@wildo-ai/saas-models 1.0.1

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js

@@ -0,0 +1,113 @@
+/**
+ * SSO Config Schema (Shared) — Polymorphic
+ *
+ * SSO enforcement, domain verification, provider restrictions, provisioning,
+ * session settings, emergency access. Policy/settings layer only —
+ * provider connections are a separate resource (SsoConnection).
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2A
+ */
+import { z } from 'zod';
+import { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas.js';
+import { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas.js';
+export const DomainVerificationStatus = {
+    PENDING: 'pending',
+    VERIFIED: 'verified',
+    FAILED: 'failed',
+    EXPIRED: 'expired',
+};
+export const SSOAuditLevel = {
+    MINIMAL: 'minimal',
+    STANDARD: 'standard',
+    VERBOSE: 'verbose',
+};
+export const SsoConfigBaseSchema = z.object({
+    _id: z.string().min(1).isPrimaryKey().isSummaryField(),
+    enforcement: z.object({
+        requireSSO: z.boolean().default(false).isSummaryField(),
+        allowPasswordFallback: z.boolean().default(true),
+        enforceForAdmins: z.boolean().default(true),
+        graceLoginAttempts: z.number().min(0).max(10).default(3),
+    }).isSummaryField(),
+    domains: z.object({
+        verifiedDomains: z.array(z.string()).default([]),
+        ssoEnabledDomains: z.array(z.string()).default([]),
+        domainHinting: z.boolean().default(true),
+        allowExternalDomains: z.boolean().default(false),
+        domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}),
+        domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),
+    }),
+    provisioning: z.object({
+        autoCreateUsers: z.boolean().default(true),
+        autoUpdateUsers: z.boolean().default(true),
+        autoDeactivateUsers: z.boolean().default(false),
+        defaultRole: z.string().optional(),
+        requiredAttributes: z.array(z.string()).default(['email']),
+        syncFrequencyHours: z.number().min(1).max(168).default(24),
+    }),
+    sessionSettings: z.object({
+        ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),
+        requireReauthForSensitive: z.boolean().default(true),
+        singleLogoutEnabled: z.boolean().default(true),
+        maxConcurrentSessions: z.number().min(1).max(50).default(5),
+    }),
+    auditConfig: z.object({
+        logAllSSOEvents: z.boolean().default(true),
+        logProviderSwitching: z.boolean().default(true),
+        logRoleMapping: z.boolean().default(true),
+        complianceReporting: z.boolean().default(false),
+        retentionDays: z.number().min(1).max(2555).default(365),
+    }),
+    emergencyAccess: z.object({
+        enabled: z.boolean().default(true),
+        breakGlassAccounts: z.array(z.string()).default([]),
+        requireApproval: z.boolean().default(true),
+        maxDurationHours: z.number().min(1).max(72).default(24),
+        auditLevel: z.enum(SSOAuditLevel).default(SSOAuditLevel.VERBOSE),
+    }),
+    oauth2ProviderRestrictions: z.object({
+        allowedProviders: z.array(z.string()).default([]),
+        blockedProviders: z.array(z.string()).default([]),
+        requireEnterpriseSSOOnly: z.boolean().default(false),
+    }),
+    /**
+     * Per-scope social provider credential overrides (P3).
+     *
+     * By default, social providers (Google, GitHub, Apple, etc.) use platform-level
+     * OAuth2 credentials from AppConfiguration. This array lets an org/app override
+     * those with their own registered OAuth2 app at the identity provider.
+     *
+     * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2
+     * endpoints, scopes, and profile mapping still come from the provider catalog.
+     *
+     * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use
+     * signed-JWT client secrets (e.g. Apple Sign-In, where the "client secret" is a
+     * short-lived JWT signed with a private key). These correspond to the Apple
+     * Developer Team ID and Key ID that are bound to the private key.
+     * When omitted, the app-level values from the secrets store are used.
+     *
+     * All secret fields are `.isBackendOnly()` — never sent to the frontend.
+     * The UPDATE custom-impl merges them from the existing record on save.
+     *
+     * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c
+     * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler
+     */
+    socialCredentialOverrides: z.array(z.object({
+        providerRef: z.string().min(1),
+        clientId: z.string().min(1),
+        clientSecret: z.string().min(1).isBackendOnly(),
+        signedJwtKeyId: z.string().optional().isBackendOnly(),
+        signedJwtTeamId: z.string().optional().isBackendOnly(),
+    })).default([]).refine((arr) => new Set(arr.map(o => o.providerRef)).size === arr.length, { message: 'Duplicate providerRef in socialCredentialOverrides' }),
+    createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+    updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
+});
+export const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({
+    baseResourceType: 'ssoConfig',
+    baseFieldIdentifier: 'ssoConfigId',
+    baseEnumKey: 'SSO_CONFIG',
+    baseSchema: SsoConfigBaseSchema,
+    variants: AUTH_SCOPE_VARIANTS,
+});
+//# sourceMappingURL=sso-config.shared.schemas.js.map

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE;IAEnB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAChD,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC;IAEF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC;IAEF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC;IAEF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC;KACjE,CAAC;IAEF,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC/C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts

@@ -0,0 +1,22 @@
+/**
+ * SSO Connection Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...ssoConnectionPolymorphicFactories
+ */
+import { z } from 'zod';
+import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions.js';
+export declare enum SsoConnection_Operations {
+    TEST_CONNECTION = "testConnection",
+    DISCOVER_ENDPOINTS = "discoverEndpoints"
+}
+export declare const SsoConnection_TestConnectionRequestDto: z.ZodObject<{
+    connectionId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export declare const SsoConnection_DiscoverEndpointsRequestDto: z.ZodObject<{
+    issuerUrl: z.ZodOptional<z.ZodURL>;
+    metadataUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export declare const ssoConnectionPolymorphicFactories: Record<string, import("../../../index.js").ResourceConfiguration_InitializationFactory<typeof SsoConnection_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
+//# sourceMappingURL=sso-connection.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAW/G,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAID,eAAO,MAAM,sCAAsC;;uCAEjD,CAAC;AAEH,eAAO,MAAM,yCAAyC;;;uCAGpD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QAgG7C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js

@@ -0,0 +1,123 @@
+/**
+ * SSO Connection Resource Configuration — Polymorphic
+ *
+ * Produces 2 factory functions (ORG + APP) via the polymorphic factory.
+ * Spread into the registry factory map:
+ *   ...ssoConnectionPolymorphicFactories
+ */
+import { z } from 'zod';
+import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
+import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
+import { ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas.js';
+// ── Custom Operations ────────────────────────────────────────────────
+export var SsoConnection_Operations;
+(function (SsoConnection_Operations) {
+    SsoConnection_Operations["TEST_CONNECTION"] = "testConnection";
+    SsoConnection_Operations["DISCOVER_ENDPOINTS"] = "discoverEndpoints";
+})(SsoConnection_Operations || (SsoConnection_Operations = {}));
+// ── Request DTOs ─────────────────────────────────────────────────────
+export const SsoConnection_TestConnectionRequestDto = z.object({
+    connectionId: z.string().optional(),
+});
+export const SsoConnection_DiscoverEndpointsRequestDto = z.object({
+    issuerUrl: z.url().optional(),
+    metadataUrl: z.url().optional(),
+});
+// ── Polymorphic Factory ──────────────────────────────────────────────
+export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(ssoConnectionPolymorphicDeclaration, {
+    isSystemResource: true,
+    customOperation: SsoConnection_Operations,
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        CoreResourceOperation.DELETE,
+    ],
+    operationsConfiguration: {
+        [CoreResourceOperation.READ]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                }],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.REPOSITORY_ONLY,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.HIGH,
+                }],
+        },
+        [SsoConnection_Operations.TEST_CONNECTION]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.READ,
+                    requestDto: SsoConnection_TestConnectionRequestDto,
+                }],
+        },
+        [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {
+            variants: [{
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    polymorphicRole: {
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    },
+                    riskLevel: ResourceOperationRiskLevel.MEDIUM,
+                    resourceOperationLike: CoreResourceOperation.CREATE,
+                    requestDto: SsoConnection_DiscoverEndpointsRequestDto,
+                }],
+        },
+    },
+});
+//# sourceMappingURL=sso-connection.shared.resources-config.schemas.js.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEtF,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;iBACnD,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;iBACtD,CAAC;SACH;KACF;CACF,CACF,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts

@@ -0,0 +1,274 @@
+/**
+ * SSO Connection Schema (Shared) — Polymorphic
+ *
+ * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).
+ * Unified resource — `protocol` field determines which sub-object is populated.
+ * SAML fields are defined but the protocol engine is NOT IMPLEMENTED (DEFERRED AUTH-2).
+ * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
+ *
+ * @see auth-data-model-audit.md §2B
+ */
+import { z } from 'zod';
+export declare const SSOProtocol: {
+    readonly OIDC: "oidc";
+    readonly SAML: "saml";
+};
+export declare const SSOTemplateMode: {
+    readonly TEMPLATE: "template";
+    readonly DISCOVERY: "discovery";
+    readonly MANUAL: "manual";
+};
+export declare const SSOResponseType: {
+    readonly CODE: "code";
+    readonly ID_TOKEN: "id_token";
+    readonly TOKEN: "token";
+};
+export declare const SSOResponseMode: {
+    readonly QUERY: "query";
+    readonly FRAGMENT: "fragment";
+    readonly FORM_POST: "form_post";
+};
+export declare const SSOPrompt: {
+    readonly NONE: "none";
+    readonly LOGIN: "login";
+    readonly CONSENT: "consent";
+    readonly SELECT_ACCOUNT: "select_account";
+};
+export declare const SSOPKCEMethod: {
+    readonly S256: "S256";
+    readonly PLAIN: "plain";
+};
+export declare const SamlNameIdFormat: {
+    readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+    readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+    readonly PERSISTENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
+    readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+};
+export declare const SsoConnectionBaseSchema: z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<{
+        readonly OIDC: "oidc";
+        readonly SAML: "saml";
+    }>>;
+    externalProviderId: z.ZodOptional<z.ZodString>;
+    displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    isDefault: z.ZodDefault<z.ZodBoolean>;
+    saml: z.ZodOptional<z.ZodObject<{
+        entityId: z.ZodString;
+        ssoUrl: z.ZodURL;
+        sloUrl: z.ZodOptional<z.ZodURL>;
+        x509CertificatePem: z.ZodOptional<z.ZodString>;
+        x509Certificates: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodString>>;
+        attributeMapping: z.ZodObject<{
+            email: z.ZodDefault<z.ZodString>;
+            firstName: z.ZodDefault<z.ZodString>;
+            lastName: z.ZodDefault<z.ZodString>;
+            roles: z.ZodOptional<z.ZodString>;
+            department: z.ZodOptional<z.ZodString>;
+            employeeId: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+        signRequests: z.ZodDefault<z.ZodBoolean>;
+        wantAssertionsSigned: z.ZodDefault<z.ZodBoolean>;
+        allowedClockDrift: z.ZodDefault<z.ZodNumber>;
+        forceAuthn: z.ZodDefault<z.ZodBoolean>;
+        maxAuthAge: z.ZodOptional<z.ZodNumber>;
+        nameIdFormat: z.ZodDefault<z.ZodEnum<{
+            readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+            readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+            readonly PERSISTENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
+            readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+        }>>;
+        allowIdpInitiated: z.ZodDefault<z.ZodBoolean>;
+        auditSettings: z.ZodObject<{
+            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
+            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
+            retentionDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    oidc: z.ZodOptional<z.ZodObject<{
+        templateMode: z.ZodDefault<z.ZodEnum<{
+            readonly TEMPLATE: "template";
+            readonly DISCOVERY: "discovery";
+            readonly MANUAL: "manual";
+        }>>;
+        templateOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        customScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        discoveryUrl: z.ZodOptional<z.ZodURL>;
+        issuer: z.ZodOptional<z.ZodURL>;
+        authorizationEndpoint: z.ZodOptional<z.ZodURL>;
+        tokenEndpoint: z.ZodOptional<z.ZodURL>;
+        userInfoEndpoint: z.ZodOptional<z.ZodURL>;
+        jwksUri: z.ZodOptional<z.ZodURL>;
+        endSessionEndpoint: z.ZodOptional<z.ZodURL>;
+        clientId: z.ZodString;
+        clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        responseType: z.ZodDefault<z.ZodEnum<{
+            readonly CODE: "code";
+            readonly ID_TOKEN: "id_token";
+            readonly TOKEN: "token";
+        }>>;
+        responseMode: z.ZodOptional<z.ZodEnum<{
+            readonly QUERY: "query";
+            readonly FRAGMENT: "fragment";
+            readonly FORM_POST: "form_post";
+        }>>;
+        claimsMapping: z.ZodObject<{
+            email: z.ZodDefault<z.ZodString>;
+            firstName: z.ZodDefault<z.ZodString>;
+            lastName: z.ZodDefault<z.ZodString>;
+            roles: z.ZodOptional<z.ZodString>;
+            department: z.ZodOptional<z.ZodString>;
+            employeeId: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+        validateIssuer: z.ZodDefault<z.ZodBoolean>;
+        validateAudience: z.ZodDefault<z.ZodBoolean>;
+        clockTolerance: z.ZodDefault<z.ZodNumber>;
+        acrValues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        prompt: z.ZodOptional<z.ZodEnum<{
+            readonly NONE: "none";
+            readonly LOGIN: "login";
+            readonly CONSENT: "consent";
+            readonly SELECT_ACCOUNT: "select_account";
+        }>>;
+        pkceEnabled: z.ZodDefault<z.ZodBoolean>;
+        pkceMethod: z.ZodDefault<z.ZodEnum<{
+            readonly S256: "S256";
+            readonly PLAIN: "plain";
+        }>>;
+        auditSettings: z.ZodObject<{
+            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
+            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
+            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
+            retentionDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
+    bypassAppMFA: z.ZodDefault<z.ZodBoolean>;
+    defaultRole: z.ZodOptional<z.ZodString>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    roleMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    groupMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>;
+export type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;
+export declare const ssoConnectionPolymorphicDeclaration: import("../../../index.js").PolymorphicSchemaDeclaration<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    protocol: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodEnum<{
+        readonly OIDC: "oidc";
+        readonly SAML: "saml";
+    }>>;
+    externalProviderId: z.ZodOptional<z.ZodString>;
+    displayName: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
+    isDefault: z.ZodDefault<z.ZodBoolean>;
+    saml: z.ZodOptional<z.ZodObject<{
+        entityId: z.ZodString;
+        ssoUrl: z.ZodURL;
+        sloUrl: z.ZodOptional<z.ZodURL>;
+        x509CertificatePem: z.ZodOptional<z.ZodString>;
+        x509Certificates: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodArray<z.ZodString>>;
+        attributeMapping: z.ZodObject<{
+            email: z.ZodDefault<z.ZodString>;
+            firstName: z.ZodDefault<z.ZodString>;
+            lastName: z.ZodDefault<z.ZodString>;
+            roles: z.ZodOptional<z.ZodString>;
+            department: z.ZodOptional<z.ZodString>;
+            employeeId: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+        signRequests: z.ZodDefault<z.ZodBoolean>;
+        wantAssertionsSigned: z.ZodDefault<z.ZodBoolean>;
+        allowedClockDrift: z.ZodDefault<z.ZodNumber>;
+        forceAuthn: z.ZodDefault<z.ZodBoolean>;
+        maxAuthAge: z.ZodOptional<z.ZodNumber>;
+        nameIdFormat: z.ZodDefault<z.ZodEnum<{
+            readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
+            readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
+            readonly PERSISTENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent";
+            readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
+        }>>;
+        allowIdpInitiated: z.ZodDefault<z.ZodBoolean>;
+        auditSettings: z.ZodObject<{
+            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
+            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
+            retentionDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    oidc: z.ZodOptional<z.ZodObject<{
+        templateMode: z.ZodDefault<z.ZodEnum<{
+            readonly TEMPLATE: "template";
+            readonly DISCOVERY: "discovery";
+            readonly MANUAL: "manual";
+        }>>;
+        templateOverrides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        customScopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        discoveryUrl: z.ZodOptional<z.ZodURL>;
+        issuer: z.ZodOptional<z.ZodURL>;
+        authorizationEndpoint: z.ZodOptional<z.ZodURL>;
+        tokenEndpoint: z.ZodOptional<z.ZodURL>;
+        userInfoEndpoint: z.ZodOptional<z.ZodURL>;
+        jwksUri: z.ZodOptional<z.ZodURL>;
+        endSessionEndpoint: z.ZodOptional<z.ZodURL>;
+        clientId: z.ZodString;
+        clientSecret: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        responseType: z.ZodDefault<z.ZodEnum<{
+            readonly CODE: "code";
+            readonly ID_TOKEN: "id_token";
+            readonly TOKEN: "token";
+        }>>;
+        responseMode: z.ZodOptional<z.ZodEnum<{
+            readonly QUERY: "query";
+            readonly FRAGMENT: "fragment";
+            readonly FORM_POST: "form_post";
+        }>>;
+        claimsMapping: z.ZodObject<{
+            email: z.ZodDefault<z.ZodString>;
+            firstName: z.ZodDefault<z.ZodString>;
+            lastName: z.ZodDefault<z.ZodString>;
+            roles: z.ZodOptional<z.ZodString>;
+            department: z.ZodOptional<z.ZodString>;
+            employeeId: z.ZodOptional<z.ZodString>;
+            groups: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+        validateIssuer: z.ZodDefault<z.ZodBoolean>;
+        validateAudience: z.ZodDefault<z.ZodBoolean>;
+        clockTolerance: z.ZodDefault<z.ZodNumber>;
+        acrValues: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        maxAge: z.ZodOptional<z.ZodNumber>;
+        prompt: z.ZodOptional<z.ZodEnum<{
+            readonly NONE: "none";
+            readonly LOGIN: "login";
+            readonly CONSENT: "consent";
+            readonly SELECT_ACCOUNT: "select_account";
+        }>>;
+        pkceEnabled: z.ZodDefault<z.ZodBoolean>;
+        pkceMethod: z.ZodDefault<z.ZodEnum<{
+            readonly S256: "S256";
+            readonly PLAIN: "plain";
+        }>>;
+        auditSettings: z.ZodObject<{
+            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
+            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
+            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
+            retentionDays: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip, core.$ZodObjectExtra>;
+    }, z.core.$strip, core.$ZodObjectExtra>>;
+    autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
+    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
+    bypassAppMFA: z.ZodDefault<z.ZodBoolean>;
+    defaultRole: z.ZodOptional<z.ZodString>;
+    allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
+    roleMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    groupMapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
+}, z.core.$strip, core.$ZodObjectExtra>>;
+//# sourceMappingURL=sso-connection.shared.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,WAAW;;;CAGd,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uCA2FlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAM9C,CAAC"}