@wildo-ai/saas-models 1.1.2 → 1.1.3

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js

@@ -0,0 +1,198 @@
+/**
+ * Organization Provider Credentials — resource configuration.
+ *
+ * The tenant-owned service credential toward a third-party provider. See
+ * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.
+ */
+import { z } from 'zod';
+import { OrganizationProviderCredentialSchema, ProviderCredentialValidationState, } from './provider-credentials.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas.js';
+const ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
+    providerRef: z.string(),
+    secretSlug: z.string(),
+    enabled: z.boolean(),
+    validationState: z.enum(ProviderCredentialValidationState),
+};
+export const orgProviderCredentialsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: OrganizationProviderCredentialSchema,
+    resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * ## `read` / `list` — the RESOLVER's door
+     *
+     * A provider call happens on whatever execution context the caller holds: a batch, a queue
+     * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the
+     * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed
+     * on this opt-in. The scope is supplied as the organization FK in the system context map, so the
+     * bypass is of the ROLE check only, never of the tenant boundary.
+     *
+     * ## `update` — the resolver's WRITE-BACK door
+     *
+     * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all
+     * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The
+     * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted
+     * into here and why those fields are not client-writable: a tenant administrator must not be able
+     * to declare their own credential `VALID`.
+     *
+     * ## `create` — deliberately NOT opted in
+     *
+     * A credential comes into existence only when a human supplies one. There is no seed, no
+     * provisioning step and no import that should mint one on a tenant's behalf, so the system create
+     * door stays shut.
+     *
+     * ## `exportSubject: FORBIDDEN`
+     *
+     * The reserved class. This row is a live credential toward a third party; a subject export that
+     * carried one would hand a working secret to whoever requested the export.
+     */
+    /**
+     * `create` is open for the reason its user-owned sibling documents at length: a credential a
+     * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect
+     * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —
+     * engine code, never a request payload — is the only thing that can store it.
+     */
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
+    /**
+     * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs
+     * to a person.
+     *
+     * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it
+     * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an
+     * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration
+     * because the admin who configured it left the company is a bug, not a privacy guarantee.
+     *
+     * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is
+     * registered for `setByUserId` — withheld deliberately, since that edge would also put a
+     * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD
+     * happen rather than a path that runs today, and it is worth declaring for that reason: the next
+     * author who registers a USERS edge inherits the correct answer instead of the default.
+     *
+     * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any
+     * field carries an impersonalize treatment or declares a personal-data category.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a
+        // relationship declaring the cascade against a resource with no DELETE core operation throws at
+        // config build. It is also the tenant's own "remove this credential" door.
+        CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
+    ],
+    operationsConfiguration: {
+        /*
+         * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not
+         * an omission.
+         *
+         * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant
+         * so a platform operator can support a tenant. This one does not, because the thing being
+         * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend
+         * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards
+         * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test
+         * before crossing a tenant boundary, and this verb fails it in both directions — reading is
+         * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the
+         * tenant out of its own integration.
+         *
+         * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials
+         * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an
+         * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs
+         * through identity, where it is audited and reversible, rather than through the credential
+         * store, where it would not be.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client
+                    // boundary, so a READ returns metadata and a placeholder.
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,
+                    sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,
+                    maxPaginatedResultPerPageLimit: 100,
+                },
+            ],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    // CRITICAL: this is the act of granting the application authority to act as the tenant
+                    // toward a third party.
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_ORG_ROLES.ORG_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        /*
+         * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be
+         * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to
+         * resolve when an erasure actually runs, because the retention primitives resolve through
+         * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=provider-credentials-organization.shared.resources-config.schemas.js.map

package/dist/esm/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-organization.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-organization.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oCAAoC,EACpC,iCAAiC,GAClC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExF,MAAM,oCAAoC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE9G,MAAM,sCAAsC,GAAG;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,iEAAiE,GAAG,CAC/E,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,oCAAoC;IAChD,kBAAkB,EAAE,gBAAgB,CAAC,wBAAwB;IAC7D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,wBAAwB,CAAC;IACtG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH;;;;;OAKG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,gGAAgG;QAChG,2EAA2E;QAC3E,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;;;;;;;WAkBG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,sCAAsC;oBACpD,UAAU,EAAE,oCAAoC;oBAChD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,uFAAuF;oBACvF,wBAAwB;oBACxB,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;oBACjC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED;;;;;WAKG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * Organization Provider Credentials — resource configuration.\n *\n * The tenant-owned service credential toward a third-party provider. See\n * `provider-credentials.shared.schemas.ts` for what the resource is and what it deliberately is not.\n */\n\nimport { z } from 'zod';\n\nimport {\n  OrganizationProviderCredentialSchema,\n  ProviderCredentialValidationState,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES, CORE_ORG_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst ORG_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype OrgProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const orgProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  OrgProviderCredentialsCoreOperations,\n  typeof OrganizationProviderCredentialSchema\n>({\n  mainSchema: OrganizationProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.ORG_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.ORG_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * ## `read` / `list` — the RESOLVER's door\n   *\n   * A provider call happens on whatever execution context the caller holds: a batch, a queue\n   * consumer, an anonymous webhook return leg. None of those carry an ORG_ADMIN role, and the\n   * resolution must still work — so the resolver reads through `readAsSystem`, which is fail-closed\n   * on this opt-in. The scope is supplied as the organization FK in the system context map, so the\n   * bypass is of the ROLE check only, never of the tenant boundary.\n   *\n   * ## `update` — the resolver's WRITE-BACK door\n   *\n   * `lastUsedAt`, `validationState`, `validationError` and `lastValidatedAt` are all\n   * `.excludeFromUpdate()`, so the strict re-parse on the ordinary update path strips them. The\n   * trusted `updateAsSystem` path is the only one that re-attaches them, which is why it is opted\n   * into here and why those fields are not client-writable: a tenant administrator must not be able\n   * to declare their own credential `VALID`.\n   *\n   * ## `create` — deliberately NOT opted in\n   *\n   * A credential comes into existence only when a human supplies one. There is no seed, no\n   * provisioning step and no import that should mint one on a tenant's behalf, so the system create\n   * door stays shut.\n   *\n   * ## `exportSubject: FORBIDDEN`\n   *\n   * The reserved class. This row is a live credential toward a third party; a subject export that\n   * carried one would hand a working secret to whoever requested the export.\n   */\n  /**\n   * `create` is open for the reason its user-owned sibling documents at length: a credential a\n   * vendor MINTS has no HTTP write that could carry it. An OAuth2 grant arrives through a redirect\n   * after a tenant administrator authorized it on the vendor's consent screen, so the exchange —\n   * engine code, never a request payload — is the only thing that can store it.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * Subject erasure RETAINS this row and scrubs nothing, because there is nothing here that belongs\n   * to a person.\n   *\n   * The row is a TENANT's credential. `setByUserId` names an ACTOR — the administrator who typed it\n   * — which is the first population `NO_PRINCIPAL` describes, and it is exactly the field an\n   * erasure must not use as a reason to destroy the row: a tenant losing its Slack integration\n   * because the admin who configured it left the company is a bug, not a privacy guarantee.\n   *\n   * The erasure walk cannot reach this resource in any case, because no `USERS` relationship is\n   * registered for `setByUserId` — withheld deliberately, since that edge would also put a\n   * credential on the Art. 15 export graph. `RETAIN_ONLY` is therefore a statement of what WOULD\n   * happen rather than a path that runs today, and it is worth declaring for that reason: the next\n   * author who registers a USERS edge inherits the correct answer instead of the default.\n   *\n   * The assertion is checked in both directions by the factory — `RETAIN_ONLY` is refused if any\n   * field carries an impersonalize treatment or declares a personal-data category.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the ORGANIZATIONS cascade: `onParentDelete` dispatches the child's DELETE, and a\n    // relationship declaring the cascade against a resource with no DELETE core operation throws at\n    // config build. It is also the tenant's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * ORG_ADMIN everywhere, and NO super-administrator variant anywhere — a deliberate refusal, not\n     * an omission.\n     *\n     * Every sibling security resource (org API keys, org OAuth clients) carries an `admin` variant\n     * so a platform operator can support a tenant. This one does not, because the thing being\n     * supported is a live credential toward a THIRD PARTY: an operator who can list, rotate or spend\n     * a tenant's Slack token can act as that tenant toward Slack, and no audit event afterwards\n     * makes that reversible. `administrative-continuity-floors.md` asks for the reversibility test\n     * before crossing a tenant boundary, and this verb fails it in both directions — reading is\n     * masked but LISTing reveals which vendors a tenant integrates with, and rotating locks the\n     * tenant out of its own integration.\n     *\n     * The cost is real and accepted: a tenant that loses every ORG_ADMIN cannot have its credentials\n     * repaired by support. That is what `organizationMembers.grantOwnership` exists for — restore an\n     * administrator to the tenant, and the tenant repairs its own credentials. The repair path runs\n     * through identity, where it is audited and reversible, rather than through the credential\n     * store, where it would not be.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: ORG_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: ORG_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          // CRITICAL: this is the act of granting the application authority to act as the tenant\n          // toward a third party.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_ORG_ROLES.ORG_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    /*\n     * Route-less retention plumbing. INTERNAL_CALL registers NO route, and must not be\n     * REPOSITORY_ONLY: that satisfies the factory's boot-time presence guard and then fails to\n     * resolve when an erasure actually runs, because the retention primitives resolve through\n     * `getServiceOperationPathDefault`, which excludes REPOSITORY_ONLY.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts

@@ -0,0 +1,31 @@
+/**
+ * User Provider Credentials — resource configuration.
+ *
+ * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for
+ * what the resource is, why it is separate from the organization-owned sibling, and why it is not a
+ * delegated OAuth grant.
+ */
+import { z } from 'zod';
+import { ProviderCredentialValidationState } from './provider-credentials.shared.schemas';
+import { CoreResourceOperation } from '../../resources/resources.shared.core.definitions';
+import { ResourceRelationship } from '../../resources/resources.shared.schemas';
+type UserProviderCredentialsCoreOperations = CoreResourceOperation.READ | CoreResourceOperation.LIST | CoreResourceOperation.CREATE | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.UPDATE_MANY;
+export declare const userProviderCredentialsResourceConfiguration_InitializationFactory: (resourcesRelationships: ResourceRelationship[]) => import("../..").ResourceConfiguration<undefined, UserProviderCredentialsCoreOperations, import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodObject<{
+    _id: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>;
+    userId: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>>;
+    providerRef: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretSlug: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>>>;
+    secretValue: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodString>;
+    enabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>>;
+    validationState: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<typeof ProviderCredentialValidationState>>>>;
+    validationError: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>>;
+    lastValidatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    lastUsedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>>;
+    secretSetAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodDate>>>;
+    connectionParameters: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
+    description: z.ZodOptional<z.ZodString>;
+    createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>>;
+    updatedAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>>;
+}, z.core.$strip>>>;
+export {};
+//# sourceMappingURL=provider-credentials-user.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EAElC,MAAM,uCAAuC,CAAC;AAK/C,OAAO,EAAE,qBAAqB,EAAwD,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAA4D,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAY1I,KAAK,qCAAqC,GACtC,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,IAAI,GAC1B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,MAAM,GAC5B,qBAAqB,CAAC,WAAW,CAAC;AAEtC,eAAO,MAAM,kEAAkE,GAC7E,wBAAwB,oBAAoB,EAAE;;;;;;;;;;;;;;;;mBAsL9C,CAAC"}

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js

@@ -0,0 +1,191 @@
+/**
+ * User Provider Credentials — resource configuration.
+ *
+ * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for
+ * what the resource is, why it is separate from the organization-owned sibling, and why it is not a
+ * delegated OAuth grant.
+ */
+import { z } from 'zod';
+import { ProviderCredentialValidationState, UserProviderCredentialSchema, } from './provider-credentials.shared.schemas.js';
+import { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas.js';
+import { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory.js';
+import { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas.js';
+import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions.js';
+import { ResourceOperationRiskLevel, ResourceOperationVariantType } from '../../resources/resources.shared.schemas.js';
+import { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas.js';
+const USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'];
+const USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {
+    providerRef: z.string(),
+    secretSlug: z.string(),
+    enabled: z.boolean(),
+    validationState: z.enum(ProviderCredentialValidationState),
+};
+export const userProviderCredentialsResourceConfiguration_InitializationFactory = (resourcesRelationships) => createResourceConfiguration_Initialization({
+    mainSchema: UserProviderCredentialSchema,
+    resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,
+    resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],
+    resourceRelationships: resourcesRelationships,
+    isSystemResource: true,
+    /**
+     * The same four system doors as the organization-owned sibling, for the same reasons: a provider
+     * call runs on whatever execution context the caller holds, so the resolver reads through
+     * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because
+     * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own
+     * credential VALID.
+     *
+     * ## `create` was shut, and the sentence that shut it stopped being true
+     *
+     * It read: "a credential exists only because a person supplied one." That is exactly right for a
+     * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a
+     * person authorized it on the vendor's own consent screen and came back through a redirect;
+     * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would
+     * mean the authorization exchange completes, the vendor records the grant, and this application
+     * has nowhere to put it.
+     *
+     * What keeps that narrow is the door itself rather than a second check: `createAsSystem` is
+     * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED
+     * from the schema rather than caller-supplied, and the row identity the seal binds to comes from
+     * the scope map, so a caller cannot name whose credential it is writing.
+     *
+     * ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real
+     *
+     * The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`
+     * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row
+     * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its
+     * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this
+     * refusal is the only thing standing between a subject-access request and a working third-party
+     * credential in the response.
+     */
+    systemAccessPolicy: {
+        exportSubject: ResourceSystemAccessMode.FORBIDDEN,
+        read: ResourceSystemAccessMode.ALLOWED,
+        list: ResourceSystemAccessMode.ALLOWED,
+        update: ResourceSystemAccessMode.ALLOWED,
+        create: ResourceSystemAccessMode.ALLOWED,
+    },
+    /**
+     * `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.
+     *
+     * These are two different mechanisms and reading them as one produces the wrong answer in both
+     * directions. The retention policy governs what the erasure WALK does to a row it retains: here,
+     * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a
+     * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys
+     * it, dispatching this resource's DELETE when the person is removed.
+     *
+     * So a person who exercises erasure does not leave a live credential behind, and the mechanism that
+     * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`
+     * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed
+     * envelope whose key material still opens against a subject who asked to be forgotten.
+     */
+    retentionPolicy: {
+        mode: ErasureRetentionMode.RETAIN_ONLY,
+    },
+    /**
+     * `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,
+     * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.
+     */
+    dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },
+    coreOperations: [
+        CoreResourceOperation.READ,
+        CoreResourceOperation.LIST,
+        CoreResourceOperation.CREATE,
+        CoreResourceOperation.UPDATE,
+        // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the
+        // holder's own "remove this credential" door.
+        CoreResourceOperation.DELETE,
+        // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.
+        CoreResourceOperation.UPDATE_MANY,
+    ],
+    operationsConfiguration: {
+        /*
+         * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the
+         * organization-owned sibling's, which refuses only the PLATFORM operator.
+         *
+         * Here an organization administrator is refused too. The row is a key its holder authored against
+         * their own account with a vendor; consent to store it is not consent for somebody else to spend
+         * it, and the vendor would record the act as the holder's own. There is no support story that
+         * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally
+         * rather than by a role list somebody could widen.
+         *
+         * The cost is that a personal credential cannot be repaired by anyone but its owner, which is the
+         * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.
+         */
+        [CoreResourceOperation.READ]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_USER],
+                    // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client
+                    // boundary, so a READ returns metadata and a placeholder.
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        [CoreResourceOperation.LIST]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_USER],
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                    filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,
+                    sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,
+                    maxPaginatedResultPerPageLimit: 100,
+                },
+            ],
+        },
+        [CoreResourceOperation.CREATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_USER],
+                    // CRITICAL: the act of granting this application authority to act as the person toward a
+                    // third party. That it is the person's own decision makes it consented, not low-risk.
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.UPDATE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_USER],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+        [CoreResourceOperation.DELETE]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.API_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_USER],
+                    // Revoking one's own credential is the safe direction and must never be harder than
+                    // granting it.
+                    riskLevel: ResourceOperationRiskLevel.LOW,
+                },
+            ],
+        },
+        /**
+         * Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.
+         *
+         * `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over
+         * HTTP on this resource would be a way to change many credentials at once, which no holder needs
+         * and no administrator may have.
+         */
+        [CoreResourceOperation.UPDATE_MANY]: {
+            variants: [
+                {
+                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    isDefault: true,
+                    roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
+                    riskLevel: ResourceOperationRiskLevel.CRITICAL,
+                },
+            ],
+        },
+    },
+});
+//# sourceMappingURL=provider-credentials-user.shared.resources-config.schemas.js.map

package/dist/esm/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-credentials-user.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../src/security/connected-accounts/provider-credentials-user.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,2DAA2D,CAAC;AAC1H,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,kCAAkC,EAAE,MAAM,mDAAmD,CAAC;AAChJ,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAwB,MAAM,0CAA0C,CAAC;AAC1I,OAAO,EAAE,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExE,MAAM,qCAAqC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAE/G,MAAM,uCAAuC,GAAG;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC;CAC3D,CAAC;AAUF,MAAM,CAAC,MAAM,kEAAkE,GAAG,CAChF,sBAA8C,EAC9C,EAAE,CAAC,0CAA0C,CAI7C;IACA,UAAU,EAAE,4BAA4B;IACxC,kBAAkB,EAAE,gBAAgB,CAAC,yBAAyB;IAC9D,uBAAuB,EAAE,kCAAkC,CAAC,gBAAgB,CAAC,yBAAyB,CAAC;IACvG,qBAAqB,EAAE,sBAAsB;IAC7C,gBAAgB,EAAE,IAAI;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,kBAAkB,EAAE;QAClB,aAAa,EAAE,wBAAwB,CAAC,SAAS;QACjD,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;QACxC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,EAAE;QACf,IAAI,EAAE,oBAAoB,CAAC,WAAW;KACvC;IAED;;;OAGG;IACH,iBAAiB,EAAE,EAAE,IAAI,EAAE,uBAAuB,CAAC,YAAY,EAAE;IAEjE,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,+FAA+F;QAC/F,8CAA8C;QAC9C,qBAAqB,CAAC,MAAM;QAC5B,oEAAoE;QACpE,qBAAqB,CAAC,WAAW;KAClC;IAED,uBAAuB,EAAE;QACvB;;;;;;;;;;;;WAYG;QACH,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,sFAAsF;oBACtF,0DAA0D;oBAC1D,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,GAAG;oBACzC,YAAY,EAAE,uCAAuC;oBACrD,UAAU,EAAE,qCAAqC;oBACjD,8BAA8B,EAAE,GAAG;iBACpC;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,yFAAyF;oBACzF,sFAAsF;oBACtF,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;QAED,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;oBAChC,oFAAoF;oBACpF,eAAe;oBACf,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aACF;SACF;QAED;;;;;;WAMG;QACH,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE;YACnC,QAAQ,EAAE;gBACR;oBACE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;oBAC7C,SAAS,EAAE,0BAA0B,CAAC,QAAQ;iBAC/C;aACF;SACF;KACF;CACF,CAAC,CAAC","sourcesContent":["/**\n * User Provider Credentials — resource configuration.\n *\n * A PERSON's own credential toward a third party. See `provider-credentials.shared.schemas.ts` for\n * what the resource is, why it is separate from the organization-owned sibling, and why it is not a\n * delegated OAuth grant.\n */\n\nimport { z } from 'zod';\n\nimport {\n  ProviderCredentialValidationState,\n  UserProviderCredentialSchema,\n} from './provider-credentials.shared.schemas';\n\nimport { ErasureRetentionMode, ResourceDataSubjectKind } from '../../compliance/privacy/impersonalization.shared.schemas';\nimport { createResourceConfiguration_Initialization } from '../../resources/resources-config.shared.factory';\nimport { ResourceSystemAccessMode } from '../../resources/resources-config.shared.schemas';\nimport { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from '../../resources/resources.shared.core.definitions';\nimport { ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceRelationship } from '../../resources/resources.shared.schemas';\nimport { CORE_APP_ROLES } from '../authorizations/roles.shared.schemas';\n\nconst USER_PROVIDER_CREDENTIALS_SORT_FIELDS = ['createdAt', 'updatedAt', 'providerRef', 'lastUsedAt'] as const;\n\nconst USER_PROVIDER_CREDENTIALS_FILTER_FIELDS = {\n  providerRef: z.string(),\n  secretSlug: z.string(),\n  enabled: z.boolean(),\n  validationState: z.enum(ProviderCredentialValidationState),\n};\n\ntype UserProviderCredentialsCoreOperations =\n  | CoreResourceOperation.READ\n  | CoreResourceOperation.LIST\n  | CoreResourceOperation.CREATE\n  | CoreResourceOperation.UPDATE\n  | CoreResourceOperation.DELETE\n  | CoreResourceOperation.UPDATE_MANY;\n\nexport const userProviderCredentialsResourceConfiguration_InitializationFactory = (\n  resourcesRelationships: ResourceRelationship[],\n) => createResourceConfiguration_Initialization<\n  undefined,\n  UserProviderCredentialsCoreOperations,\n  typeof UserProviderCredentialSchema\n>({\n  mainSchema: UserProviderCredentialSchema,\n  resourceIdentifier: CoreResourceType.USER_PROVIDER_CREDENTIALS,\n  resourceFieldIdentifier: coreResourceShared_FieldIdentifier[CoreResourceType.USER_PROVIDER_CREDENTIALS],\n  resourceRelationships: resourcesRelationships,\n  isSystemResource: true,\n\n  /**\n   * The same four system doors as the organization-owned sibling, for the same reasons: a provider\n   * call runs on whatever execution context the caller holds, so the resolver reads through\n   * `readAsSystem`, and writes back `lastUsedAt` / `validationState` through `updateAsSystem` because\n   * those fields are `.excludeFromUpdate()` and a holder must not be able to declare their own\n   * credential VALID.\n   *\n   * ## `create` was shut, and the sentence that shut it stopped being true\n   *\n   * It read: \"a credential exists only because a person supplied one.\" That is exactly right for a\n   * credential somebody PASTES, and false for one a vendor MINTS. An OAuth2 grant exists because a\n   * person authorized it on the vendor's own consent screen and came back through a redirect;\n   * nobody ever types it, so there is no HTTP write that could carry it. Leaving the door shut would\n   * mean the authorization exchange completes, the vendor records the grant, and this application\n   * has nowhere to put it.\n   *\n   * What keeps that narrow is the door itself rather than a second check: `createAsSystem` is\n   * reachable only from engine code — never an HTTP payload — its re-attach allowlist is DERIVED\n   * from the schema rather than caller-supplied, and the row identity the seal binds to comes from\n   * the scope map, so a caller cannot name whose credential it is writing.\n   *\n   * ## `exportSubject: FORBIDDEN` matters MORE here than on the sibling, and the difference is real\n   *\n   * The organization-owned row is unreachable on the subject-export graph anyway, because no `USERS`\n   * relationship is registered for its `setByUserId` — the export walk simply never arrives. This row\n   * IS reachable: `userId` is a registered `USERS` composition, which is what gives the resource its\n   * USER_SELF scope in the first place. So the export walk arrives here BY CONSTRUCTION, and this\n   * refusal is the only thing standing between a subject-access request and a working third-party\n   * credential in the response.\n   */\n  systemAccessPolicy: {\n    exportSubject: ResourceSystemAccessMode.FORBIDDEN,\n    read: ResourceSystemAccessMode.ALLOWED,\n    list: ResourceSystemAccessMode.ALLOWED,\n    update: ResourceSystemAccessMode.ALLOWED,\n    create: ResourceSystemAccessMode.ALLOWED,\n  },\n\n  /**\n   * `RETAIN_ONLY`, and the row still does not survive its owner — the CASCADE removes it.\n   *\n   * These are two different mechanisms and reading them as one produces the wrong answer in both\n   * directions. The retention policy governs what the erasure WALK does to a row it retains: here,\n   * nothing, because a secret is not personal data to be pseudonymised. You do not scrub a\n   * credential, you destroy it. The `USERS → USER_PROVIDER_CREDENTIALS` composition is what destroys\n   * it, dispatching this resource's DELETE when the person is removed.\n   *\n   * So a person who exercises erasure does not leave a live credential behind, and the mechanism that\n   * guarantees it is the relationship rather than the policy. Declaring `RETAIN_AND_IMPERSONALIZE`\n   * instead would be actively wrong: it would keep the row and replace its fields, leaving a sealed\n   * envelope whose key material still opens against a subject who asked to be forgotten.\n   */\n  retentionPolicy: {\n    mode: ErasureRetentionMode.RETAIN_ONLY,\n  },\n\n  /**\n   * `NO_PRINCIPAL` on the axis this enum actually decides: erasing a credential revokes no session,\n   * because no login is reachable from it. `userId` names the OWNER, not a login this row confers.\n   */\n  dataSubjectPolicy: { kind: ResourceDataSubjectKind.NO_PRINCIPAL },\n\n  coreOperations: [\n    CoreResourceOperation.READ,\n    CoreResourceOperation.LIST,\n    CoreResourceOperation.CREATE,\n    CoreResourceOperation.UPDATE,\n    // Required by the USERS cascade — `onParentDelete` dispatches this DELETE — and it is also the\n    // holder's own \"remove this credential\" door.\n    CoreResourceOperation.DELETE,\n    // Route-less; `retentionPolicy` requires READ + LIST + UPDATE_MANY.\n    CoreResourceOperation.UPDATE_MANY,\n  ],\n\n  operationsConfiguration: {\n    /*\n     * `APP_USER` everywhere, and NO administrative variant anywhere — a stronger refusal than the\n     * organization-owned sibling's, which refuses only the PLATFORM operator.\n     *\n     * Here an organization administrator is refused too. The row is a key its holder authored against\n     * their own account with a vendor; consent to store it is not consent for somebody else to spend\n     * it, and the vendor would record the act as the holder's own. There is no support story that\n     * makes that reversible, and the USER_SELF primary-scope filter is what enforces it structurally\n     * rather than by a role list somebody could widen.\n     *\n     * The cost is that a personal credential cannot be repaired by anyone but its owner, which is the\n     * correct outcome: if the person is gone, the credential should be too, and the cascade sees to it.\n     */\n    [CoreResourceOperation.READ]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // LOW because the value never leaves: `.isWriteOnlySecret()` redacts it at the client\n          // boundary, so a READ returns metadata and a placeholder.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.LIST]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.LOW,\n          filterFields: USER_PROVIDER_CREDENTIALS_FILTER_FIELDS,\n          sortFields: USER_PROVIDER_CREDENTIALS_SORT_FIELDS,\n          maxPaginatedResultPerPageLimit: 100,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.CREATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // CRITICAL: the act of granting this application authority to act as the person toward a\n          // third party. That it is the person's own decision makes it consented, not low-risk.\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.UPDATE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n\n    [CoreResourceOperation.DELETE]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_USER],\n          // Revoking one's own credential is the safe direction and must never be harder than\n          // granting it.\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        },\n      ],\n    },\n\n    /**\n     * Route-less and INTERNAL_CALL only — the retention machinery's own door, never a client's.\n     *\n     * `retentionPolicy` requires READ + LIST + UPDATE_MANY to exist, and a bulk update reachable over\n     * HTTP on this resource would be a way to change many credentials at once, which no holder needs\n     * and no administrator may have.\n     */\n    [CoreResourceOperation.UPDATE_MANY]: {\n      variants: [\n        {\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          roles: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          riskLevel: ResourceOperationRiskLevel.CRITICAL,\n        },\n      ],\n    },\n  },\n});\n"]}