npm - @wildo-ai/saas-models - Versions diffs - 1.1.2 → 1.1.4 - Mend

@wildo-ai/saas-models 1.1.2 → 1.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (645) hide show

package/dist/esm/config/auth-config-resolution.shared.utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAkB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;SAClF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;KACzF,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n };\n}\n"]}
1	+ {"version":3,"file":"auth-config-resolution.shared.utils.js","sourceRoot":"","sources":["../../../src/config/auth-config-resolution.shared.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAyB9E,SAAS,eAAe,CAAC,KAAiD;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAA+B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAc,CAAC;IACrC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,eAAe,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kFAAkF;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAA0B;IAC9E,UAAU,CAAC,QAAQ;IACnB,UAAU,CAAC,OAAO;IAClB,UAAU,CAAC,UAAU;IACrB,UAAU,CAAC,OAAO;CACnB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,mCAAmC,CAAC,kBAAkC;IACpF,MAAM,MAAM,GAAmB,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,yCAAyC,EAAE,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,wBAAwB,CAC/B,eAAgC,EAChC,WAAiC,EACjC,MAA2B,EAC3B,UAAwB;IAExB,IAAI,CAAC,WAAW,EAAE,kBAAkB;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAErE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,mBAAmB,CAAC,aAAa;YACpC,OAAO,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEnD,KAAK,mBAAmB,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,mBAAmB,CAAC,YAAY;YACnC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QAE7B;YACE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,eAAgC,EAChC,YAAoC,EACpC,MAA2B,EAC3B,UAAwB;IAExB,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;IAEjE,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAC3C,wBAAwB,CAAC,eAAe,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CACjE,CAAC;IAEF,IAAI,MAAM,KAAK,mBAAmB,CAAC,iBAAiB,EAAE,CAAC;QACrD,iFAAiF;QACjF,8EAA8E;QAC9E,qFAAqF;QACrF,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,8EAA8E;AAE9E,SAAS,sBAAsB,CAC7B,IAAqB,EACrB,QAAkC;IAElC,OAAO;QACL,UAAU,EAAE,iBAAiB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,oBAAoB,EAAE,sBAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;QACtG,yBAAyB,EAAE,oBAAoB,CAAC,IAAI,CAAC,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,CAAC;QACnH,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,CAAC;KACnG,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAC/B,IAAqB,EACrB,YAAoC;IAEpC,MAAM,YAAY,GAAG,YAAY;SAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAiC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAElD,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,uBAAuB,CAAC,CAAkB,EAAE,CAAkB;IACrE,OAAO;QACL,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,oBAAoB,EAAE,sBAAsB,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,CAAC;QAC5F,yBAAyB,EAAE,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,EAAE,CAAC,CAAC,yBAAyB,CAAC;QACzG,oBAAoB,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;KAC/E,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,IAAsB,EAAE,QAAmC;IACtF,OAAO;QACL,+FAA+F;QAC/F,+EAA+E;QAC/E,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,KAAK,CAAC;QACpD,4FAA4F;QAC5F,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,aAAa,CAAC;QAC/E,wFAAwF;QACxF,OAAO,EAAE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,IAAkC,EAClC,YAAoC;IAEpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,eAAe,GAAG,YAAY;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAErD,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;QACjC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,aAAa,CAAC;QAC3D,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO;KACvE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,+EAA+E;AAE/E,SAAS,2BAA2B,CAClC,IAA0B,EAC1B,QAAuC;IAEvC,OAAO;QACL,SAAS,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACpE,SAAS,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;QACnE,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,gBAAgB,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC;QACrF,cAAc,EAAE,iBAAiB,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,cAAc,CAAC;QAC/E,mBAAmB,EAAE,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,CAAC;QAC9F,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,IAA0B,EAC1B,YAAoC;IAEpC,MAAM,WAAW,GAAG,YAAY;SAC7B,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAsC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IAEjD,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,OAAO,6BAA6B,CAClC,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,CAAuB,EAAE,CAAuB;IACpF,OAAO,6BAA6B,CAAC;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAC7C,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB;QAC1D,cAAc,EAAE,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,cAAc;QACpD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,mBAAmB;QACnE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,6BAA6B,CAAC,MAA4B;IACjE,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,IAAa,EAAE,QAA6B;IACrE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAE,QAA6B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,IAAI,QAAQ,CAAC;AAC1B,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,QAA4B;IACvE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAE,QAA4B;IACtE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,QAA4B;IACjE,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,IAAI,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,sBAAsB,CAAI,CAAkB,EAAE,CAAkB;IACvE,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAI,CAAS,EAAE,CAAS;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAK,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAI,CAAS,EAAE,CAAS;IACpC,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAgC;IAChE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,KAAK,CAAC;IAExF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,kBAAkB,EAAE,EAAE,GAAG,YAAY,CAAC,kBAAkB,EAAE;YAC1D,SAAS,EAAE,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE;YACxC,cAAc,EAAE,6BAA6B,CAAC,EAAE,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YACjF,UAAU,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,0BAA0B,CAChD,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,oBAAoB,IAAI,EAAE,CAC3B,CAAC;IAEF,OAAO;QACL,kBAAkB,EAAE,eAAe,CAAC,eAAe,CAAC;QACpD,SAAS,EAAE,wBAAwB,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC;QACzE,cAAc,EAAE,6BAA6B,CAAC,YAAY,CAAC,cAAc,EAAE,YAAY,CAAC;QACxF,UAAU,EAAE,qBAAqB,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC;KACzE,CAAC;AACJ,CAAC","sourcesContent":["/*\n W5.8: Auth Config Resolution — 3-tier merge with org overrides.\n \n Resolution order: User Type (base) → Org Type authOverrides (most-restrictive-wins).\n * Multi-org: each org type override resolved independently, then most-restrictive across all.\n \n This is a pure function — no DI, no DB, no side effects.\n /\n\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { OrgAuthMethodPolicy } from './entity-identity-config.shared.schemas';\nimport type { UserTypeAuthPolicy, OrgTypeAuthOverrides, MfaPolicyConfig, PasswordPolicyConfig, StepUpAuthConfig } from './entity-identity-config.shared.schemas';\n\nexport type AuthMethodsMap = Partial<Record<AuthMethod, boolean \| { enabled: boolean }>>;\n\nexport interface AuthConfigResolutionInput {\n userTypeAuth: UserTypeAuthPolicy;\n orgOverrides: OrgTypeAuthOverrides[];\n orgAuthMethodPolicy: OrgAuthMethodPolicy;\n expandableOrgMethods?: AuthMethod[];\n}\n\nexport interface ResolvedAuthConfig {\n authMethodsEnabled: AuthMethodsMap;\n mfaPolicy: MfaPolicyConfig;\n passwordPolicy: PasswordPolicyConfig;\n /\n Re-authentication freshness (#527). `undefined` when the user type declares no step-up policy —\n * an organisation cannot introduce step-up for a user type that has none, because there is no base\n * to be more restrictive THAN, and inventing one would let a tenant enable a gate the application\n * never configured.\n /\n stepUpAuth: StepUpAuthConfig \| undefined;\n}\n\nfunction isMethodEnabled(value: boolean \| { enabled: boolean } \| undefined): boolean {\n if (value === undefined) return false;\n if (typeof value === 'boolean') return value;\n return value.enabled;\n}\n\nexport function getEnabledMethods(map: AuthMethodsMap \| undefined): Set<AuthMethod> {\n if (!map) return new Set();\n const result = new Set<AuthMethod>();\n for (const [method, value] of Object.entries(map)) {\n if (isMethodEnabled(value)) result.add(method as AuthMethod);\n }\n return result;\n}\n\nfunction setToMethodsMap(methods: Set<AuthMethod>): AuthMethodsMap {\n const result: AuthMethodsMap = {};\n for (const method of Object.values(AuthMethod)) {\n result[method] = methods.has(method);\n }\n return result;\n}\n\n// ─── Directory-management posture derivation (AUTH-24) ─────────────────────────\n\n/\n Auth methods that establish a LOCAL first-factor credential — a way into the account that does\n * NOT go through the organization's external identity provider. For an org whose users are\n * directory-MANAGED (an IdP that both provisions AND deprovisions them via SCIM), such a credential\n * is a deprovisioning bypass: it keeps working after the IdP removes the user. Kept in sync with the\n * invite-accept block's `establishedCredentialMethod` set (auth-registration.backend.service.ts).\n * See `.claude/plans/auth-24-credential-lifecycle.md`.\n \n `SMS_OTP` is included because it is FIRST-factor-capable (`FIRST_OR_SECOND`) and its \"credential\"\n * — a verified, user-controlled phone number — is IdP-INDEPENDENT and survives deprovisioning, so an\n * SMS-OTP first-factor login is exactly the bypass this set closes. Neutralization is DORMANCY-only:\n * unlike PASSWORD/PASSKEY there is no stored secret for AUTH-24 Part 3 to physically destroy (the\n * phone is the user's, not a revocable secret), so disabling it in the effective policy — refused at\n * the first-factor login seam and at OTP issuance — is the complete measure. `EMAIL_OTP` is\n * deliberately EXCLUDED: it is `SECOND_ONLY`, so it has no first-factor bypass surface. (A directory-\n * managed user's MFA is owned by the IdP; disabling the method here removes it as a SECOND factor\n * too, consistent with how PASSKEY is handled — TOTP, an authenticator-app second factor, is\n * intentionally left intact.)\n /\nexport const DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.PASSKEY,\n AuthMethod.MAGIC_LINK,\n AuthMethod.SMS_OTP,\n];\n\n/\n AUTH-24 posture derivation (pure): return a COPY of `authMethodsEnabled` with every\n * {@link DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS} forced OFF. The backend policy resolver applies\n * this whenever the user belongs to any ACTIVELY directory-managed org, so the org's identity\n * posture wins over authored config — the same most-restrictive direction as the org-override merge.\n * This is the \"one authority axis, derived\" step: every first-factor login gate and every\n * credential-creation gate that reads the effective policy then honors directory management\n * automatically, without each site re-deriving it.\n /\nexport function disableDirectoryIncompatibleMethods(authMethodsEnabled: AuthMethodsMap): AuthMethodsMap {\n const result: AuthMethodsMap = { ...authMethodsEnabled };\n for (const method of DIRECTORY_INCOMPATIBLE_LOCAL_AUTH_METHODS) {\n result[method] = false;\n }\n return result;\n}\n\n// ─── Auth Methods Resolution ────────────────────────────────────────────────\n\nfunction resolveAuthMethodsSingle(\n userTypeMethods: Set<AuthMethod>,\n orgOverride: OrgTypeAuthOverrides,\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n if (!orgOverride?.authMethodsEnabled) return new Set(userTypeMethods);\n\n const orgMethods = getEnabledMethods(orgOverride.authMethodsEnabled);\n\n switch (policy) {\n case OrgAuthMethodPolicy.RESTRICT_ONLY:\n return intersection(userTypeMethods, orgMethods);\n\n case OrgAuthMethodPolicy.EXPAND_WITHIN_SET: {\n const expandableSet = new Set(expandable);\n const expansions = intersection(orgMethods, expandableSet);\n return union(userTypeMethods, expansions);\n }\n\n case OrgAuthMethodPolicy.UNRESTRICTED:\n return new Set(orgMethods);\n\n default:\n return new Set(userTypeMethods);\n }\n}\n\nfunction resolveAuthMethodsMultiOrg(\n userTypeMethods: Set<AuthMethod>,\n orgOverrides: OrgTypeAuthOverrides[],\n policy: OrgAuthMethodPolicy,\n expandable: AuthMethod[],\n): Set<AuthMethod> {\n const validOverrides = orgOverrides.filter(o => o?.authMethodsEnabled);\n if (validOverrides.length === 0) return new Set(userTypeMethods);\n\n const perOrgResults = validOverrides.map(o =>\n resolveAuthMethodsSingle(userTypeMethods, o, policy, expandable),\n );\n\n if (policy === OrgAuthMethodPolicy.EXPAND_WITHIN_SET) {\n // SEC-W5.13-FIX-1b: Most-restrictive-wins across orgs — intersection, not union.\n // Each org may expand within the expandable set, but multi-org users only get\n // methods that ALL their orgs agree on (consistent with restrict_only/unrestricted).\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n }\n\n return perOrgResults.reduce((acc, set) => intersection(acc, set));\n}\n\n// ─── MFA Policy Resolution ─────────────────────────────────────────────────\n\nfunction resolveMfaPolicySingle(\n base: MfaPolicyConfig,\n override: Partial<MfaPolicyConfig>,\n): MfaPolicyConfig {\n return {\n requireMFA: mergeBoolTrueWins(base.requireMFA, override.requireMFA),\n requireStrongMFA: mergeBoolTrueWins(base.requireStrongMFA, override.requireStrongMFA),\n acceptableMFAMethods: mergeArrayIntersection(base.acceptableMFAMethods, override.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(base.enrollmentGracePeriodDays, override.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: mergeBoolFalseWins(base.passkeyExemptFromMFA, override.passkeyExemptFromMFA),\n };\n}\n\nfunction resolveMfaPolicyMultiOrg(\n base: MfaPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): MfaPolicyConfig {\n const mfaOverrides = orgOverrides\n .map(o => o?.mfaPolicy)\n .filter((p): p is Partial<MfaPolicyConfig> => !!p);\n if (mfaOverrides.length === 0) return { ...base };\n\n const perOrgResults = mfaOverrides.map(o => resolveMfaPolicySingle(base, o));\n return perOrgResults.reduce((acc, r) => mergeMfaMostRestrictive(acc, r));\n}\n\nfunction mergeMfaMostRestrictive(a: MfaPolicyConfig, b: MfaPolicyConfig): MfaPolicyConfig {\n return {\n requireMFA: a.requireMFA \|\| b.requireMFA,\n requireStrongMFA: a.requireStrongMFA \|\| b.requireStrongMFA,\n acceptableMFAMethods: mergeArrayIntersection(a.acceptableMFAMethods, b.acceptableMFAMethods),\n enrollmentGracePeriodDays: mergeNumberLowerWins(a.enrollmentGracePeriodDays, b.enrollmentGracePeriodDays),\n passkeyExemptFromMFA: !a.passkeyExemptFromMFA ? false : b.passkeyExemptFromMFA,\n };\n}\n\n// ─── Step-Up Auth Resolution ────────────────────────────────────────────────\n\nfunction resolveStepUpSingle(base: StepUpAuthConfig, override: Partial<StepUpAuthConfig>): StepUpAuthConfig {\n return {\n // Either side turning step-up ON wins: an organisation may require re-authentication where the\n // application does not, and may never switch off one the application requires.\n enabled: base.enabled \|\| (override.enabled ?? false),\n // The SHORTER window wins — the opposite arithmetic to `enabled`, same direction of intent.\n maxAgeSeconds: mergeNumberLowerWins(base.maxAgeSeconds, override.maxAgeSeconds),\n // Intersection: an organisation may WITHDRAW an acceptable method, never introduce one.\n methods: mergeArrayIntersection(base.methods, override.methods) ?? base.methods,\n };\n}\n\nfunction resolveStepUpMultiOrg(\n base: StepUpAuthConfig \| undefined,\n orgOverrides: OrgTypeAuthOverrides[],\n): StepUpAuthConfig \| undefined {\n if (base === undefined) return undefined;\n const stepUpOverrides = orgOverrides\n .map(o => o?.stepUpAuth)\n .filter((p): p is Partial<StepUpAuthConfig> => !!p);\n if (stepUpOverrides.length === 0) return { ...base };\n\n const perOrgResults = stepUpOverrides.map(o => resolveStepUpSingle(base, o));\n return perOrgResults.reduce((acc, r) => ({\n enabled: acc.enabled \|\| r.enabled,\n maxAgeSeconds: Math.min(acc.maxAgeSeconds, r.maxAgeSeconds),\n methods: mergeArrayIntersection(acc.methods, r.methods) ?? acc.methods,\n }));\n}\n\n// ─── Password Policy Resolution ─────────────────────────────────────────────\n\nfunction resolvePasswordPolicySingle(\n base: PasswordPolicyConfig,\n override: Partial<PasswordPolicyConfig>,\n): PasswordPolicyConfig {\n return {\n minLength: mergeNumberHigherWins(base.minLength, override.minLength),\n maxLength: mergeNumberLowerWins(base.maxLength, override.maxLength),\n requireUppercase: mergeBoolTrueWins(base.requireUppercase, override.requireUppercase),\n requireLowercase: mergeBoolTrueWins(base.requireLowercase, override.requireLowercase),\n requireNumbers: mergeBoolTrueWins(base.requireNumbers, override.requireNumbers),\n requireSpecialChars: mergeBoolTrueWins(base.requireSpecialChars, override.requireSpecialChars),\n expiryDays: mergeExpiryDays(base.expiryDays, override.expiryDays),\n };\n}\n\nfunction resolvePasswordPolicyMultiOrg(\n base: PasswordPolicyConfig,\n orgOverrides: OrgTypeAuthOverrides[],\n): PasswordPolicyConfig {\n const pwOverrides = orgOverrides\n .map(o => o?.passwordPolicy)\n .filter((p): p is Partial<PasswordPolicyConfig> => !!p);\n if (pwOverrides.length === 0) return { ...base };\n\n const perOrgResults = pwOverrides.map(o => resolvePasswordPolicySingle(base, o));\n return normalizePasswordPolicyBounds(\n perOrgResults.reduce((acc, r) => mergePasswordMostRestrictive(acc, r)),\n );\n}\n\nfunction mergePasswordMostRestrictive(a: PasswordPolicyConfig, b: PasswordPolicyConfig): PasswordPolicyConfig {\n return normalizePasswordPolicyBounds({\n minLength: Math.max(a.minLength, b.minLength),\n maxLength: Math.min(a.maxLength, b.maxLength),\n requireUppercase: a.requireUppercase \|\| b.requireUppercase,\n requireLowercase: a.requireLowercase \|\| b.requireLowercase,\n requireNumbers: a.requireNumbers \|\| b.requireNumbers,\n requireSpecialChars: a.requireSpecialChars \|\| b.requireSpecialChars,\n expiryDays: mergeExpiryDays(a.expiryDays, b.expiryDays),\n });\n}\n\n/\n Independent higher-min / lower-max merges can cross when multiple org overrides\n * conflict. Collapse that impossible range to an exact-length policy at the stricter\n * minimum so downstream consumers always receive a valid password policy.\n */\nfunction normalizePasswordPolicyBounds(policy: PasswordPolicyConfig): PasswordPolicyConfig {\n if (policy.maxLength >= policy.minLength) {\n return policy;\n }\n\n return {\n ...policy,\n maxLength: policy.minLength,\n };\n}\n\n// ─── Merge Primitives ───────────────────────────────────────────────────────\n\nfunction mergeBoolTrueWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base \|\| override;\n}\n\nfunction mergeBoolFalseWins(base: boolean, override: boolean \| undefined): boolean {\n if (override === undefined) return base;\n return base && override;\n}\n\nfunction mergeNumberHigherWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.max(base, override);\n}\n\nfunction mergeNumberLowerWins(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n return Math.min(base, override);\n}\n\nfunction mergeExpiryDays(base: number, override: number \| undefined): number {\n if (override === undefined) return base;\n if (base === 0 && override === 0) return 0;\n if (base === 0) return override;\n if (override === 0) return base;\n return Math.min(base, override);\n}\n\nfunction mergeArrayIntersection<T>(a: T[] \| undefined, b: T[] \| undefined): T[] \| undefined {\n if (a === undefined) return b;\n if (b === undefined) return a;\n const setB = new Set(b);\n return a.filter(item => setB.has(item));\n}\n\n// ─── Set Helpers ────────────────────────────────────────────────────────────\n\nfunction intersection<T>(a: Set<T>, b: Set<T>): Set<T> {\n const result = new Set<T>();\n for (const item of a) {\n if (b.has(item)) result.add(item);\n }\n return result;\n}\n\nfunction union<T>(a: Set<T>, b: Set<T>): Set<T> {\n return new Set([...a, ...b]);\n}\n\n// ─── Public API ─────────────────────────────────────────────────────────────\n\nexport function resolveAuthConfig(input: AuthConfigResolutionInput): ResolvedAuthConfig {\n const { userTypeAuth, orgOverrides, orgAuthMethodPolicy, expandableOrgMethods } = input;\n\n if (!orgOverrides.length) {\n return {\n authMethodsEnabled: { ...userTypeAuth.authMethodsEnabled },\n mfaPolicy: { ...userTypeAuth.mfaPolicy },\n passwordPolicy: normalizePasswordPolicyBounds({ ...userTypeAuth.passwordPolicy }),\n stepUpAuth: userTypeAuth.stepUpAuth ? { ...userTypeAuth.stepUpAuth } : undefined,\n };\n }\n\n const userTypeMethods = getEnabledMethods(userTypeAuth.authMethodsEnabled);\n const resolvedMethods = resolveAuthMethodsMultiOrg(\n userTypeMethods,\n orgOverrides,\n orgAuthMethodPolicy,\n expandableOrgMethods ?? [],\n );\n\n return {\n authMethodsEnabled: setToMethodsMap(resolvedMethods),\n mfaPolicy: resolveMfaPolicyMultiOrg(userTypeAuth.mfaPolicy, orgOverrides),\n passwordPolicy: resolvePasswordPolicyMultiOrg(userTypeAuth.passwordPolicy, orgOverrides),\n stepUpAuth: resolveStepUpMultiOrg(userTypeAuth.stepUpAuth, orgOverrides),\n };\n}\n"]}

package/dist/esm/config/brand-assets.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}
1	+ {"version":3,"file":"brand-assets.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/brand-assets.shared.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,qBAAqB;IAC/B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,IAAI,SAAS;IACb,KAAK,UAAU;IACf,UAAU,eAAe;CAC1B;AAED,oBAAY,iBAAiB;IAC3B;;;;;OAKG;IACH,MAAM,WAAW;IACjB,mFAAmF;IACnF,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,KAAK,UAAU;CAChB;AAED,oBAAY,gBAAgB;IAC1B,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,QAAA,MAAM,wBAAwB;;;;;;;;iBAS5B,CAAC;AACH,eAAO,MAAM,uBAAuB,EAAE,OAAO,wBAAmD,CAAC;AACjG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEzE,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,qBAAqB,CAAC;IACnC,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,iBAAiB,EAAE,EAC3B,KAAK,EAAE,eAAe,GACrB,iBAAiB,GAAG,SAAS,CAsB/B"}

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts CHANGED Viewed

@@ -70,10 +70,17 @@ export declare const RegistrationConfigSchema: z.ZodObject<{
     mode: z.ZodEnum<typeof RegistrationMode>;
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -139,10 +146,17 @@ export declare const UserTypeAuthPolicySchema: z.ZodObject<{
         mode: z.ZodEnum<typeof RegistrationMode>;
         /**
          * Only acquisition methods with a complete public-signup implementation are accepted.
-         * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-         * end-to-end registration flow; declaring them here would otherwise advertise a path
-         * the runtime cannot execute.
-        */
+         *
+         * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+         * registration in #463; before that they were authentication and enrollment methods only, and
+         * declaring one here was refused because it would have advertised a path the runtime could not
+         * execute.
+         *
+         * A password-less signup creates the account with NO credential and proves the address by a magic
+         * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+         * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+         * nothing. See `registerUser`.
+         */
         allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
         /** D-19: 'deferred' gives immediate access, verify later. */
         emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -197,10 +211,17 @@ export declare const UserTypeDefinitionSchema: z.ZodObject<{
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -276,7 +297,41 @@ export declare const FrontendServiceDefinitionSchema: z.ZodObject<{
     frontendType: z.ZodOptional<z.ZodEnum<typeof AppFrontendType>>;
 }, z.core.$strip>;
 export type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export declare enum OrganizationNameSource {
     ASK = "ask",
     AUTO = "auto",
@@ -309,6 +364,11 @@ export declare const OrgTypeAuthOverridesSchema: z.ZodOptional<z.ZodObject<{
         requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
         expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
     }, z.core.$strip>>;
+    stepUpAuth: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+        methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+    }, z.core.$strip>>;
 }, z.core.$strip>>;
 export type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
@@ -341,6 +401,11 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
@@ -353,6 +418,7 @@ export declare const OrganizationTypeDefinitionSchema: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;
+/** @wildo_source:part:end saas.models.config.organization-types */
 export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     auth: z.ZodObject<{
         authMethodsEnabled: z.ZodDefault<z.ZodRecord<z.ZodEnum<typeof AuthMethod> & z.core.$partial, z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
@@ -369,10 +435,17 @@ export declare const UserTypesConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject
             mode: z.ZodEnum<typeof RegistrationMode>;
             /**
              * Only acquisition methods with a complete public-signup implementation are accepted.
-             * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-             * end-to-end registration flow; declaring them here would otherwise advertise a path
-             * the runtime cannot execute.
-            */
+             *
+             * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+             * registration in #463; before that they were authentication and enrollment methods only, and
+             * declaring one here was refused because it would have advertised a path the runtime could not
+             * execute.
+             *
+             * A password-less signup creates the account with NO credential and proves the address by a magic
+             * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+             * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+             * nothing. See `registerUser`.
+             */
             allowedMethods: z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>;
             /** D-19: 'deferred' gives immediate access, verify later. */
             emailVerification: z.ZodDefault<z.ZodEnum<typeof EmailVerificationMode>>;
@@ -450,6 +523,11 @@ export declare const OrganizationTypesConfigSchema: z.ZodRecord<z.ZodString, z.Z
             requireSpecialChars: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
             expiryDays: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
         }, z.core.$strip>>;
+        stepUpAuth: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+            maxAgeSeconds: z.ZodOptional<z.ZodDefault<z.ZodNumber>>;
+            methods: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEnum<typeof AuthMethod>>>>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     scimProvisioning: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;

package/dist/esm/config/entity-identity-config.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../~~src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC~~;;;;;MAKE~~;;~~IAEF~~,6DAA6D;;IAE7D,yFAAyF;;~~kBAyBzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;~~QAzFnC;;;;;UAKE~~;;~~QAEF~~,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAsJzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;~~YApKnC;;;;;cAKE~~;;~~YAEF~~,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAwKzF~~,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF~~,gFAAgF~~;~~AAChF~~,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B~~;;;;;;;;;;;;;;;;;;;;kBAI1B~~,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;~~AAI1F~~,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;~~YA3QhC;;;;;cAKE~~;;~~YAEF~~,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBAkQR~~,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAkB,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAkB,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAIrE,kDAAkD;AAClD,oBAAY,gBAAgB;IAC1B,IAAI,SAAS;IACb,eAAe,oBAAoB;IACnC,UAAU,eAAe;IACzB,QAAQ,aAAa;CACtB;AAED;;;;;;GAMG;AACH,oBAAY,8BAA8B;IACxC,mBAAmB,wBAAwB;IAC3C,gBAAgB,qBAAqB;IACrC,kBAAkB,uBAAuB;IACzC,UAAU,eAAe;IACzB,2BAA2B,gCAAgC;CAC5D;AAED,uCAAuC;AACvC,oBAAY,qBAAqB;IAC/B,sBAAsB,2BAA2B;IACjD,QAAQ,aAAa;CACtB;AAED,qEAAqE;AACrE,oBAAY,mBAAmB;IAC7B,aAAa,kBAAkB;IAC/B,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC9B;AAID,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAUtF,eAAO,MAAM,qBAAqB;;;;;;iBAUhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;IAEnC;;;;;;;;;;;;OAYG;;IAEH,6DAA6D;;IAE7D,yFAAyF;;kBAsCzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;iBASrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,yBAAyB;;;;;iBAOpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,4BAA4B;;;iBAGvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAIlF;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;QA7GnC;;;;;;;;;;;;WAYG;;QAEH,6DAA6D;;QAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0KzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;YA/LnC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4LzF,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAI1E,eAAO,MAAM,wCAAwC;;;;iBAInD,CAAC;AACH,MAAM,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,+BAA+B;;;;;;;iBAG1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAIxF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,oBAAY,sBAAsB;IAChC,GAAG,QAAQ;IACX,IAAI,SAAS;IACb,UAAU,eAAe;CAC1B;AAED,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;kBAmB1B,CAAC;AACd,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,4FAA4F;AAC5F,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAoB3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,mEAAmE;AAInE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;YAxVhC;;;;;;;;;;;;eAYG;;YAEH,6DAA6D;;YAE7D,yFAAyF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAwUR,CAAC;AACpF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,4BAA4B;;;;;;;kBAAwD,CAAC;AAClG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBA8BtC,CAAC;AACL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,MAAM,WAAW,yCAAyC,CACxD,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,GAAG,0BAA0B;IAE9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,+CAA+C,CAC7D,WAAW,SAAS;IAClB,QAAQ,CAAC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CAC7C,EAED,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,GAAG,SAAS,EACpE,kBAAkB,EAAE,MAAM,GACzB,SAAS,yCAAyC,CAAC,WAAW,CAAC,EAAE,CAYnE"}

package/dist/esm/config/entity-identity-config.shared.schemas.js CHANGED Viewed

@@ -84,18 +84,39 @@ export const RegistrationConfigSchema = z.strictObject({
     mode: z.enum(RegistrationMode),
     /**
      * Only acquisition methods with a complete public-signup implementation are accepted.
-     * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an
-     * end-to-end registration flow; declaring them here would otherwise advertise a path
-     * the runtime cannot execute.
-    */
+     *
+     * PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public
+     * registration in #463; before that they were authentication and enrollment methods only, and
+     * declaring one here was refused because it would have advertised a path the runtime could not
+     * execute.
+     *
+     * A password-less signup creates the account with NO credential and proves the address by a magic
+     * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —
+     * "access now, verify later" is not a state the runtime can produce for a registrant who holds
+     * nothing. See `registerUser`.
+     */
     allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),
     /** D-19: 'deferred' gives immediate access, verify later. */
     emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),
     /** R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. */
     blockForSSODomains: z.boolean().default(false),
 }).superRefine((registration, ctx) => {
-    const unsupportedMethods = registration.allowedMethods.filter((method) => method !== AuthMethod.PASSWORD
-        && method !== AuthMethod.EXTERNAL_OAUTH2);
+    /*
+     * The set with a public-signup implementation. It is enumerated rather than open because the
+     * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and
+     * one the runtime cannot execute fails after they have committed to it.
+     *
+     * MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication
+     * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it
+     * here means building that flow first, not widening this list.
+     */
+    const publiclyRegisterableMethods = [
+        AuthMethod.PASSWORD,
+        AuthMethod.EXTERNAL_OAUTH2,
+        AuthMethod.MAGIC_LINK,
+        AuthMethod.PASSKEY,
+    ];
+    const unsupportedMethods = registration.allowedMethods.filter((method) => !publiclyRegisterableMethods.includes(method));
     if (unsupportedMethods.length > 0) {
         ctx.addIssue({
             code: 'custom',
@@ -179,7 +200,14 @@ export const UserTypeAuthPolicySchema = z.object({
     }),
     /** E-8: Session duration for this user type. */
     sessionDurationMinutes: z.number().min(1).max(1440).default(30),
-    /** E-8, G-2: undefined = unlimited. */
+    /**
+     * E-8, G-2: the cap on simultaneous refresh chains for this user type.
+     *
+     * Leaving it undefined does NOT mean unlimited. The token issuer falls back to
+     * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type
+     * that declares nothing is still capped. There is no value that disables the cap; declare the
+     * number you want.
+     */
     maxConcurrentSessions: z.number().min(1).optional(),
     /** G-1: Per-user-type lockout. Backend-only. */
     lockoutPolicy: LockoutPolicyConfigSchema.default({
@@ -250,7 +278,41 @@ export const FrontendServiceDefinitionSchema = z.object({
     frontendType: z.enum(AppFrontendType).optional(),
 });
 // ─── Organization Type ──────────────────────────────────────────────────────
-/** How a registration-derived organization obtains its initial display name. */
+/**
+ * @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer
+ *
+ * An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles
+ * exist inside it, whether it can come into existence through sign-up, and how hard it is for its
+ * members to prove who they are. Declared as `organizationTypes` in the application configuration.
+ *
+ * ## A type only self-creates if it says so
+ *
+ * `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a
+ * tenant of this type into existence. A type an administrator creates simply omits the policy — and
+ * a user type may match AT MOST ONE organization type, which the schema enforces rather than
+ * resolving by record order.
+ *
+ * `orgNameSource` decides where that tenant's first display name comes from: `ASK` during
+ * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who
+ * the registrant becomes.
+ *
+ * ## `authOverrides` tightens, and can never loosen
+ *
+ * A tenant may restrict how its own members authenticate, on four axes and no others — enabled
+ * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and
+ * registration are NOT organization-overridable.
+ *
+ * Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but
+ * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR
+ * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and
+ * `methods` intersects — an organization can withdraw an acceptable re-authentication method and
+ * never introduce one the user type does not already allow.
+ *
+ * When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging
+ * to a permissive tenant never restores what a strict one removed.
+ *
+ * How a registration-derived organization obtains its initial display name.
+ */
 export var OrganizationNameSource;
 (function (OrganizationNameSource) {
     OrganizationNameSource["ASK"] = "ask";
@@ -267,6 +329,21 @@ export const OrgTypeAuthOverridesSchema = z.object({
     authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),
     mfaPolicy: MfaPolicyConfigSchema.partial().optional(),
     passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),
+    /**
+     * Re-authentication freshness, added 2026-09-09 (#527).
+     *
+     * The other three overrides and this one answer ONE question — how hard is it for this tenant's
+     * members to prove who they are — and until now a tenant could tighten three of them. An
+     * organisation that requires MFA and a 16-character password could still have a member mutate a
+     * sensitive resource on an eight-hour-old session, because the app-wide default said so.
+     *
+     * Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic
+     * directions and that is worth stating rather than inferring: `enabled` is an OR (either side
+     * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`
+     * intersects, so an organisation can withdraw an acceptable re-authentication method but never
+     * introduce one the user type does not already allow.
+     */
+    stepUpAuth: StepUpAuthConfigSchema.partial().optional(),
 }).optional();
 /** G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). */
 export const OrgScimProvisioningSchema = z.object({
@@ -289,6 +366,7 @@ export const OrganizationTypeDefinitionSchema = z.object({
     scimProvisioning: OrgScimProvisioningSchema.optional(),
     creationPolicy: OrgCreationPolicySchema.optional(),
 });
+/** @wildo_source:part:end saas.models.config.organization-types */
 // ─── Top-Level Config Sections ──────────────────────────────────────────────
 export const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);
 export const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);

package/dist/esm/config/entity-identity-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;MAKE;IACF,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CACT,MAAM,KAAK,UAAU,CAAC,QAAQ;WAC3B,MAAM,KAAK,UAAU,CAAC,eAAe,CAC3C,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D,uCAAuC;IACvC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,gFAAgF;AAChF,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChE,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n * MAGIC_LINK and PASSKEY remain authentication/enrollment methods until they own an\n * end-to-end registration flow; declaring them here would otherwise advertise a path\n * the runtime cannot execute.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) =>\n method !== AuthMethod.PASSWORD\n && method !== AuthMethod.EXTERNAL_OAUTH2,\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /* E-8, G-2: undefined = unlimited. /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/* How a registration-derived organization obtains its initial display name. /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}
1	+ {"version":3,"file":"entity-identity-config.shared.schemas.js","sourceRoot":"","sources":["../../../src/config/entity-identity-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,2DAA2D,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AAErE,+EAA+E;AAE/E,kDAAkD;AAClD,MAAM,CAAN,IAAY,gBAKX;AALD,WAAY,gBAAgB;IAC1B,iCAAa,CAAA;IACb,uDAAmC,CAAA;IACnC,6CAAyB,CAAA;IACzB,yCAAqB,CAAA;AACvB,CAAC,EALW,gBAAgB,KAAhB,gBAAgB,QAK3B;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,8BAMX;AAND,WAAY,8BAA8B;IACxC,6EAA2C,CAAA;IAC3C,uEAAqC,CAAA;IACrC,2EAAyC,CAAA;IACzC,2DAAyB,CAAA;IACzB,6FAA2D,CAAA;AAC7D,CAAC,EANW,8BAA8B,KAA9B,8BAA8B,QAMzC;AAED,uCAAuC;AACvC,MAAM,CAAN,IAAY,qBAGX;AAHD,WAAY,qBAAqB;IAC/B,0EAAiD,CAAA;IACjD,8CAAqB,CAAA;AACvB,CAAC,EAHW,qBAAqB,KAArB,qBAAqB,QAGhC;AAED,qEAAqE;AACrE,MAAM,CAAN,IAAY,mBAIX;AAJD,WAAY,mBAAmB;IAC7B,sDAA+B,CAAA;IAC/B,8DAAuC,CAAA;IACvC,oDAA6B,CAAA;AAC/B,CAAC,EAJW,mBAAmB,KAAnB,mBAAmB,QAI9B;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAErF,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,uFAAuF;IACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5C,6FAA6F;IAC7F,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5D,yIAAyI;IACzI,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,+GAA+G;IAC/G,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChD,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,YAAY,CAAC;IACrD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC1E,6DAA6D;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC;IACtG,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAC,WAAW,CAAC,CAAC,YAAY,EAAE,GAAG,EAAE,EAAE;IACnC;;;;;;;;OAQG;IACH,MAAM,2BAA2B,GAA0B;QACzD,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,OAAO;KACnB,CAAC;IACF,MAAM,kBAAkB,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC1D,CAAC;IACF,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,4CAA4C,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IACE,YAAY,CAAC,IAAI,KAAK,gBAAgB,CAAC,IAAI;WACxC,YAAY,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3C,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAClD,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,uHAAuH;IACvH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;CACzC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;CACpE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/D,sJAAsJ;IACtJ,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAC9C,2DAA2D;IAC3D,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,sBAAsB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACjD,6BAA6B,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC1D,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,8DAA8D;IAC9D,kBAAkB,EAAE,CAAC,CAAC,aAAa,CACjC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAClB,qBAAqB,CACtB,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAE1C,+CAA+C;IAC/C,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACvC,UAAU,EAAE,KAAK;QACjB,gBAAgB,EAAE,KAAK;QACvB,yBAAyB,EAAE,CAAC;QAC5B,oBAAoB,EAAE,IAAI;KAC3B,CAAC;IAEF,4FAA4F;IAC5F,YAAY,EAAE,wBAAwB;IAEtC,4CAA4C;IAC5C,cAAc,EAAE,0BAA0B,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;QAC1B,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,gDAAgD;IAChD,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAE/D;;;;;;;OAOG;IACH,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEnD,gDAAgD;IAChD,aAAa,EAAE,yBAAyB,CAAC,OAAO,CAAC;QAC/C,gBAAgB,EAAE,CAAC;QACnB,sBAAsB,EAAE,EAAE;QAC1B,kBAAkB,EAAE,KAAK;QACzB,0BAA0B,EAAE,EAAE;KAC/B,CAAC;IAEF,gEAAgE;IAChE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAE1C,2FAA2F;IAC3F,UAAU,EAAE,sBAAsB,CAAC,QAAQ,EAAE;IAE7C,gBAAgB,EAAE,4BAA4B,CAAC,OAAO,CAAC;QACrD,sBAAsB,EAAE,IAAI;QAC5B,6BAA6B,EAAE,KAAK;KACrC,CAAC;IAEF;;8GAE0G;IAC1G,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEhD,iJAAiJ;IACjJ,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE5C;;;;;;mHAM+G;IAC/G,+BAA+B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpE,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,yFAAyF;IACzF,IAAI,EAAE,wBAAwB;IAE9B,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IAE7C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAE3E,yFAAyF;IACzF,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;KACrC,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAN,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,qCAAW,CAAA;IACX,uCAAa,CAAA;IACb,mDAAyB,CAAA;AAC3B,CAAC,EAJW,sBAAsB,KAAtB,sBAAsB,QAIjC;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IAC7C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC;CAC/D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC,CAAC,QAAQ,EAAE;IACzF,SAAS,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrD,cAAc,EAAE,0BAA0B,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/D;;;;;;;;;;;;;OAaG;IACH,UAAU,EAAE,sBAAsB,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC,QAAQ,EAAE,CAAC;AAGd,4FAA4F;AAC5F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAErC,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACxE,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,SAAS;QACxB,cAAc,CAAC,UAAU;KAC1B,CAAC;IAEF,mDAAmD;IACnD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC;IAE3F,mEAAmE;IACnE,aAAa,EAAE,0BAA0B;IAEzC,kDAAkD;IAClD,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IAEtD,cAAc,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAC;AAEH,mEAAmE;AAEnE,+EAA+E;AAE/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;AAGpF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,+BAA+B,CAAC,CAAC;AAGlG,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gCAAgC,CAAC;KACpD,WAAW,CAAC,CAAC,iBAAiB,EAAE,GAAG,EAAE,EAAE;IACtC,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5D,KAAK,MAAM,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CACzD,iBAAiB,CAClB,EAAE,CAAC;QACF,MAAM,mBAAmB,GACvB,UAAU,CAAC,cAAc,EAAE,4BAA4B,IAAI,EAAE,CAAC;QAChE,mBAAmB,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC9C,MAAM,aAAa,GAAG,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE;wBACJ,gBAAgB;wBAChB,gBAAgB;wBAChB,8BAA8B;wBAC9B,KAAK;qBACN;oBACD,OAAO,EACL,cAAc,QAAQ,sCAAsC;0BAC1D,IAAI,aAAa,0CAA0C;0BAC3D,8DAA8D;iBACnE,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,yBAAyB,CAAC,GAAG,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAYL;;;;;;GAMG;AACH,MAAM,UAAU,+CAA+C,CAK7D,iBAAoE,EACpE,kBAA0B;IAE1B,IAAI,CAAC,iBAAiB;QAAE,OAAO,EAAE,CAAC;IAClC,OAAO,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;SACrC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,cAAc,EAAE,4BAA4B,CAAC,QAAQ,CAC9D,kBAAkB,CACnB,CACF;SACA,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC,CAAC;AACR,CAAC","sourcesContent":["/*\n Entity & Identity Configuration Schemas\n \n Top-level config sections: userTypes, frontendServices, organizationTypes.\n * Defines the identity model for the application (user facets, frontend-surface-to-user-type mapping, org typing).\n \n Auth policy is ENTIRELY per-user-type (UserTypeAuthPolicySchema) — no global auth defaults.\n * Global auth (in app-configuration-shared) contains only infrastructure + app-level settings.\n \n See:\n * - target-configuration-type.md §2b (UserTypeAuthPolicy)\n * - entity-identity-architecture-analysis.md §4.2\n /\n\nimport { z } from 'zod';\nimport { AuthMethod } from '../security/authentications/authentication.shared.schemas';\nimport { AppRolesSchema, CORE_APP_ROLES } from '../security/authorizations/roles.shared.schemas';\nimport { CORE_ORG_ROLES, OrgRolesSchema } from '../security/authorizations/roles.shared.schemas';\nimport { AppFrontendType } from './app-frontend-type.shared.schemas';\n\n// ─── Enums ──────────────────────────────────────────────────────────────────\n\n/* Canonical registration-policy discriminant. /\nexport enum RegistrationMode {\n OPEN = 'open',\n INVITATION_ONLY = 'invitation_only',\n ADMIN_ONLY = 'admin_only',\n DISABLED = 'disabled',\n}\n\n/\n Semantically distinct ways in which a user can acquire a user type.\n \n Keep these channels separate even when two currently share the same mode matrix: the actor,\n * user intent, and security boundary differ, and future policy can evolve one without silently\n * changing the others.\n /\nexport enum RegistrationAcquisitionChannel {\n PUBLIC_SELF_SERVICE = 'public_self_service',\n SOCIAL_OAUTH_JIT = 'social_oauth_jit',\n ENTERPRISE_SSO_JIT = 'enterprise_sso_jit',\n INVITATION = 'invitation',\n ADMINISTRATIVE_PROVISIONING = 'administrative_provisioning',\n}\n\n/* D-19: Email verification timing. /\nexport enum EmailVerificationMode {\n REQUIRED_BEFORE_ACCESS = 'required_before_access',\n DEFERRED = 'deferred',\n}\n\n/* E-10, D-15: How much orgs can override user-type auth methods. /\nexport enum OrgAuthMethodPolicy {\n RESTRICT_ONLY = 'restrict_only',\n EXPAND_WITHIN_SET = 'expand_within_set',\n UNRESTRICTED = 'unrestricted',\n}\n\n// ─── Auth Method Expanded Config (D-20) ─────────────────────────────────────\n\nexport const AuthMethodExpandedConfigSchema = z.object({\n enabled: z.boolean(),\n});\nexport type AuthMethodExpandedConfig = z.infer<typeof AuthMethodExpandedConfigSchema>;\n\n/\n authMethodsEnabled value: boolean shorthand OR expanded config.\n * Shorthand: PASSWORD: true → normalized at runtime to { enabled: true }.\n /\nconst AuthMethodValueSchema = z.union([z.boolean(), AuthMethodExpandedConfigSchema]);\n\n// ─── Policy Sub-Types ───────────────────────────────────────────────────────\n\nexport const MfaPolicyConfigSchema = z.object({\n requireMFA: z.boolean().default(false),\n /* D-4: EMAIL_OTP alone insufficient when true. Requires TOTP, Passkey, or SMS_OTP. /\n requireStrongMFA: z.boolean().default(false),\n /* Restricts which MFA methods count. Intersected with authMethodsEnabled second factors. /\n acceptableMFAMethods: z.array(z.enum(AuthMethod)).optional(),\n /* D-17: days only — enrollmentGraceLogins REMOVED. 0 = must enroll on first login. Enforced via firstMfaPromptAt on UserCredentials. /\n enrollmentGracePeriodDays: z.number().min(0).max(365).default(0),\n /* C-5 migration: migrated to config from the now-removed AuthPolicyBase resource. Passkey IS multi-factor. /\n passkeyExemptFromMFA: z.boolean().default(true),\n});\nexport type MfaPolicyConfig = z.infer<typeof MfaPolicyConfigSchema>;\n\n/\n Registration policy for one user type.\n \n Every user type must author this object explicitly. Acquisition policy is security\n * configuration, so omission must never silently become open registration.\n /\nexport const RegistrationConfigSchema = z.strictObject({\n mode: z.enum(RegistrationMode),\n /\n Only acquisition methods with a complete public-signup implementation are accepted.\n \n PASSWORD, EXTERNAL_OAUTH2, MAGIC_LINK and PASSKEY. The last two gained end-to-end public\n * registration in #463; before that they were authentication and enrollment methods only, and\n * declaring one here was refused because it would have advertised a path the runtime could not\n * execute.\n \n A password-less signup creates the account with NO credential and proves the address by a magic\n * link, so it never issues a session at signup and never honours `emailVerification: DEFERRED` —\n * \"access now, verify later\" is not a state the runtime can produce for a registrant who holds\n * nothing. See `registerUser`.\n /\n allowedMethods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n /* D-19: 'deferred' gives immediate access, verify later. /\n emailVerification: z.enum(EmailVerificationMode).default(EmailVerificationMode.REQUIRED_BEFORE_ACCESS),\n /* R-6: Moved from flat auth field. Blocks self-registration for SSO-managed domains. /\n blockForSSODomains: z.boolean().default(false),\n}).superRefine((registration, ctx) => {\n /\n * The set with a public-signup implementation. It is enumerated rather than open because the\n * failure this refusal prevents is silent: a method listed here is ADVERTISED to a registrant, and\n * one the runtime cannot execute fails after they have committed to it.\n \n MAGIC_LINK and PASSKEY joined in #463. Anything else — SSO, an MFA factor — is an authentication\n * or enrollment method that has no way to CREATE an account from an anonymous caller, and adding it\n * here means building that flow first, not widening this list.\n /\n const publiclyRegisterableMethods: readonly AuthMethod[] = [\n AuthMethod.PASSWORD,\n AuthMethod.EXTERNAL_OAUTH2,\n AuthMethod.MAGIC_LINK,\n AuthMethod.PASSKEY,\n ];\n const unsupportedMethods = registration.allowedMethods.filter(\n (method) => !publiclyRegisterableMethods.includes(method),\n );\n if (unsupportedMethods.length > 0) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: `Unsupported public registration methods: ${unsupportedMethods.join(', ')}`,\n });\n }\n if (\n registration.mode === RegistrationMode.OPEN\n && registration.allowedMethods.length === 0\n ) {\n ctx.addIssue({\n code: 'custom',\n path: ['allowedMethods'],\n message: 'Open registration requires at least one supported acquisition method',\n });\n }\n});\nexport type RegistrationConfig = z.infer<typeof RegistrationConfigSchema>;\n\n/\n Password policy — includes expiryDays (R-8, moved from flat auth field).\n * Defined here (not in app-configuration-shared) to avoid circular dependency.\n * PasswordPolicyRulesSchema in app-configuration-shared is the frontend validation subset.\n /\nexport const PasswordPolicyConfigSchema = z.object({\n minLength: z.number().min(6).max(128).default(8),\n maxLength: z.number().min(8).max(256).default(128),\n requireUppercase: z.boolean().default(true),\n requireLowercase: z.boolean().default(true),\n requireNumbers: z.boolean().default(true),\n requireSpecialChars: z.boolean().default(false),\n /* R-8: Folded from flat auth.passwordExpiryDays. 0 = never. Backend-only. Enforced in orchestrator authenticate(). /\n expiryDays: z.number().min(0).default(0),\n});\nexport type PasswordPolicyConfig = z.infer<typeof PasswordPolicyConfigSchema>;\n\n/* E-9, D-16: Step-up re-authentication for sensitive operations. R-2: single source of truth. /\nexport const StepUpAuthConfigSchema = z.object({\n enabled: z.boolean().default(false),\n maxAgeSeconds: z.number().min(60).max(3600).default(300),\n methods: z.array(z.enum(AuthMethod)).default([AuthMethod.PASSWORD]),\n});\nexport type StepUpAuthConfig = z.infer<typeof StepUpAuthConfigSchema>;\n\nexport const LockoutPolicyConfigSchema = z.object({\n maxLoginAttempts: z.number().min(3).max(20).default(5),\n lockoutDurationMinutes: z.number().min(1).max(1440).default(30),\n /* W2.3: doubles lockout duration for each consecutive lockout (2^n × lockoutDurationMinutes). Tracked via consecutiveLockouts on UserCredentials. /\n progressiveLockout: z.boolean().default(false),\n /* W2.3: cap for progressive lockout duration in hours. /\n maxProgressiveLockoutHours: z.number().min(1).max(168).default(24),\n});\nexport type LockoutPolicyConfig = z.infer<typeof LockoutPolicyConfigSchema>;\n\nexport const MethodManagementConfigSchema = z.object({\n allowUserMethodRemoval: z.boolean().default(true),\n requireReauthForMethodChanges: z.boolean().default(false),\n});\nexport type MethodManagementConfig = z.infer<typeof MethodManagementConfigSchema>;\n\n// ─── User Type Auth Policy (§2b — complete, non-partial, REQUIRED) ──────────\n\n/\n The complete auth policy for a user type. Every user type MUST define this.\n * There are no global auth defaults — this IS the auth config.\n \n Zod .default() values enable omission in config input files, but the\n * resolved runtime type has all fields present (no optionals for policy fields).\n \n See target-configuration-type.md §2b for full specification.\n /\nexport const UserTypeAuthPolicySchema = z.object({\n /* E-1, D-20: Opt-in semantics — absent method = disabled. /\n authMethodsEnabled: z.partialRecord(\n z.enum(AuthMethod),\n AuthMethodValueSchema,\n ).default({ [AuthMethod.PASSWORD]: true }),\n\n /* E-2: MFA enforcement for this user type. /\n mfaPolicy: MfaPolicyConfigSchema.default({\n requireMFA: false,\n requireStrongMFA: false,\n enrollmentGracePeriodDays: 0,\n passkeyExemptFromMFA: true,\n }),\n\n /* E-3: Explicit acquisition policy. No implicit OPEN or legacy boolean fallback exists. /\n registration: RegistrationConfigSchema,\n\n /* E-7, R-8: Password strength + expiry. /\n passwordPolicy: PasswordPolicyConfigSchema.default({\n minLength: 8,\n maxLength: 128,\n requireUppercase: true,\n requireLowercase: true,\n requireNumbers: true,\n requireSpecialChars: false,\n expiryDays: 0,\n }),\n\n /* E-8: Session duration for this user type. /\n sessionDurationMinutes: z.number().min(1).max(1440).default(30),\n\n /\n E-8, G-2: the cap on simultaneous refresh chains for this user type.\n \n Leaving it undefined does NOT mean unlimited. The token issuer falls back to\n * `DEFAULT_MAX_CONCURRENT_SESSIONS` (10) and evicts the oldest chain beyond it, so a user type\n * that declares nothing is still capped. There is no value that disables the cap; declare the\n * number you want.\n /\n maxConcurrentSessions: z.number().min(1).optional(),\n\n /* G-1: Per-user-type lockout. Backend-only. /\n lockoutPolicy: LockoutPolicyConfigSchema.default({\n maxLoginAttempts: 5,\n lockoutDurationMinutes: 30,\n progressiveLockout: false,\n maxProgressiveLockoutHours: 24,\n }),\n\n /* G-8: Consumer=true (convenience), Admin=false (security). /\n autoLinkByEmail: z.boolean().default(true),\n\n /* E-9, D-16, R-2: Step-up auth. undefined = disabled. W7.1: enforced in doOperation(). /\n stepUpAuth: StepUpAuthConfigSchema.optional(),\n\n methodManagement: MethodManagementConfigSchema.default({\n allowUserMethodRemoval: true,\n requireReauthForMethodChanges: false,\n }),\n\n /* W7.3a: Enables anonymous session support for this user type. When true,\n * unauthenticated users can interact with isAnonymizable resources via ANONYMOUS scope.\n * On login/register for this user type, anonymous resources are transposed to the authenticated user. /\n anonymousSessionsEnabled: z.boolean().optional(),\n\n /* W7.3b: Enables one-off scoped sessions — known users accessing specific operations via consumable token links without full authentication. /\n oneOffSessionAllowed: z.boolean().optional(),\n\n /* revocation-B1: Per-user-type upper bound (in minutes) on the lifetime of a one-off SESSION token minted\n * for a user of this type through the super-admin route. It can only TIGHTEN below the framework-wide\n * absolute one-off-session ceiling (`ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES`, ~12h) that EVERY mint path is\n * bounded by at issuance — a value above that ceiling has no effect (the absolute maximum wins). When unset,\n * the absolute ceiling applies. An over-cap mint is refused (`ONE_OFF_SESSION_DURATION_EXCEEDS_MAX`). The\n * ceiling follows the industry treatment of delegated/impersonated-credential lifetime as a hard cap\n * enforced at issuance (see `ONE_OFF_SESSION_ABSOLUTE_MAX_MINUTES` for the AWS STS / GCP / OWASP sources). /\n oneOffSessionMaxDurationMinutes: z.number().int().min(1).optional(),\n});\nexport type UserTypeAuthPolicy = z.infer<typeof UserTypeAuthPolicySchema>;\n\n// ─── User Type Definition ───────────────────────────────────────────────────\n\nexport const UserTypeDefinitionSchema = z.object({\n /* REQUIRED — the complete auth policy for this user type. Not an override of global. /\n auth: UserTypeAuthPolicySchema,\n\n /* DEFERRED: Only 'email' supported. Accepts any string; engine warns if !== 'email'. /\n uniqueIdentifier: z.string().default('email'),\n\n defaultAppRoles: z.array(AppRolesSchema).default([CORE_APP_ROLES.APP_USER]),\n\n /* D-10: When set, user type auto-revoked when user leaves last org of matching type. /\n requiresOrgMembership: z.object({\n orgTypes: z.array(z.string()).min(1),\n }).optional(),\n});\nexport type UserTypeDefinition = z.infer<typeof UserTypeDefinitionSchema>;\n\n// ─── Frontend Service Identity ──────────────────────────────────────────────\n\nexport const FrontendServiceUserManagementEntrySchema = z.object({\n register: z.boolean(),\n auth: z.boolean(),\n isDefault: z.boolean().optional(),\n});\nexport type FrontendServiceUserManagementEntry = z.infer<typeof FrontendServiceUserManagementEntrySchema>;\n\n/\n Backend-runtime view of one frontend service.\n \n Seeded by `platform-apps-manager`'s `buildManagedFrontendServicesSeed()`\n * from the `AdminAppManagedDeclaration` projection of `wildo.saas.config.ts`.\n \n - `usersManagement` — auth-policy bindings per user type (legacy field;\n * present since the original auth identity model).\n * - `frontendType` — the runtime kind declared in\n * `wildo.saas.config.ts → services[name].frontendType`. Currently\n * informational on the backend; reserved for `frontendType`-conditioned\n * policy (e.g. `TECH_DOC` only ever receives ephemeral sessions). The\n * full taxonomy + the \"no native variants\" decision live in\n * `./app-frontend-type.shared.schemas.ts`'s file-level JSDoc — do NOT\n * duplicate that explanation here.\n /\nexport const FrontendServiceDefinitionSchema = z.object({\n usersManagement: z.record(z.string(), FrontendServiceUserManagementEntrySchema),\n frontendType: z.enum(AppFrontendType).optional(),\n});\nexport type FrontendServiceDefinition = z.infer<typeof FrontendServiceDefinitionSchema>;\n\n// ─── Organization Type ──────────────────────────────────────────────────────\n\n/\n @wildo_source:part:start saas.models.config.organization-types facet:layer:shared facet:audience:app-developer\n \n An ORGANIZATION TYPE is the shape a tenant takes: which user types its members get, which roles\n * exist inside it, whether it can come into existence through sign-up, and how hard it is for its\n * members to prove who they are. Declared as `organizationTypes` in the application configuration.\n \n ## A type only self-creates if it says so\n \n `creationPolicy.createOnUserTypeRegistration` names the user types whose registration brings a\n * tenant of this type into existence. A type an administrator creates simply omits the policy — and\n * a user type may match AT MOST ONE organization type, which the schema enforces rather than\n * resolving by record order.\n \n `orgNameSource` decides where that tenant's first display name comes from: `ASK` during\n * registration, `AUTO` derived, or `ONBOARDING` deferred to a later step. `defaultOwnerRole` is who\n * the registrant becomes.\n \n ## `authOverrides` tightens, and can never loosen\n \n A tenant may restrict how its own members authenticate, on four axes and no others — enabled\n * methods, MFA policy, password policy and re-authentication freshness. Session length, lockout and\n * registration are NOT organization-overridable.\n \n Every axis is most-restrictive-wins on top of the user type, so an organization can subtract but\n * never add. Two directions worth stating because they differ: for step-up, `enabled` is an OR\n * (either side turning it on wins) while `maxAgeSeconds` is a MIN (the shorter window wins), and\n * `methods` intersects — an organization can withdraw an acceptable re-authentication method and\n * never introduce one the user type does not already allow.\n \n When a person belongs to SEVERAL organizations the sets intersect across all of them, so belonging\n * to a permissive tenant never restores what a strict one removed.\n \n How a registration-derived organization obtains its initial display name.\n /\nexport enum OrganizationNameSource {\n ASK = 'ask',\n AUTO = 'auto',\n ONBOARDING = 'onboarding',\n}\n\nexport const OrgCreationPolicySchema = z.object({\n createOnUserTypeRegistration: z.array(z.string()).min(1),\n orgNameSource: z.enum(OrganizationNameSource),\n defaultOwnerRole: z.string().default(CORE_ORG_ROLES.ORG_OWNER),\n});\nexport type OrgCreationPolicy = z.infer<typeof OrgCreationPolicySchema>;\n\n/* D-15: Org type auth overrides — Partial, most-restrictive-wins on top of user type. /\nexport const OrgTypeAuthOverridesSchema = z.object({\n authMethodsEnabled: z.partialRecord(z.enum(AuthMethod), AuthMethodValueSchema).optional(),\n mfaPolicy: MfaPolicyConfigSchema.partial().optional(),\n passwordPolicy: PasswordPolicyConfigSchema.partial().optional(),\n /\n Re-authentication freshness, added 2026-09-09 (#527).\n \n The other three overrides and this one answer ONE question — how hard is it for this tenant's\n * members to prove who they are — and until now a tenant could tighten three of them. An\n * organisation that requires MFA and a 16-character password could still have a member mutate a\n * sensitive resource on an eight-hour-old session, because the app-wide default said so.\n \n Most-restrictive-wins like its siblings, but the two fields move in OPPOSITE arithmetic\n * directions and that is worth stating rather than inferring: `enabled` is an OR (either side\n * turning step-up ON wins) while `maxAgeSeconds` is a MIN (the shorter window wins). `methods`\n * intersects, so an organisation can withdraw an acceptable re-authentication method but never\n * introduce one the user type does not already allow.\n /\n stepUpAuth: StepUpAuthConfigSchema.partial().optional(),\n}).optional();\nexport type OrgTypeAuthOverrides = z.infer<typeof OrgTypeAuthOverridesSchema>;\n\n/* G-4: Per-org-type SCIM provisioning (moved from global directoryProvisioningEnabled). /\nexport const OrgScimProvisioningSchema = z.object({\n enabled: z.boolean().default(false),\n syncFrequencyHours: z.number().min(1).max(720).default(24),\n});\nexport type OrgScimProvisioning = z.infer<typeof OrgScimProvisioningSchema>;\n\nexport const OrganizationTypeDefinitionSchema = z.object({\n /* D-10: User types auto-granted when joining this org type. /\n userTypes: z.array(z.string()).min(1),\n\n availableOrgRoles: z.array(z.union([OrgRolesSchema, z.string()])).default([\n CORE_ORG_ROLES.ORG_OWNER,\n CORE_ORG_ROLES.ORG_ADMIN,\n CORE_ORG_ROLES.ORG_MEMBER,\n ]),\n\n /* R-5: Moved from registration.defaultOrgRole. /\n defaultMemberRole: z.union([OrgRolesSchema, z.string()]).default(CORE_ORG_ROLES.ORG_MEMBER),\n\n /* D-15: Most-restrictive-wins on top of user type auth policy. /\n authOverrides: OrgTypeAuthOverridesSchema,\n\n /* G-4: SCIM provisioning toggle per org type. /\n scimProvisioning: OrgScimProvisioningSchema.optional(),\n\n creationPolicy: OrgCreationPolicySchema.optional(),\n});\nexport type OrganizationTypeDefinition = z.infer<typeof OrganizationTypeDefinitionSchema>;\n/* @wildo_source:part:end saas.models.config.organization-types /\n\n// ─── Top-Level Config Sections ──────────────────────────────────────────────\n\nexport const UserTypesConfigSchema = z.record(z.string(), UserTypeDefinitionSchema);\nexport type UserTypesConfig = z.infer<typeof UserTypesConfigSchema>;\n\nexport const FrontendServicesConfigSchema = z.record(z.string(), FrontendServiceDefinitionSchema);\nexport type FrontendServicesConfig = z.infer<typeof FrontendServicesConfigSchema>;\n\nexport const OrganizationTypesConfigSchema = z\n .record(z.string(), OrganizationTypeDefinitionSchema)\n .superRefine((organizationTypes, ctx) => {\n const ownerByRegisteredUserType = new Map<string, string>();\n for (const [organizationType, definition] of Object.entries(\n organizationTypes,\n )) {\n const registeredUserTypes =\n definition.creationPolicy?.createOnUserTypeRegistration ?? [];\n registeredUserTypes.forEach((userType, index) => {\n const existingOwner = ownerByRegisteredUserType.get(userType);\n if (existingOwner !== undefined) {\n ctx.addIssue({\n code: 'custom',\n path: [\n organizationType,\n 'creationPolicy',\n 'createOnUserTypeRegistration',\n index,\n ],\n message:\n `User type '${userType}' already creates organization type `\n + `'${existingOwner}' during registration; one registration `\n + 'cannot implicitly choose between multiple organization types',\n });\n return;\n }\n ownerByRegisteredUserType.set(userType, organizationType);\n });\n }\n });\nexport type OrganizationTypesConfig = z.infer<typeof OrganizationTypesConfigSchema>;\n\nexport interface OrganizationTypeRegistrationCreationMatch<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n } = OrganizationTypeDefinition,\n> {\n readonly organizationType: string;\n readonly definition: TDefinition;\n}\n\n/\n Canonical matching rule for registration-derived organization creation.\n \n The schema rejects more than one match for a user type. Returning all\n * matches is intentional defensive behavior for stale/unparsed runtime input:\n * callers can fail closed instead of selecting record insertion order.\n */\nexport function findOrganizationTypeRegistrationCreationMatches<\n TDefinition extends {\n readonly creationPolicy?: OrgCreationPolicy;\n },\n>(\n organizationTypes: Readonly<Record<string, TDefinition>> \| undefined,\n registeredUserType: string,\n): readonly OrganizationTypeRegistrationCreationMatch<TDefinition>[] {\n if (!organizationTypes) return [];\n return Object.entries(organizationTypes)\n .filter(([, definition]) =>\n definition.creationPolicy?.createOnUserTypeRegistration.includes(\n registeredUserType,\n ),\n )\n .map(([organizationType, definition]) => ({\n organizationType,\n definition,\n }));\n}\n"]}