@wildo-ai/saas-models 1.1.1 → 1.1.3

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts

@@ -15,17 +15,11 @@ export declare const DomainVerificationStatus: {
     readonly FAILED: "failed";
     readonly EXPIRED: "expired";
 };
-export declare const SSOAuditLevel: {
-    readonly MINIMAL: "minimal";
-    readonly STANDARD: "standard";
-    readonly VERBOSE: "verbose";
-};
 export declare const SsoConfigBaseSchema: z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         requireSSO: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         allowPasswordFallback: z.ZodDefault<z.ZodBoolean>;
-        enforceForAdmins: z.ZodDefault<z.ZodBoolean>;
         graceLoginAttempts: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>>;
     domains: z.ZodObject<{
@@ -33,12 +27,12 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
         ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         domainHinting: z.ZodDefault<z.ZodBoolean>;
         allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        domainVerificationStatus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        domainVerificationStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
             readonly FAILED: "failed";
             readonly EXPIRED: "expired";
-        }>>>;
+        }>>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
     }, z.core.$strip>;
     provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
@@ -64,14 +58,7 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
     }, z.core.$strip>>;
     emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        requireApproval: z.ZodDefault<z.ZodBoolean>;
-        maxDurationHours: z.ZodDefault<z.ZodNumber>;
-        auditLevel: z.ZodDefault<z.ZodEnum<{
-            readonly MINIMAL: "minimal";
-            readonly STANDARD: "standard";
-            readonly VERBOSE: "verbose";
-        }>>;
+        breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodEmail>>;
     }, z.core.$strip>>;
     oauth2ProviderRestrictions: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         allowedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;
@@ -89,12 +76,42 @@ export declare const SsoConfigBaseSchema: z.ZodObject<{
     updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
 }, z.core.$strip>;
 export type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;
+/**
+ * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.
+ *
+ * ## Why this exists rather than five correct joins
+ *
+ * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by
+ * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM
+ * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup
+ * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.
+ *
+ * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied
+ * at N sites, where the next site is the one that forgets. It had already happened; it was harmless
+ * only because that reader had no consumer — and claiming a domain is now reachable by tenants
+ * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.
+ *
+ * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for
+ * the verified set finds this; one that reaches for the raw array finds the warning on the field.
+ *
+ * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a
+ * DTO or a lean document can use it — the three existing shapes at the call sites — without the
+ * helper forcing a cast at every one of them.
+ */
+export declare function resolveVerifiedDomains(domains: {
+    readonly verifiedDomains?: readonly string[];
+    readonly domainVerificationStatus?: Readonly<Record<string, string>>;
+} | undefined): string[];
+/** Whether ONE domain is verified for this organization. The single-domain form of the join. */
+export declare function isDomainVerified(domains: {
+    readonly verifiedDomains?: readonly string[];
+    readonly domainVerificationStatus?: Readonly<Record<string, string>>;
+} | undefined, domain: string): boolean;
 export declare const ssoConfigPolymorphicDeclaration: import("../../..").PolymorphicSchemaDeclaration<z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     enforcement: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         requireSSO: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         allowPasswordFallback: z.ZodDefault<z.ZodBoolean>;
-        enforceForAdmins: z.ZodDefault<z.ZodBoolean>;
         graceLoginAttempts: z.ZodDefault<z.ZodNumber>;
     }, z.core.$strip>>>;
     domains: z.ZodObject<{
@@ -102,12 +119,12 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../..").Polymor
         ssoEnabledDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
         domainHinting: z.ZodDefault<z.ZodBoolean>;
         allowExternalDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        domainVerificationStatus: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        domainVerificationStatus: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
             readonly PENDING: "pending";
             readonly VERIFIED: "verified";
             readonly FAILED: "failed";
             readonly EXPIRED: "expired";
-        }>>>;
+        }>>>>;
         domainVerificationTokens: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>>;
     }, z.core.$strip>;
     provisioning: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
@@ -133,14 +150,7 @@ export declare const ssoConfigPolymorphicDeclaration: import("../../..").Polymor
     }, z.core.$strip>>;
     emergencyAccess: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
-        breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodString>>;
-        requireApproval: z.ZodDefault<z.ZodBoolean>;
-        maxDurationHours: z.ZodDefault<z.ZodNumber>;
-        auditLevel: z.ZodDefault<z.ZodEnum<{
-            readonly MINIMAL: "minimal";
-            readonly STANDARD: "standard";
-            readonly VERBOSE: "verbose";
-        }>>;
+        breakGlassAccounts: z.ZodDefault<z.ZodArray<z.ZodEmail>>;
     }, z.core.$strip>>;
     oauth2ProviderRestrictions: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
         allowedProviders: z.ZodDefault<z.ZodArray<z.ZodString>>;

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoI9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}
+{"version":3,"file":"sso-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,wBAAwB;;;;;CAK3B,CAAC;AAEX,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoO9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,GAAG,MAAM,EAAE,CAKvB;AAED,gGAAgG;AAChG,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE;IACP,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,QAAQ,CAAC,wBAAwB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtE,GAAG,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAGT;AAED,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAM1C,CAAC"}

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js

@@ -17,11 +17,6 @@ export const DomainVerificationStatus = {
     FAILED: 'failed',
     EXPIRED: 'expired',
 };
-export const SSOAuditLevel = {
-    MINIMAL: 'minimal',
-    STANDARD: 'standard',
-    VERBOSE: 'verbose',
-};
 export const SsoConfigBaseSchema = z.object({
     _id: z.string().min(1).isPrimaryKey().isSummaryField(),
     // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────
@@ -39,10 +34,27 @@ export const SsoConfigBaseSchema = z.object({
     //
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are
     // permitted to authenticate at all.
+    //
+    // `enforceForAdmins` was REMOVED here (#481). It said "this tenant's SSO requirement also binds
+    // its administrators", defaulted `true`, and was read by nothing — so an operator who set it
+    // `false` believed their administrators had a way in when the IdP broke, and they did not.
+    //
+    // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role
+    // membership changes, and a standing exemption for "whoever is an admin" means compromising one
+    // administrator and promoting an account silently grants an SSO bypass to the promoted one.
+    // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small
+    // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below
+    // now does. Google Workspace does take the role-shaped route for its super administrators; it was
+    // considered and rejected here for the escalation path above.
+    //
+    // spec-cite: Microsoft Entra ID — "Manage emergency access admin accounts"
+    // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),
+    // "Conditional Access considerations": create a dedicated security group for the emergency access
+    // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this
+    // repository's, not a quotation.
     enforcement: z.object({
         requireSSO: z.boolean().default(false).isSummaryField(),
         allowPasswordFallback: z.boolean().default(true),
-        enforceForAdmins: z.boolean().default(true),
         graceLoginAttempts: z.number().min(0).max(10).default(3),
     }).isSummaryField().isAuditEvidence(),
     // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is
@@ -55,11 +67,49 @@ export const SsoConfigBaseSchema = z.object({
     // Read this before marking any other container: a block is safe to mark WHOLESALE only when no
     // descendant is `.isBackendOnly()` or personal data.
     domains: z.object({
+        /**
+         * Every domain this organization has CLAIMED — verified and unverified alike.
+         *
+         * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain
+         * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means
+         * "somebody asked", never "we checked". The real answer is the join with that map, and
+         * `resolveVerifiedDomains` below is the only place it should be computed (#457).
+         *
+         * **Do not read this array directly.** A reader that does gets pending, failed and expired
+         * domains under a name that says otherwise — which `AuthOrganizationConfigurationService
+         * .getDomains` did, returning them as `verified`, with no consumer to notice.
+         *
+         * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an
+         * omission: it is persisted on every SSO config row of both dogfood applications, so the rename
+         * is a schema change plus a data migration for a field whose every reader now goes through the
+         * helper. The name is no longer what a new reader reaches.
+         */
         verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),
         ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),
         domainHinting: z.boolean().default(true),
         allowExternalDomains: z.boolean().default(false).isAuditEvidence(),
-        domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}),
+        /**
+         * The half of the join that decides routing authority — and therefore the audit evidence.
+         *
+         * Marked individually rather than through the containing `domains` block, for the reason that
+         * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the
+         * immutable ledger. This map holds domain names and one of four statuses — no secret, no
+         * personal data — and it is the only field that answers the question an auditor asks about a
+         * domain workflow: WHICH domain became verified, and when did it stop being verified.
+         *
+         * Without it the trail records `domains` as a changed field name and nothing more, which cannot
+         * distinguish "a tenant claimed a domain" from "a tenant gained SSO routing control over every
+         * address at it".
+         */
+        domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),
+        /**
+         * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend
+         * through a resource READ, and never enters the audit trail (see the block comment above).
+         *
+         * The one place its value is disclosed is the response to `claimDomain`, which returns it once
+         * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.
+         * A lost token is recovered by claiming again, which mints a new one — there is no re-read.
+         */
         domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),
     }),
     provisioning: z.object({
@@ -87,13 +137,54 @@ export const SsoConfigBaseSchema = z.object({
         complianceReporting: z.boolean().default(false),
         retentionDays: z.number().min(1).max(2555).default(365),
     }).isAuditEvidence(),
-    // `breakGlassAccounts` is an authority LIST — adding an entry grants emergency bypass.
+    /**
+     * Break-glass: the named accounts that may still sign in with a password when the identity
+     * provider cannot be reached.
+     *
+     * Every field here is READ at runtime. It carried three more — `requireApproval`,
+     * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,
+     * #423) rather than implemented, for reasons worth keeping:
+     *
+     * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where
+     *   nobody can act; an approval step means the approver may be locked out too, which is the
+     *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem
+     *   after each use, never for prior approval.
+     * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and
+     *   is not built. A field that names a control nobody enforces is exactly what this issue was
+     *   about, so it is absent until the session cap exists.
+     * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in
+     *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a
+     *   privileged-access record is not a setting a tenant should have.
+     *
+     * ## What a listed account gets, and what it does not
+     *
+     * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and
+     * nothing else. It authenticates with the same password, against the same lockout counters and
+     * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.
+     *
+     * ## Why the whole TENANT keeps a password field when this list is non-empty
+     *
+     * The sign-in surface must not depend on the account, or the offered methods become an oracle for
+     * "is this address a break-glass account". So `requiresEnterpriseSsoOnly` answers false for the
+     * whole tenant while this list is non-empty: everyone at the domain sees a password field, and
+     * everyone not on the list is refused AFTER presenting a correct credential. The cost is a
+     * password field that only two accounts can use; the alternative discloses who they are.
+     *
+     * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's
+     * own authentication requirement.
+     */
     emergencyAccess: z.object({
+        /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */
         enabled: z.boolean().default(true),
-        breakGlassAccounts: z.array(z.string()).default([]),
-        requireApproval: z.boolean().default(true),
-        maxDurationHours: z.number().min(1).max(72).default(24),
-        auditLevel: z.enum(SSOAuditLevel).default(SSOAuditLevel.VERBOSE),
+        /**
+         * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants
+         * a standing password path into a tenant that has otherwise required SSO.
+         *
+         * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials
+         * stored apart from any individual, and a validation drill every 90 days; none of that is
+         * enforceable from here, and all of it is what makes this list safe to have.
+         */
+        breakGlassAccounts: z.array(z.email()).default([]),
     }).isAuditEvidence(),
     oauth2ProviderRestrictions: z.object({
         allowedProviders: z.array(z.string()).default([]),
@@ -143,6 +234,37 @@ export const SsoConfigBaseSchema = z.object({
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
     updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),
 });
+/**
+ * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.
+ *
+ * ## Why this exists rather than five correct joins
+ *
+ * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by
+ * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM
+ * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup
+ * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.
+ *
+ * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied
+ * at N sites, where the next site is the one that forgets. It had already happened; it was harmless
+ * only because that reader had no consumer — and claiming a domain is now reachable by tenants
+ * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.
+ *
+ * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for
+ * the verified set finds this; one that reaches for the raw array finds the warning on the field.
+ *
+ * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a
+ * DTO or a lean document can use it — the three existing shapes at the call sites — without the
+ * helper forcing a cast at every one of them.
+ */
+export function resolveVerifiedDomains(domains) {
+    const status = domains?.domainVerificationStatus ?? {};
+    return (domains?.verifiedDomains ?? []).filter(domain => status[domain] === DomainVerificationStatus.VERIFIED);
+}
+/** Whether ONE domain is verified for this organization. The single-domain form of the join. */
+export function isDomainVerified(domains, domain) {
+    return (domains?.verifiedDomains ?? []).includes(domain)
+        && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;
+}
 export const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({
     baseResourceType: 'ssoConfig',
     baseFieldIdentifier: 'ssoConfigId',

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5F,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB,uFAAuF;IACvF,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC;KACjE,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SSOAuditLevel = {\n  MINIMAL: 'minimal',\n  STANDARD: 'standard',\n  VERBOSE: 'verbose',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    enforceForAdmins: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n  // keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    domainHinting: z.boolean().default(true),\n    allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}),\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  provisioning: z.object({\n    autoCreateUsers: z.boolean().default(true),\n    autoUpdateUsers: z.boolean().default(true),\n    autoDeactivateUsers: z.boolean().default(false),\n    defaultRole: z.string().optional(),\n    requiredAttributes: z.array(z.string()).default(['email']),\n    syncFrequencyHours: z.number().min(1).max(168).default(24),\n  }).isAuditEvidence(),\n\n  sessionSettings: z.object({\n    ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n    requireReauthForSensitive: z.boolean().default(true),\n    singleLogoutEnabled: z.boolean().default(true),\n    maxConcurrentSessions: z.number().min(1).max(50).default(5),\n  }).isAuditEvidence(),\n\n  // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n  // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n  // one change the trail cannot evidence.\n  // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n  auditConfig: z.object({\n    logAllSSOEvents: z.boolean().default(true),\n    logProviderSwitching: z.boolean().default(true),\n    logRoleMapping: z.boolean().default(true),\n    complianceReporting: z.boolean().default(false),\n    retentionDays: z.number().min(1).max(2555).default(365),\n  }).isAuditEvidence(),\n\n  // `breakGlassAccounts` is an authority LIST — adding an entry grants emergency bypass.\n  emergencyAccess: z.object({\n    enabled: z.boolean().default(true),\n    breakGlassAccounts: z.array(z.string()).default([]),\n    requireApproval: z.boolean().default(true),\n    maxDurationHours: z.number().min(1).max(72).default(24),\n    auditLevel: z.enum(SSOAuditLevel).default(SSOAuditLevel.VERBOSE),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SSO Config Schema (Shared) — Polymorphic\n *\n * SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2A\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n  PENDING: 'pending',\n  VERIFIED: 'verified',\n  FAILED: 'failed',\n  EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n  // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n  // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n  // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n  // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n  // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n  // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n  //\n  // These are configuration flags, domains and role names — NOT personal data — so recording their\n  // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n  // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n  // scrubbed).\n  //\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n  // permitted to authenticate at all.\n  //\n  // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n  // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n  // `false` believed their administrators had a way in when the IdP broke, and they did not.\n  //\n  // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n  // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n  // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n  // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n  // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n  // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n  // considered and rejected here for the escalation path above.\n  //\n  // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n  // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n  // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n  // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n  // repository's, not a quotation.\n  enforcement: z.object({\n    requireSSO: z.boolean().default(false).isSummaryField(),\n    allowPasswordFallback: z.boolean().default(true),\n    graceLoginAttempts: z.number().min(0).max(10).default(3),\n  }).isSummaryField().isAuditEvidence(),\n\n  // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n  // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n  // before/after, so marking `domains` would copy live verification tokens into audit rows that\n  // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n  // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n  // keeps the secret out by construction rather than by reviewer vigilance.\n  //\n  // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n  // descendant is `.isBackendOnly()` or personal data.\n  domains: z.object({\n    /**\n     * Every domain this organization has CLAIMED — verified and unverified alike.\n     *\n     * ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n     * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n     * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n     * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n     *\n     * **Do not read this array directly.** A reader that does gets pending, failed and expired\n     * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n     * .getDomains` did, returning them as `verified`, with no consumer to notice.\n     *\n     * The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n     * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n     * is a schema change plus a data migration for a field whose every reader now goes through the\n     * helper. The name is no longer what a new reader reaches.\n     */\n    verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n    domainHinting: z.boolean().default(true),\n    allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n    /**\n     * The half of the join that decides routing authority — and therefore the audit evidence.\n     *\n     * Marked individually rather than through the containing `domains` block, for the reason that\n     * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n     * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n     * personal data — and it is the only field that answers the question an auditor asks about a\n     * domain workflow: WHICH domain became verified, and when did it stop being verified.\n     *\n     * Without it the trail records `domains` as a changed field name and nothing more, which cannot\n     * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n     * address at it\".\n     */\n    domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n    /**\n     * The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n     * through a resource READ, and never enters the audit trail (see the block comment above).\n     *\n     * The one place its value is disclosed is the response to `claimDomain`, which returns it once\n     * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n     * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n     */\n    domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n  }),\n\n  provisioning: z.object({\n    autoCreateUsers: z.boolean().default(true),\n    autoUpdateUsers: z.boolean().default(true),\n    autoDeactivateUsers: z.boolean().default(false),\n    defaultRole: z.string().optional(),\n    requiredAttributes: z.array(z.string()).default(['email']),\n    syncFrequencyHours: z.number().min(1).max(168).default(24),\n  }).isAuditEvidence(),\n\n  sessionSettings: z.object({\n    ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n    requireReauthForSensitive: z.boolean().default(true),\n    singleLogoutEnabled: z.boolean().default(true),\n    maxConcurrentSessions: z.number().min(1).max(50).default(5),\n  }).isAuditEvidence(),\n\n  // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n  // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n  // one change the trail cannot evidence.\n  // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n  auditConfig: z.object({\n    logAllSSOEvents: z.boolean().default(true),\n    logProviderSwitching: z.boolean().default(true),\n    logRoleMapping: z.boolean().default(true),\n    complianceReporting: z.boolean().default(false),\n    retentionDays: z.number().min(1).max(2555).default(365),\n  }).isAuditEvidence(),\n\n  /**\n   * Break-glass: the named accounts that may still sign in with a password when the identity\n   * provider cannot be reached.\n   *\n   * Every field here is READ at runtime. It carried three more — `requireApproval`,\n   * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n   * #423) rather than implemented, for reasons worth keeping:\n   *\n   * - **`requireApproval` cannot exist on this path.** Break-glass is the door for the case where\n   *   nobody can act; an approval step means the approver may be locked out too, which is the\n   *   deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n   *   after each use, never for prior approval.\n   * - **`maxDurationHours`** describes a bounded break-glass SESSION, which is a real control and\n   *   is not built. A field that names a control nobody enforces is exactly what this issue was\n   *   about, so it is absent until the session cap exists.\n   * - **`auditLevel`** could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n   *   `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n   *   privileged-access record is not a setting a tenant should have.\n   *\n   * ## What a listed account gets, and what it does not\n   *\n   * A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n   * nothing else. It authenticates with the same password, against the same lockout counters and\n   * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n   *\n   * ## Why the whole TENANT keeps a password field when this list is non-empty\n   *\n   * The sign-in surface must not depend on the account, or the offered methods become an oracle for\n   * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n   * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n   * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n   * password field that only two accounts can use; the alternative discloses who they are.\n   *\n   * assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n   * own authentication requirement.\n   */\n  emergencyAccess: z.object({\n    /** Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. */\n    enabled: z.boolean().default(true),\n    /**\n     * The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n     * a standing password path into a tenant that has otherwise required SSO.\n     *\n     * Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n     * stored apart from any individual, and a validation drill every 90 days; none of that is\n     * enforceable from here, and all of it is what makes this list safe to have.\n     */\n    breakGlassAccounts: z.array(z.email()).default([]),\n  }).isAuditEvidence(),\n\n  oauth2ProviderRestrictions: z.object({\n    allowedProviders: z.array(z.string()).default([]),\n    blockedProviders: z.array(z.string()).default([]),\n    requireEnterpriseSSOOnly: z.boolean().default(false),\n  }).isAuditEvidence(),\n\n  /**\n   * Per-scope social provider credential overrides (P3).\n   *\n   * By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n   * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n   * those with their own registered OAuth2 app at the identity provider.\n   *\n   * Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n   * endpoints, scopes, and profile mapping still come from the provider catalog.\n   *\n   * `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n   * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n   * short-lived JWT signed with a private key). These correspond to the Apple\n   * Developer Team ID and Key ID that are bound to the private key.\n   * When omitted, the app-level values from the secrets store are used.\n   *\n   * Secret handling (two distinct contracts, on purpose):\n   * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n   *   stays writable AND stays in the response DTO where the framework redacts it to\n   *   `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n   *   via `readAsSystem`) keep the real value.\n   * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n   *   frontend at all (stripped from every client DTO).\n   *\n   * Because these secrets live inside an ARRAY, neither the central write-only-secret\n   * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n   * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n   * matches each incoming override to the stored record by `providerRef` and\n   * re-injects any secret that arrived absent or as the `••••••••` mask.\n   *\n   * @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n   * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n   */\n  socialCredentialOverrides: z.array(z.object({\n    providerRef: z.string().min(1),\n    clientId: z.string().min(1),\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    signedJwtKeyId: z.string().optional().isBackendOnly(),\n    signedJwtTeamId: z.string().optional().isBackendOnly(),\n  })).default([]).refine(\n    (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n    { message: 'Duplicate providerRef in socialCredentialOverrides' },\n  ),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/**\n * The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n *\n * ## Why this exists rather than five correct joins\n *\n * The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, **five** reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n *\n * That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n *\n * So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n *\n * Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n */\nexport function resolveVerifiedDomains(domains: {\n  readonly verifiedDomains?: readonly string[];\n  readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} | undefined): string[] {\n  const status = domains?.domainVerificationStatus ?? {};\n  return (domains?.verifiedDomains ?? []).filter(\n    domain => status[domain] === DomainVerificationStatus.VERIFIED,\n  );\n}\n\n/** Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n  domains: {\n    readonly verifiedDomains?: readonly string[];\n    readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n  } | undefined,\n  domain: string,\n): boolean {\n  return (domains?.verifiedDomains ?? []).includes(domain)\n    && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConfig',\n  baseFieldIdentifier: 'ssoConfigId',\n  baseEnumKey: 'SSO_CONFIG',\n  baseSchema: SsoConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts

@@ -122,9 +122,6 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
-        validateIssuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        validateAudience: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        clockTolerance: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         acrValues: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
         maxAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
         prompt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{
@@ -233,9 +230,6 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             employeeId: z.ZodOptional<z.ZodString>;
             groups: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>;
-        validateIssuer: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        validateAudience: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        clockTolerance: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         acrValues: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodArray<z.ZodString>>>;
         maxAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
         prompt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodEnum<{

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqJlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}
+{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8JlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js

@@ -105,11 +105,12 @@ export const SsoConnectionBaseSchema = z.object({
     }).optional(),
     // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection
     // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /
-    // `clientId`) and HOW strictly it validates tokens (`validateIssuer`, `validateAudience`,
-    // `clockTolerance`, `pkceEnabled`, `pkceMethod`), plus what it requests (`scopes` / `customScopes` /
-    // `responseType` / `responseMode` / template + auth-request shaping). Turning `validateIssuer` /
-    // `validateAudience` / `pkceEnabled` off, or repointing `issuer` / `jwksUri`, silently breaks the
-    // token trust chain, so a reviewer must see the before/after. `clientSecret` is NEVER marked (it is
+    // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it
+    // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request
+    // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing
+    // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the
+    // before/after — and so does a change to `acrValues`, which is an authentication-strength
+    // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is
     // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's
     // one-level reach.
     // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-
@@ -158,9 +159,17 @@ export const SsoConnectionBaseSchema = z.object({
             employeeId: z.string().optional(),
             groups: z.string().optional(),
         }),
-        validateIssuer: z.boolean().default(true).isAuditEvidence(),
-        validateAudience: z.boolean().default(true).isAuditEvidence(),
-        clockTolerance: z.number().min(0).max(300).default(30).isAuditEvidence(),
+        /*
+         * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,
+         * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,
+         * which is why they were removed rather than honoured (#419, decided 2026-09-08).
+         *
+         * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute
+         * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that
+         * is currently unconditional — an operator could switch off issuer or audience validation and
+         * break the token trust chain from a settings screen. A configuration field whose only
+         * achievable effect is to weaken a security control should not exist.
+         */
         acrValues: z.array(z.string()).optional().isAuditEvidence(),
         maxAge: z.number().min(0).optional().isAuditEvidence(),
         prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,0FAA0F;IAC1F,qGAAqG;IACrG,iGAAiG;IACjG,kGAAkG;IAClG,oGAAoG;IACpG,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC3D,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC7D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACxE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`validateIssuer`, `validateAudience`,\n  // `clockTolerance`, `pkceEnabled`, `pkceMethod`), plus what it requests (`scopes` / `customScopes` /\n  // `responseType` / `responseMode` / template + auth-request shaping). Turning `validateIssuer` /\n  // `validateAudience` / `pkceEnabled` off, or repointing `issuer` / `jwksUri`, silently breaks the\n  // token trust chain, so a reviewer must see the before/after. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    validateIssuer: z.boolean().default(true).isAuditEvidence(),\n    validateAudience: z.boolean().default(true).isAuditEvidence(),\n    clockTolerance: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n  // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n  // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n  bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}
+{"version":3,"file":"sso-connection.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAC;AAErI,2EAA2E;AAC3E,MAAM,CAAN,IAAY,WAGX;AAHD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,4BAAa,CAAA;AACf,CAAC,EAHW,WAAW,KAAX,WAAW,QAGtB;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;CACd,CAAC;AAEX,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,OAAO,EAAE,SAAS;IAClB,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACN,CAAC;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,WAAW,EAAE,uDAAuD;IACpE,aAAa,EAAE,wDAAwD;IACvE,UAAU,EAAE,sDAAsD;IAClE,SAAS,EAAE,qDAAqD;CACxD,CAAC;AAEX,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE;IAC9C,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;IAC/C,gGAAgG;IAChG,0FAA0F;IAC1F,8FAA8F;IAC9F,qEAAqE;IACrE,iGAAiG;IACjG,yEAAyE;IACzE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAEvD,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,qGAAqG;IACrG,kGAAkG;IAClG,kGAAkG;IAClG,kDAAkD;IAClD,+FAA+F;IAC/F,kGAAkG;IAClG,oCAAoC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,eAAe,EAAE;QACjC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,0FAA0F;QAC1F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE;QAC5D,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,oEAAoE,CAAC;YAC/F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iEAAiE,CAAC;YAChG,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,+DAA+D,CAAC;YAC7F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACzD,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACjE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC3E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC1D,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,eAAe,EAAE;QAChG,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAC/D,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,sGAAsG;IACtG,iGAAiG;IACjG,+FAA+F;IAC/F,kGAAkG;IAClG,+FAA+F;IAC/F,0FAA0F;IAC1F,0FAA0F;IAC1F,qFAAqF;IACrF,kGAAkG;IAClG,mBAAmB;IACnB,8FAA8F;IAC9F,oGAAoG;IACpG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,eAAe,EAAE;QACvF,iBAAiB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAChF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC9D,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClD,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC5C,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACnD,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC7C,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACxD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;QAC7C;;;;;;;;;;;;;;;;;;WAkBG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACrF,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAClE,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;YAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;YAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC9B,CAAC;QACF;;;;;;;;;;WAUG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;QACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QACxD,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;QAC/E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;YACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC1C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC,QAAQ,EAAE;IAEb,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;IAC1D,gGAAgG;IAChG,8FAA8F;IAC9F,4FAA4F;IAC5F,4EAA4E;IAC5E,4EAA4E;IAC5E,sFAAsF;IACtF,mFAAmF;IACnF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAC1E,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAEpF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,mCAAmC,GAAG,yBAAyB,CAAC;IAC3E,gBAAgB,EAAE,gBAAgB;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,WAAW,EAAE,iBAAiB;IAC9B,UAAU,EAAE,uBAAuB;IACnC,0EAA0E;IAC1E,uEAAuE;IACvE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,gCAAgC,CAAC;CACpE,CAAC,CAAC","sourcesContent":["/**\n * SSO Connection Schema (Shared) — Polymorphic\n *\n * Individual SSO provider connections with protocol discriminator (OIDC vs SAML).\n * Unified resource — `protocol` field determines which sub-object is populated.\n * Both OIDC and SAML protocol engines consume this shared discriminator.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2B\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas, optOutPolymorphicAutoBusinessKey } from '../../../resources/utils/resource-polymorphism.schemas';\n\n/** Interactive single-sign-on protocols supported by an SSO connection. */\nexport enum SsoProtocol {\n  OIDC = 'oidc',\n  SAML = 'saml',\n}\n\nexport const SSOTemplateMode = {\n  TEMPLATE: 'template',\n  DISCOVERY: 'discovery',\n  MANUAL: 'manual',\n} as const;\n\nexport const SSOResponseType = {\n  CODE: 'code',\n  ID_TOKEN: 'id_token',\n  TOKEN: 'token',\n} as const;\n\nexport const SSOResponseMode = {\n  QUERY: 'query',\n  FRAGMENT: 'fragment',\n  FORM_POST: 'form_post',\n} as const;\n\nexport const SSOPrompt = {\n  NONE: 'none',\n  LOGIN: 'login',\n  CONSENT: 'consent',\n  SELECT_ACCOUNT: 'select_account',\n} as const;\n\nexport const SSOPKCEMethod = {\n  S256: 'S256',\n  PLAIN: 'plain',\n} as const;\n\nexport const SamlNameIdFormat = {\n  UNSPECIFIED: 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',\n  EMAIL_ADDRESS: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',\n  PERSISTENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',\n  TRANSIENT: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',\n} as const;\n\nexport const SsoConnectionBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  protocol: z.enum(SsoProtocol).isSummaryField(),\n  externalProviderId: z.string().min(1).optional(),\n  displayName: z.string().min(1).isSummaryField(),\n  // `.isAuditEvidence()` — `enabled` is the connection's live/dead switch and `isDefault` decides\n  // which IdP silently receives logins. Marked individually rather than on any parent: this\n  // schema carries `x509Certificates` under `.isBackendOnly()`, and marking a container records\n  // the WHOLE object into rows that replicate to an unerasable ledger.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the live/dead switch and the default IdP\n  // decide which identity provider is trusted to authenticate this tenant.\n  enabled: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  isDefault: z.boolean().default(false).isAuditEvidence(),\n\n  // `.isAuditEvidence()` on the SAML leaves below — they say WHERE this connection federates\n  // (`entityId` / `ssoUrl` / `sloUrl`) and HOW strictly it validates the IdP (`signRequests`,\n  // `wantAssertionsSigned`, `allowedClockDrift`, `forceAuthn`, `maxAuthAge`, `nameIdFormat`,\n  // `allowIdpInitiated`). A silent change here redirects the trust anchor or accepts unsigned/replayed\n  // assertions — an authentication-assurance change the field NAME alone cannot evidence — so a\n  // reviewer must see the before/after value. Marked per LEAF, never on the `saml` container: the\n  // certificate material (`x509Certificates` / `x509CertificatePem`) sits beside these and marking the\n  // container would copy key material into an unerasable ledger. The two-level `attributeMapping` /\n  // `auditSettings` leaves are deliberately NOT marked — the evidence resolver reaches one level of\n  // nesting only, so a marker there would be inert.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the IdP endpoints and signature/replay\n  // validation posture decide which provider is trusted to authenticate this tenant and whether its\n  // assertions are actually verified.\n  saml: z.object({\n    entityId: z.string().min(1).isAuditEvidence(),\n    ssoUrl: z.url().isAuditEvidence(),\n    sloUrl: z.url().optional().isAuditEvidence(),\n    /** Frontend input: PEM-encoded certificate(s). Backend transforms to x509Certificates. */\n    x509CertificatePem: z.string().min(1).optional(),\n    x509Certificates: z.array(z.string()).min(1).isBackendOnly(),\n    attributeMapping: z.object({\n      email: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'),\n      firstName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname'),\n      lastName: z.string().default('http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    signRequests: z.boolean().default(true).isAuditEvidence(),\n    wantAssertionsSigned: z.boolean().default(true).isAuditEvidence(),\n    allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),\n    forceAuthn: z.boolean().default(false).isAuditEvidence(),\n    maxAuthAge: z.number().min(0).optional().isAuditEvidence(),\n    nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),\n    allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logAttributeMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  // `.isAuditEvidence()` on the OIDC leaves below — like the SAML block, they say WHERE this connection\n  // federates (`discoveryUrl` / `issuer` / the four endpoints / `jwksUri` / `endSessionEndpoint` /\n  // `clientId`) and HOW strictly it validates tokens (`pkceEnabled`, `pkceMethod`), plus what it\n  // requests (`scopes` / `customScopes` / `responseType` / `responseMode` / template + auth-request\n  // shaping, including the `acrValues` step-up demand). Turning `pkceEnabled` off, or repointing\n  // `issuer` / `jwksUri`, silently breaks the token trust chain, so a reviewer must see the\n  // before/after — and so does a change to `acrValues`, which is an authentication-strength\n  // requirement placed on the identity provider. `clientSecret` is NEVER marked (it is\n  // a write-only secret); `claimsMapping` / `auditSettings` are two-level and out of the resolver's\n  // one-level reach.\n  // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the OIDC endpoints, issuer and token-\n  // validation posture decide which provider is trusted and whether its tokens are actually verified.\n  oidc: z.object({\n    templateMode: z.enum(SSOTemplateMode).default(SSOTemplateMode.MANUAL).isAuditEvidence(),\n    templateOverrides: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n    customScopes: z.array(z.string()).optional().isAuditEvidence(),\n    discoveryUrl: z.url().optional().isAuditEvidence(),\n    issuer: z.url().optional().isAuditEvidence(),\n    authorizationEndpoint: z.url().optional().isAuditEvidence(),\n    tokenEndpoint: z.url().optional().isAuditEvidence(),\n    userInfoEndpoint: z.url().optional().isAuditEvidence(),\n    jwksUri: z.url().optional().isAuditEvidence(),\n    endSessionEndpoint: z.url().optional().isAuditEvidence(),\n    clientId: z.string().min(1).isAuditEvidence(),\n    /**\n     * OIDC/OAuth2 client secret issued by the IdP, used by the backend token\n     * exchange (`oauth2-connection-resolver` → `exchangeCodeForTokens`) to\n     * authenticate this connection at the provider's token endpoint.\n     *\n     * `.isWriteOnlySecret()` gives it the framework's write-then-masked contract:\n     * the operator sets/rotates it (stays in the CREATE/UPDATE request DTO) and it\n     * stays in the response DTO so the UI renders a masked placeholder, but the\n     * framework redacts it to `••••••••` at the client-serialization boundary only\n     * — internal reads (`servicesRegistryHandler.read` during token exchange) keep\n     * the real value. Do NOT use `.isBackendOnly()`: that strips the field from\n     * every client DTO, so the operator could never supply it.\n     *\n     * Preservation on UPDATE is NOT automatic here: this is a nested field, and the\n     * repository UPDATE is a whole-subdocument `$set` (no deep merge), so a\n     * round-tripped mask must be re-injected from the stored record by the SSO\n     * connection UPDATE custom-impl (`sso-connection.custom-impl` prefix). The\n     * central sentinel-strip only preserves TOP-LEVEL write-only secrets.\n     */\n    clientSecret: z.string().min(1).isWriteOnlySecret(),\n    scopes: z.array(z.string()).default(['openid', 'email', 'profile']).isAuditEvidence(),\n    responseType: z.enum(SSOResponseType).default(SSOResponseType.CODE).isAuditEvidence(),\n    responseMode: z.enum(SSOResponseMode).optional().isAuditEvidence(),\n    claimsMapping: z.object({\n      email: z.string().default('email'),\n      firstName: z.string().default('given_name'),\n      lastName: z.string().default('family_name'),\n      roles: z.string().optional(),\n      department: z.string().optional(),\n      employeeId: z.string().optional(),\n      groups: z.string().optional(),\n    }),\n    /*\n     * NO `validateIssuer` / `validateAudience` / `clockTolerance`. All three were declared here,\n     * persisted and audit-marked, and read by nothing — and they were inert in the SAFE direction,\n     * which is why they were removed rather than honoured (#419, decided 2026-09-08).\n     *\n     * `verifyIdToken` ALWAYS verifies the issuer and the audience and hardcodes a five-minute\n     * maximum token age. Honouring the three toggles could therefore only ever LOOSEN a guard that\n     * is currently unconditional — an operator could switch off issuer or audience validation and\n     * break the token trust chain from a settings screen. A configuration field whose only\n     * achievable effect is to weaken a security control should not exist.\n     */\n    acrValues: z.array(z.string()).optional().isAuditEvidence(),\n    maxAge: z.number().min(0).optional().isAuditEvidence(),\n    prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),\n    pkceEnabled: z.boolean().default(true).isAuditEvidence(),\n    pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),\n    auditSettings: z.object({\n      logAuthAttempts: z.boolean().default(true),\n      logTokenExchange: z.boolean().default(true),\n      logClaimsMapping: z.boolean().default(true),\n      retentionDays: z.number().min(1).max(2555).default(90),\n    }),\n  }).optional(),\n\n  autoCreateUsers: z.boolean().default(true),\n  autoVerifyEmail: z.boolean().default(true),\n  /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */\n  // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who\n  // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.\n  bypassAppMFA: z.boolean().default(false).isAuditEvidence(),\n  // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`\n  // and the two mappings decide what authority an externally-authenticated identity lands with,\n  // and `allowedDomains` decides whose identities the connection will accept at all. A change\n  // here is an authorization change; the field NAME alone cannot evidence it.\n  // The values are role names and domains — configuration, not personal data.\n  // assurance-control: WILDO.ACCESS.PRIVILEGE_EVIDENCE — these decide what authority an\n  // externally-authenticated identity lands with, and whose identities are accepted.\n  defaultRole: z.string().optional().isAuditEvidence(),\n  allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),\n  roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),\n  groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n// NOTE: Protocol-config discriminant enforcement (protocol=saml → saml defined, protocol=oidc → oidc defined)\n// is validated at the backend service layer, not via .refine() here.\n// Zod 4 doesn't allow .extend() on refined objects, which breaks the polymorphism engine.\n\n\nexport type SsoConnectionBase = z.infer<typeof SsoConnectionBaseSchema>;\n\nexport const ssoConnectionPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'ssoConnections',\n  baseFieldIdentifier: 'ssoConnectionId',\n  baseEnumKey: 'SSO_CONNECTIONS',\n  baseSchema: SsoConnectionBaseSchema,\n  // Many connections per scope (LIST/CREATE/UPDATE/DELETE) — opt out of the\n  // polymorphism engine's singleton-per-scope business-key auto-default.\n  variants: AUTH_SCOPE_VARIANTS.map(optOutPolymorphicAutoBusinessKey),\n});\n"]}

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts

@@ -16,7 +16,7 @@ import { z } from 'zod';
 import { PlatformAccessGrantStatus, PlatformAccessGrants_Operations } from './platform-access-grants.shared.schemas';
 import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
 import { type ResourceRelationship } from '../../resources/resources.shared.schemas';
-type PlatformAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.DELETE;
+type PlatformAccessGrantsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.COUNT | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
 export declare const platformAccessGrantsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<typeof PlatformAccessGrants_Operations, PlatformAccessGrantsCoreOperations, z.ZodObject<{
     _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
     organizationId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>>;

package/dist/esm/security/authorizations/platform-access-grants.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAOlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,CAAC;AAEjC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAqP1H,CAAC"}
+{"version":3,"file":"platform-access-grants.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authorizations/platform-access-grants.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAA6B,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,yCAAyC,CAAC;AAChJ,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAGL,KAAK,oBAAoB,EAC1B,MAAM,0CAA0C,CAAC;AAQlD,KAAK,kCAAkC,GACnC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,KAAK,GAC3B,qBAAqB,CAAC,MAAM,GAE5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,+DAA+D,GAAI,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;kBAuU1H,CAAC"}