@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/config/auth-config-resolution.shared.utils.js

@@ -134,6 +134,33 @@ function mergeMfaMostRestrictive(a, b) {
         passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,
     };
 }
+// ─── Step-Up Auth Resolution ────────────────────────────────────────────────
+function resolveStepUpSingle(base, override) {
+    return {
+        // Either side turning step-up ON wins: an organisation may require re-authentication where the
+        // application does not, and may never switch off one the application requires.
+        enabled: base.enabled || (override.enabled ?? false),
+        // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.
+        maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),
+        // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.
+        methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,
+    };
+}
+function resolveStepUpMultiOrg(base, orgOverrides) {
+    if (base === undefined)
+        return undefined;
+    const stepUpOverrides = orgOverrides
+        .map(o => o?.stepUpAuth)
+        .filter((p) => !!p);
+    if (stepUpOverrides.length === 0)
+        return { ...base };
+    const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));
+    return perOrgResults.reduce((acc, r) => ({
+        enabled: acc.enabled || r.enabled,
+        maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),
+        methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,
+    }));
+}
 // ─── Password Policy Resolution ─────────────────────────────────────────────
 function resolvePasswordPolicySingle(base, override) {
     return {
@@ -240,6 +267,7 @@ export function resolveAuthConfig(input) {
             authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },
             mfaPolicy: { ...userTypeAuth.mfaPolicy },
             passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),
+            stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,
         };
     }
     const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);
@@ -248,6 +276,7 @@ export function resolveAuthConfig(input) {
         authMethodsEnabled: setToMethodsMap(resolvedMethods),
         mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),
         passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),
+        stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),
     };
 }
 //# sourceMappingURL=auth-config-resolution.shared.utils.js.map

package/dist/esm/config/auth-config-resolution.shared.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n *\n * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n *\n * This is a pure function — no DI, no DB, no side effects.\n */\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean | { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n  userTypeAuth: UserTypeAuthPolicy;\n  orgOverrides: OrgTypeAuthOverrides[];\n  orgAuthMethodPolicy: OrgAuthMethodPolicy;\n  expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n  authMethodsEnabled: AuthMethodsMap;\n  mfaPolicy: MfaPolicyConfig;\n  passwordPolicy: PasswordPolicyConfig;\n}\n\nfunction isMethodEnabled(value: boolean | { enabled: boolean } | undefined): boolean {\n  if (value === undefined) return false;\n  if (typeof value === 'boolean') return value;\n  return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  if (!map) return new Set();\n  const result = new Set<AuthMethod>();\n  for (const [method, value] of Object.entries(map)) {\n    if (isMethodEnabled(value)) result.add(method as AuthMethod);\n  }\n  return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n  const result: AuthMethodsMap = {};\n  for (const method of Object.values(AuthMethod)) {\n    result[method] = methods.has(method);\n  }\n  return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/**\n * Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n *\n * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n */\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n  AuthMethod.PASSWORD,\n  AuthMethod.PASSKEY,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.SMS_OTP,\n];\n\n/**\n * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n */\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n  const result: AuthMethodsMap = { ...authMethodsEnabled };\n  for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n    result[method] = false;\n  }\n  return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverride: OrgTypeAuthOverrides,\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n  const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n  switch (policy) {\n    case OrgAuthMethodPolicy.RESTRICT_ONLY:\n      return intersection(userTypeMethods, orgMethods);\n\n    case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n      const expandableSet = new Set(expandable);\n      const expansions = intersection(orgMethods, expandableSet);\n      return union(userTypeMethods, expansions);\n    }\n\n    case OrgAuthMethodPolicy.UNRESTRICTED:\n      return new Set(orgMethods);\n\n    default:\n      return new Set(userTypeMethods);\n  }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverrides: OrgTypeAuthOverrides[],\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n  if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n  const perOrgResults = validOverrides.map(o =>\n    resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n  );\n\n  if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n    // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n    // Each org may expand within the expandable set, but multi-org users only get\n    // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n    return perOrgResults.reduce((acc, set) => intersection(acc, set));\n  }\n\n  return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n  base: MfaPolicyConfig,\n  override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n  return {\n    requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n    requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n    acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n  };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n  base: MfaPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n  const mfaOverrides = orgOverrides\n    .map(o => o?.mfaPolicy)\n    .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n  if (mfaOverrides.length === 0) return { ...base };\n\n  const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n  return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n  return {\n    requireMFA: a.requireMFA || b.requireMFA,\n    requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,\n    acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n  };\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n  base: PasswordPolicyConfig,\n  override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n  return {\n    minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n    maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n    requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n    requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n    requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n    requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n    expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n  };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n  base: PasswordPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n  const pwOverrides = orgOverrides\n    .map(o => o?.passwordPolicy)\n    .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n  if (pwOverrides.length === 0) return { ...base };\n\n  const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n  return normalizePasswordPolicyBounds(\n    perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n  );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n  return normalizePasswordPolicyBounds({\n    minLength: Math.max(a.minLength, b.minLength),\n    maxLength: Math.min(a.maxLength, b.maxLength),\n    requireUppercase: a.requireUppercase || b.requireUppercase,\n    requireLowercase: a.requireLowercase || b.requireLowercase,\n    requireNumbers: a.requireNumbers || b.requireNumbers,\n    requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,\n    expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n  });\n}\n\n/**\n * Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n  if (policy.maxLength >= policy.minLength) {\n    return policy;\n  }\n\n  return {\n    ...policy,\n    maxLength: policy.minLength,\n  };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base || override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  if (base === 0 && override === 0) return 0;\n  if (base === 0) return override;\n  if (override === 0) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] | undefined, b: T[] | undefined): T[] | undefined {\n  if (a === undefined) return b;\n  if (b === undefined) return a;\n  const setB = new Set(b);\n  return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n  const result = new Set<T>();\n  for (const item of a) {\n    if (b.has(item)) result.add(item);\n  }\n  return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n  return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n  const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n  if (!orgOverrides.length) {\n    return {\n      authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n      mfaPolicy: { ...userTypeAuth.mfaPolicy },\n      passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n    };\n  }\n\n  const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n  const resolvedMethods = resolveAuthMethodsMultiOrg(\n    userTypeMethods,\n    orgOverrides,\n    orgAuthMethodPolicy,\n    expandableOrgMethods ?? [],\n  );\n\n  return {\n    authMethodsEnabled: setToMethodsMap(resolvedMethods),\n    mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n    passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n  };\n}\n"]}
+{"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/**\n * W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n *\n * Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n *\n * This is a pure function — no DI, no DB, no side effects.\n */\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean | { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n  userTypeAuth: UserTypeAuthPolicy;\n  orgOverrides: OrgTypeAuthOverrides[];\n  orgAuthMethodPolicy: OrgAuthMethodPolicy;\n  expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n  authMethodsEnabled: AuthMethodsMap;\n  mfaPolicy: MfaPolicyConfig;\n  passwordPolicy: PasswordPolicyConfig;\n  /**\n   * Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n   * an organisation cannot introduce step-up for a user type that has none, because there is no base\n   * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n   * never configured.\n   */\n  stepUpAuth: StepUpAuthConfig | undefined;\n}\n\nfunction isMethodEnabled(value: boolean | { enabled: boolean } | undefined): boolean {\n  if (value === undefined) return false;\n  if (typeof value === 'boolean') return value;\n  return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap | undefined): Set<AuthMethod> {\n  if (!map) return new Set();\n  const result = new Set<AuthMethod>();\n  for (const [method, value] of Object.entries(map)) {\n    if (isMethodEnabled(value)) result.add(method as AuthMethod);\n  }\n  return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n  const result: AuthMethodsMap = {};\n  for (const method of Object.values(AuthMethod)) {\n    result[method] = methods.has(method);\n  }\n  return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/**\n * Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n *\n * `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n */\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n  AuthMethod.PASSWORD,\n  AuthMethod.PASSKEY,\n  AuthMethod.MAGIC_LINK,\n  AuthMethod.SMS_OTP,\n];\n\n/**\n * AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n */\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n  const result: AuthMethodsMap = { ...authMethodsEnabled };\n  for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n    result[method] = false;\n  }\n  return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverride: OrgTypeAuthOverrides,\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n  const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n  switch (policy) {\n    case OrgAuthMethodPolicy.RESTRICT_ONLY:\n      return intersection(userTypeMethods, orgMethods);\n\n    case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n      const expandableSet = new Set(expandable);\n      const expansions = intersection(orgMethods, expandableSet);\n      return union(userTypeMethods, expansions);\n    }\n\n    case OrgAuthMethodPolicy.UNRESTRICTED:\n      return new Set(orgMethods);\n\n    default:\n      return new Set(userTypeMethods);\n  }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n  userTypeMethods: Set<AuthMethod>,\n  orgOverrides: OrgTypeAuthOverrides[],\n  policy: OrgAuthMethodPolicy,\n  expandable: AuthMethod[],\n): Set<AuthMethod> {\n  const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n  if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n  const perOrgResults = validOverrides.map(o =>\n    resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n  );\n\n  if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n    // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n    // Each org may expand within the expandable set, but multi-org users only get\n    // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n    return perOrgResults.reduce((acc, set) => intersection(acc, set));\n  }\n\n  return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n  base: MfaPolicyConfig,\n  override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n  return {\n    requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n    requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n    acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n  };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n  base: MfaPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n  const mfaOverrides = orgOverrides\n    .map(o => o?.mfaPolicy)\n    .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n  if (mfaOverrides.length === 0) return { ...base };\n\n  const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n  return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n  return {\n    requireMFA: a.requireMFA || b.requireMFA,\n    requireStrongMFA: a.requireStrongMFA || b.requireStrongMFA,\n    acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n    enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n    passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n  };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n  return {\n    // Either side turning step-up ON wins: an organisation may require re-authentication where the\n    // application does not, and may never switch off one the application requires.\n    enabled: base.enabled || (override.enabled ?? false),\n    // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n    maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n    // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n    methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n  };\n}\n\nfunction resolveStepUpMultiOrg(\n  base: StepUpAuthConfig | undefined,\n  orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig | undefined {\n  if (base === undefined) return undefined;\n  const stepUpOverrides = orgOverrides\n    .map(o => o?.stepUpAuth)\n    .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n  if (stepUpOverrides.length === 0) return { ...base };\n\n  const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n  return perOrgResults.reduce((acc, r) => ({\n    enabled: acc.enabled || r.enabled,\n    maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n    methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n  }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n  base: PasswordPolicyConfig,\n  override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n  return {\n    minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n    maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n    requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n    requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n    requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n    requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n    expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n  };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n  base: PasswordPolicyConfig,\n  orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n  const pwOverrides = orgOverrides\n    .map(o => o?.passwordPolicy)\n    .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n  if (pwOverrides.length === 0) return { ...base };\n\n  const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n  return normalizePasswordPolicyBounds(\n    perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n  );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n  return normalizePasswordPolicyBounds({\n    minLength: Math.max(a.minLength, b.minLength),\n    maxLength: Math.min(a.maxLength, b.maxLength),\n    requireUppercase: a.requireUppercase || b.requireUppercase,\n    requireLowercase: a.requireLowercase || b.requireLowercase,\n    requireNumbers: a.requireNumbers || b.requireNumbers,\n    requireSpecialChars: a.requireSpecialChars || b.requireSpecialChars,\n    expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n  });\n}\n\n/**\n * Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n  if (policy.maxLength >= policy.minLength) {\n    return policy;\n  }\n\n  return {\n    ...policy,\n    maxLength: policy.minLength,\n  };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base || override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean | undefined): boolean {\n  if (override === undefined) return base;\n  return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number | undefined): number {\n  if (override === undefined) return base;\n  if (base === 0 && override === 0) return 0;\n  if (base === 0) return override;\n  if (override === 0) return base;\n  return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] | undefined, b: T[] | undefined): T[] | undefined {\n  if (a === undefined) return b;\n  if (b === undefined) return a;\n  const setB = new Set(b);\n  return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n  const result = new Set<T>();\n  for (const item of a) {\n    if (b.has(item)) result.add(item);\n  }\n  return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n  return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n  const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n  if (!orgOverrides.length) {\n    return {\n      authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n      mfaPolicy: { ...userTypeAuth.mfaPolicy },\n      passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n      stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n    };\n  }\n\n  const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n  const resolvedMethods = resolveAuthMethodsMultiOrg(\n    userTypeMethods,\n    orgOverrides,\n    orgAuthMethodPolicy,\n    expandableOrgMethods ?? [],\n  );\n\n  return {\n    authMethodsEnabled: setToMethodsMap(resolvedMethods),\n    mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n    passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n    stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n  };\n}\n"]}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts

@@ -70,10 +70,17 @@ export declare const RegistrationConfigSchema: z.ZodObject<{
     mode: z.ZodEnum<typeof RegistrationMode>;
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -139,10 +146,17 @@ export declare const UserTypeAuthPolicySchema: z.ZodObject<{
         mode: z.ZodEnum<typeof RegistrationMode>;
         /**
          * Only acquisition methods with a complete public-signup implementation are accepted.
-         * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-         * end-to-end registration flow; declaring them here would otherwise advertise a path
-         * the runtime cannot execute.
-        */
+         *
+         * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+         * registration in #463; before that they were authentication and enrollment methods only, and
+         * declaring one here was refused because it would have advertised a path the runtime could not
+         * execute.
+         *
+         * A password-less signup creates the account with NO credential and proves the address by a magic
+         * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+         * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+         * nothing. See `registerUser`.
+         */
         allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
         /** D-19: 'deferred' gives immediate access, verify later. */
         emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -197,10 +211,17 @@ export declare const UserTypeDefinitionSchema: z.ZodObject<{
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -276,7 +297,41 @@ export declare const FrontendServiceDefinitionSchema: z.ZodObject<{
     frontendType: z.ZodOptional<z.ZodEnum<typeof AppFrontendType>>;
 }, z.core.$strip>;
 export type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export declare enum OrganizationNameSource {
     ASK = "ask",
     AUTO = "auto",
@@ -309,6 +364,11 @@ export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
         requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
     }, z.core.$strip>>;
+    stepUpAuth: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>>;
 export type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
@@ -341,6 +401,11 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -353,6 +418,7 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
+/** @wildo_source:part:end saas.models.config.organization-types */
 export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     auth: z.ZodObject<{
         authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -369,10 +435,17 @@ export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -450,6 +523,11 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;MAKE;;IAEF,6DAA6D;;IAE7D,yFAAyF;;kBAyBzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QAzFnC;;;;;UAKE;;QAEF,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsJzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YApKnC;;;;;cAKE;;YAEF,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwKzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF,gFAAgF;AAChF,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;kBAI1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAI1F,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YA3QhC;;;;;cAKE;;YAEF,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAkQR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}
+{"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;kBAsCzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QA7GnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0KzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YA/LnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YAxVhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwUR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}

package/dist/esm/config/entity-identity-config.shared.schemas.js

@@ -84,18 +84,39 @@ export const RegistrationConfigSchema = z.strictObject({
     mode: z.enum(RegistrationMode),
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),
     /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
     blockForSSODomains: z.boolean().default(false),
 }).superRefine((registration, ctx) => {
-    const unsupportedMethods = registration.allowedMethods.filter((method) => method !== AuthMethod.PASSWORD
-        && method !== AuthMethod.EXTERNAL_OAUTH2);
+    /*
+     * The set with a public-signup implementation. It is enumerated rather than open because the
+     * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and
+     * one the runtime cannot execute fails after they have committed to it.
+     *
+     * MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication
+     * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it
+     * here means building that flow first, not widening this list.
+     */
+    const publiclyRegisterableMethods = [
+        AuthMethod.PASSWORD,
+        AuthMethod.EXTERNAL_OAUTH2,
+        AuthMethod.MAGIC_LINK,
+        AuthMethod.PASSKEY,
+    ];
+    const unsupportedMethods = registration.allowedMethods.filter((method) => !publiclyRegisterableMethods.includes(method));
     if (unsupportedMethods.length > 0) {
         ctx.addIssue({
             code: 'custom',
@@ -179,7 +200,14 @@ export const UserTypeAuthPolicySchema = z.object({
     }),
     /** E-8: Session duration for this user type. */
     sessionDurationMinutes: z.number().min(1).max(1440).default(30),
-    /** E-8, G-2: undefined = unlimited. */
+    /**
+     * E-8, G-2: the cap on simultaneous refresh chains for this user type.
+     *
+     * Leaving it undefined does NOT mean unlimited. The token issuer falls back to
+     * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type
+     * that declares nothing is still capped. There is no value that disables the cap; declare the
+     * number you want.
+     */
     maxConcurrentSessions: z.number().min(1).optional(),
     /** G-1: Per-user-type lockout. Backend-only. */
     lockoutPolicy: LockoutPolicyConfigSchema.default({
@@ -250,7 +278,41 @@ export const FrontendServiceDefinitionSchema = z.object({
     frontendType: z.enum(AppFrontendType).optional(),
 });
 // ─── Organization Type ──────────────────────────────────────────────────────
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export var OrganizationNameSource;
 (function (OrganizationNameSource) {
     OrganizationNameSource["ASK"] = "ask";
@@ -267,6 +329,21 @@ export const OrgTypeAuthOverridesSchema = z.object({
     authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),
     mfaPolicy: MfaPolicyConfigSchema.partial().optional(),
     passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),
+    /**
+     * Re-authentication freshness, added 2026-09-09 (#527).
+     *
+     * The other three overrides and this one answer ONE question — how hard is it for this tenant's
+     * members to prove who they are — and until now a tenant could tighten three of them. An
+     * organisation that requires MFA and a 16-character password could still have a member mutate a
+     * sensitive resource on an eight-hour-old session, because the app-wide default said so.
+     *
+     * Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic
+     * directions and that is worth stating rather than inferring: `enabled` is an OR (either side
+     * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`
+     * intersects, so an organisation can withdraw an acceptable re-authentication method but never
+     * introduce one the user type does not already allow.
+     */
+    stepUpAuth: StepUpAuthConfigSchema.partial().optional(),
 }).optional();
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
 export const OrgScimProvisioningSchema = z.object({
@@ -289,6 +366,7 @@ export const OrganizationTypeDefinitionSchema = z.object({
     scimProvisioning: OrgScimProvisioningSchema.optional(),
     creationPolicy: OrgCreationPolicySchema.optional(),
 });
+/** @wildo_source:part:end saas.models.config.organization-types */
 // ─── Top-Level Config Sections ──────────────────────────────────────────────
 export const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);
 export const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);