),
+    // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates
+    // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,
+    // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,
+    // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed
+    // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a
+    // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the
+    // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the
+    // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /
+    // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of
+    // nesting only, so a marker there would be inert.
+    // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay
+    // validation posture decide which provider is trusted to authenticate this tenant and whether its
+    // assertions are actually verified.
     saml: z.object({
-        entityId: z.string().min(1),
-        ssoUrl: z.url(),
-        sloUrl: z.url().optional(),
+        entityId: z.string().min(1).isAuditEvidence(),
+        ssoUrl: z.url().isAuditEvidence(),
+        sloUrl: z.url().optional().isAuditEvidence(),
         /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */
         x509CertificatePem: z.string().min(1).optional(),
         x509Certificates: z.array(z.string()).min(1).isBackendOnly(),
@@ -69,35 +90,65 @@ export const SsoConnectionBaseSchema = z.object({
             employeeId: z.string().optional(),
             groups: z.string().optional(),
         }),
-        signRequests: z.boolean().default(true),
-        wantAssertionsSigned: z.boolean().default(true),
-        allowedClockDrift: z.number().min(0).max(300).default(30),
-        forceAuthn: z.boolean().default(false),
-        maxAuthAge: z.number().min(0).optional(),
-        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS),
-        allowIdpInitiated: z.boolean().default(false),
+        signRequests: z.boolean().default(true).isAuditEvidence(),
+        wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),
+        allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),
+        forceAuthn: z.boolean().default(false).isAuditEvidence(),
+        maxAuthAge: z.number().min(0).optional().isAuditEvidence(),
+        nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),
+        allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),
         auditSettings: z.object({
             logAuthAttempts: z.boolean().default(true),
             logAttributeMapping: z.boolean().default(true),
             retentionDays: z.number().min(1).max(2555).default(90),
         }),
     }).optional(),
+    // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection
+    // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /
+    // `clientId`) and HOW strictly it validates tokens (`validateIssuer`, `validateAudience`,
+    // `clockTolerance`, `pkceEnabled`, `pkceMethod`), plus what it requests (`scopes` / `customScopes` /
+    // `responseType` / `responseMode` / template + auth-request shaping). Turning `validateIssuer` /
+    // `validateAudience` / `pkceEnabled` off, or repointing `issuer` / `jwksUri`, silently breaks the
+    // token trust chain, so a reviewer must see the before/after. `clientSecret` is NEVER marked (it is
+    // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's
+    // one-level reach.
+    // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-
+    // validation posture decide which provider is trusted and whether its tokens are actually verified.
     oidc: z.object({
-        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL),
-        templateOverrides: z.record(z.string(), z.string()).optional(),
-        customScopes: z.array(z.string()).optional(),
-        discoveryUrl: z.url().optional(),
-        issuer: z.url().optional(),
-        authorizationEndpoint: z.url().optional(),
-        tokenEndpoint: z.url().optional(),
-        userInfoEndpoint: z.url().optional(),
-        jwksUri: z.url().optional(),
-        endSessionEndpoint: z.url().optional(),
-        clientId: z.string().min(1),
-        clientSecret: z.string().min(1).isBackendOnly(),
-        scopes: z.array(z.string()).default(['openid', 'email', 'profile']),
-        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE),
-        responseMode: z.enum(SSOResponseMode).optional(),
+        templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),
+        templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),
+        customScopes: z.array(z.string()).optional().isAuditEvidence(),
+        discoveryUrl: z.url().optional().isAuditEvidence(),
+        issuer: z.url().optional().isAuditEvidence(),
+        authorizationEndpoint: z.url().optional().isAuditEvidence(),
+        tokenEndpoint: z.url().optional().isAuditEvidence(),
+        userInfoEndpoint: z.url().optional().isAuditEvidence(),
+        jwksUri: z.url().optional().isAuditEvidence(),
+        endSessionEndpoint: z.url().optional().isAuditEvidence(),
+        clientId: z.string().min(1).isAuditEvidence(),
+        /**
+         * OIDC/OAuth2 client secret issued by the IdP, used by the backend token
+         * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to
+         * authenticate this connection at the provider's token endpoint.
+         *
+         * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:
+         * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it
+         * stays in the response DTO so the UI renders a masked placeholder, but the
+         * framework redacts it to `••••••••` at the client-serialization boundary only
+         * — internal reads (`servicesRegistryHandler.read` during token exchange) keep
+         * the real value. Do NOT use `.isBackendOnly()`: that strips the field from
+         * every client DTO, so the operator could never supply it.
+         *
+         * Preservation on UPDATE is NOT automatic here: this is a nested field, and the
+         * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a
+         * round-tripped mask must be re-injected from the stored record by the SSO
+         * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The
+         * central sentinel-strip only preserves TOP-LEVEL write-only secrets.
+         */
+        clientSecret: z.string().min(1).isWriteOnlySecret(),
+        scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),
+        responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),
+        responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),
         claimsMapping: z.object({
             email: z.string().default('email'),
             firstName: z.string().default('given_name'),
@@ -107,14 +158,14 @@ export const SsoConnectionBaseSchema = z.object({
             employeeId: z.string().optional(),
             groups: z.string().optional(),
         }),
-        validateIssuer: z.boolean().default(true),
-        validateAudience: z.boolean().default(true),
-        clockTolerance: z.number().min(0).max(300).default(30),
-        acrValues: z.array(z.string()).optional(),
-        maxAge: z.number().min(0).optional(),
-        prompt: z.enum(SSOPrompt).optional(),
-        pkceEnabled: z.boolean().default(true),
-        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256),
+        validateIssuer: z.boolean().default(true).isAuditEvidence(),
+        validateAudience: z.boolean().default(true).isAuditEvidence(),
+        clockTolerance: z.number().min(0).max(300).default(30).isAuditEvidence(),
+        acrValues: z.array(z.string()).optional().isAuditEvidence(),
+        maxAge: z.number().min(0).optional().isAuditEvidence(),
+        prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),
+        pkceEnabled: z.boolean().default(true).isAuditEvidence(),
+        pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),
         auditSettings: z.object({
             logAuthAttempts: z.boolean().default(true),
             logTokenExchange: z.boolean().default(true),
@@ -125,11 +176,20 @@ export const SsoConnectionBaseSchema = z.object({
     autoCreateUsers: z.boolean().default(true),
     autoVerifyEmail: z.boolean().default(true),
     /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */
-    bypassAppMFA: z.boolean().default(false),
-    defaultRole: z.string().optional(),
-    allowedDomains: z.array(z.string()).default([]).isDBIndexed(),
-    roleMapping: z.record(z.string(), z.string()).optional(),
-    groupMapping: z.record(z.string(), z.array(z.string())).optional(),
+    // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who
+    // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.
+    bypassAppMFA: z.boolean().default(false).isAuditEvidence(),
+    // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`
+    // and the two mappings decide what authority an externally-authenticated identity lands with,
+    // and `allowedDomains` decides whose identities the connection will accept at all. A change
+    // here is an authorization change; the field NAME alone cannot evidence it.
+    // The values are role names and domains — configuration, not personal data.
+    // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an
+    // externally-authenticated identity lands with, and whose identities are accepted.
+    defaultRole: z.string().optional().isAuditEvidence(),
+    allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),
+    roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),
+    groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
 });
@@ -138,6 +198,8 @@ export const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({
     baseFieldIdentifier: 'ssoConnectionId',
     baseEnumKey: 'SSO_CONNECTIONS',
     baseSchema: SsoConnectionBaseSchema,
-    variants: AUTH_SCOPE_VARIANTS,
+    // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the
+    // polymorphism engine's singleton-per-scope business-key auto-default.
+    variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),
 });
-//# sourceMappingURL=sso-connection.shared.schemas.js.map
+//# sourceMappingURL=sso-connection.shared.schemas.js.map