npm - @wildo-ai/saas-models - Versions diffs - 1.1.4 → 1.1.5 - Mend

@wildo-ai/saas-models 1.1.4 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1032) hide show

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js CHANGED Viewed

@@ -61,8 +61,8 @@ export const SsoConfigBaseSchema = z.object({
     // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object
     // before/after, so marking `domains` would copy live verification tokens into audit rows that
     // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant
-    // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which
-    // keeps the secret out by construction rather than by reviewer vigilance.
+    // sub-fields (`ssoEnabledDomains`, and `domainVerificationStatus` below) are marked individually
+    // instead, which keeps the secret out by construction rather than by reviewer vigilance.
     //
     // Read this before marking any other container: a block is safe to mark WHOLESALE only when no
     // descendant is `.isBackendOnly()` or personal data.
@@ -86,8 +86,20 @@ export const SsoConfigBaseSchema = z.object({
          */
         verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),
         ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),
-        domainHinting: z.boolean().default(true),
-        allowExternalDomains: z.boolean().default(false).isAuditEvidence(),
+        /*
+         * `domainHinting` and `allowExternalDomains` were REMOVED here, and both were read by nothing.
+         *
+         * `domainHinting` promised the sign-in form would route a person to their IdP from their email
+         * domain — a real and common feature, and one this engine implements from `ssoEnabledDomains`
+         * plus the verification map, never from this flag. Turning it off changed no routing.
+         *
+         * `allowExternalDomains` carried `.isAuditEvidence()` and read as an admission control on who
+         * may join through SSO. Nothing consulted it, so an operator who left it `false` — the default —
+         * believed they had closed a door that was never fitted. What actually restricts admission is
+         * the connection's `allowedDomains`, and on the SCIM lane the verified-domain projection.
+         *
+         * Absence is pinned in `authentication-knobs-have-readers.test.ts`.
+         */
         /**
          * The half of the join that decides routing authority — and therefore the audit evidence.
          *
@@ -112,31 +124,93 @@ export const SsoConfigBaseSchema = z.object({
          */
         domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),
     }),
-    provisioning: z.object({
-        autoCreateUsers: z.boolean().default(true),
-        autoUpdateUsers: z.boolean().default(true),
-        autoDeactivateUsers: z.boolean().default(false),
-        defaultRole: z.string().optional(),
-        requiredAttributes: z.array(z.string()).default(['email']),
-        syncFrequencyHours: z.number().min(1).max(168).default(24),
-    }).isAuditEvidence(),
+    /*
+     * `provisioning` was REMOVED here, and the reason is that it decided NOTHING.
+     *
+     * It declared six fields — `autoCreateUsers`, `autoUpdateUsers`, `autoDeactivateUsers`,
+     * `defaultRole`, `requiredAttributes`, `syncFrequencyHours` — carried `.isAuditEvidence()`, was
+     * written by the default seed, was rendered as a section of the SSO settings pane, and had ZERO
+     * production readers. An administrator set "create users automatically" there and nothing
+     * anywhere consulted it.
+     *
+     * ## What actually decides, and why there are two of them rather than three
+     *
+     * Just-in-time provisioning on an INTERACTIVE sign-in reads the CONNECTION, not this row:
+     * `SsoConnectionSchema.{autoCreateUsers, autoVerifyEmail, defaultRole, roleMapping, groupMapping}`,
+     * assembled once per connection by `oauth2-connection-resolver` and `saml-authentication` and
+     * carried into `provisionEnterpriseUser`. Per connection is the right grain — two IdPs bound to
+     * one tenant may legitimately differ.
+     *
+     * A DIRECTORY PUSH reads `ScimProvisioningConfigBaseSchema`, resolved by
+     * `scim.backend.controller._getProvisioningConfig`. Per organization is the right grain — there
+     * is one directory relationship.
+     *
+     * Those two are NOT duplicates of each other. They are different planes (a person signing in
+     * versus a directory pushing), on different code paths, and an organization can run either
+     * without the other. This block was the duplicate: a third grain, org-wide and inert, whose own
+     * documentation described it as "SSO JIT provisioning" — the one thing it did not do.
+     *
+     * ## What is NOT lost
+     *
+     * `autoCreateUsers` / `defaultRole` exist per connection; `autoDeactivateUsers` exists on the SCIM
+     * config. `autoUpdateUsers`, `requiredAttributes` and `syncFrequencyHours` existed ONLY here and
+     * were never implemented anywhere — removing them removes an advertised capability that was never
+     * present, which is the honest state. Wanting any of them back is a feature with a design, not a
+     * field to re-add. `syncFrequencyHours` in particular was already removed once for exactly this
+     * reason on the org-TYPE side (#1224); this is its twin.
+     *
+     * Absence is pinned in `authentication-knobs-have-readers.test.ts`.
+     */
+    /**
+     * Federated logout, and the ONLY thing this block still decides.
+     *
+     * `saml-metadata.backend.service` reads it as `spConfig.singleLogoutEnabled` and advertises — or
+     * withholds — the SP's SLO endpoint in the published metadata; `saml-authentication` honours the
+     * opt-out in both directions, terminating the local session on an SP-initiated logout and
+     * answering an IdP-initiated one with a graceful no-op LogoutResponse.
+     *
+     * ## Its three former neighbours were removed, and none of them was implemented
+     *
+     * - `requireReauthForSensitive` — nothing anywhere asks a session to re-authenticate for a
+     *   "sensitive" operation, and nothing classified one. Step-up authentication is a real mechanism
+     *   in this engine and it is not reached from here.
+     * - `ssoSessionDurationMinutes` — the ONLY mention outside the seed was a comment in
+     *   `saml-authentication` asserting the app session "expires on its own `ssoSessionDurationMinutes`".
+     *   It does not: session lifetime comes from the token issuer's own configuration. A comment is
+     *   not an implementation, and one that names a field makes the field look wired.
+     * - `maxConcurrentSessions` — a SECOND source of truth for a setting that already has a live one.
+     *   `userTypes.<type>.auth.maxConcurrentSessions` is what the token issuer enforces (pinned in
+     *   `auth-token-issuer.rotation-concurrency.redis.test.ts`); the copy here was read by nothing, so
+     *   an operator could set two different limits and neither the lower nor the later would win.
+     */
     sessionSettings: z.object({
-        ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),
-        requireReauthForSensitive: z.boolean().default(true),
         singleLogoutEnabled: z.boolean().default(true),
-        maxConcurrentSessions: z.number().min(1).max(50).default(5),
-    }).isAuditEvidence(),
-    // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or
-    // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the
-    // one change the trail cannot evidence.
-    // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.
-    auditConfig: z.object({
-        logAllSSOEvents: z.boolean().default(true),
-        logProviderSwitching: z.boolean().default(true),
-        logRoleMapping: z.boolean().default(true),
-        complianceReporting: z.boolean().default(false),
-        retentionDays: z.number().min(1).max(2555).default(365),
     }).isAuditEvidence(),
+    /*
+     * `auditConfig` was REMOVED here — all five fields, and the assurance marker that stood over them.
+     *
+     * It declared `logAllSSOEvents`, `logProviderSwitching`, `logRoleMapping`, `complianceReporting`
+     * and `retentionDays`, and carried
+     * `assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself`.
+     * Its own comment argued the marker: "disabling `logAllSSOEvents` or shortening `retentionDays` is
+     * the classic pre-incident tampering move, and it must not be the one change the trail cannot
+     * evidence."
+     *
+     * Every word of that is a good argument about a block that governed NOTHING. Zero production
+     * readers: the declaration, the default seed, a specification example and the display template
+     * were the complete set of mentions. No SSO event consults `logAllSSOEvents` before emitting, and
+     * no retention job consults `retentionDays` — which made the marker the worse half of the defect,
+     * because a control marker is a CLAIM, and `compliance-is-derived-from-the-product.md` names a
+     * marker whose truth nothing checks as the thing to remove rather than the thing to keep.
+     *
+     * Audit-trail behaviour is not configurable per SSO policy and was never meant to be: emission is
+     * decided by the operation's own risk level against `AUTOMATIC_AUDIT_RISK_FLOOR`, and RETENTION by
+     * `ApplicationRetentionSchedule` over `DataRetentionClass` — application-level, derived, and total
+     * over that vocabulary. `retentionDays` here was a second, inert answer to a question already
+     * answered there.
+     *
+     * Absence is pinned in `authentication-knobs-have-readers.test.ts`.
+     */
     /**
      * Break-glass: the named accounts that may still sign in with a password when the identity
      * provider cannot be reached.

package/dist/esm/security/authentications/sso/sso-config.shared.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,kGAAkG;IAClG,0EAA0E;IAC1E,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,eAAe,EAAE;QAClE;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAC,eAAe,EAAE;IAEpB,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QACpE,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACpD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAC5D,CAAC,CAAC,eAAe,EAAE;IAEpB,4FAA4F;IAC5F,gGAAgG;IAChG,wCAAwC;IACxC,iGAAiG;IACjG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAC/C,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;KACxD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/*\n SSO Config Schema (Shared) — Polymorphic\n \n SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n \n @see auth-data-model-audit.md §2A\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n PENDING: 'pending',\n VERIFIED: 'verified',\n FAILED: 'failed',\n EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n //\n // These are configuration flags, domains and role names — NOT personal data — so recording their\n // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n // scrubbed).\n //\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n // permitted to authenticate at all.\n //\n // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n // `false` believed their administrators had a way in when the IdP broke, and they did not.\n //\n // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n // considered and rejected here for the escalation path above.\n //\n // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n // repository's, not a quotation.\n enforcement: z.object({\n requireSSO: z.boolean().default(false).isSummaryField(),\n allowPasswordFallback: z.boolean().default(true),\n graceLoginAttempts: z.number().min(0).max(10).default(3),\n }).isSummaryField().isAuditEvidence(),\n\n // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n // before/after, so marking `domains` would copy live verification tokens into audit rows that\n // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n // sub-fields (`ssoEnabledDomains`, `allowExternalDomains`) are marked individually instead, which\n // keeps the secret out by construction rather than by reviewer vigilance.\n //\n // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n // descendant is `.isBackendOnly()` or personal data.\n domains: z.object({\n /\n Every domain this organization has CLAIMED — verified and unverified alike.\n \n ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n \n Do not read this array directly. A reader that does gets pending, failed and expired\n * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n * .getDomains` did, returning them as `verified`, with no consumer to notice.\n \n The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n * is a schema change plus a data migration for a field whose every reader now goes through the\n * helper. The name is no longer what a new reader reaches.\n /\n verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n domainHinting: z.boolean().default(true),\n allowExternalDomains: z.boolean().default(false).isAuditEvidence(),\n /\n The half of the join that decides routing authority — and therefore the audit evidence.\n \n Marked individually rather than through the containing `domains` block, for the reason that\n * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n * personal data — and it is the only field that answers the question an auditor asks about a\n * domain workflow: WHICH domain became verified, and when did it stop being verified.\n \n Without it the trail records `domains` as a changed field name and nothing more, which cannot\n * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n * address at it\".\n /\n domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n /\n The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n * through a resource READ, and never enters the audit trail (see the block comment above).\n \n The one place its value is disclosed is the response to `claimDomain`, which returns it once\n * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n /\n domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n }),\n\n provisioning: z.object({\n autoCreateUsers: z.boolean().default(true),\n autoUpdateUsers: z.boolean().default(true),\n autoDeactivateUsers: z.boolean().default(false),\n defaultRole: z.string().optional(),\n requiredAttributes: z.array(z.string()).default(['email']),\n syncFrequencyHours: z.number().min(1).max(168).default(24),\n }).isAuditEvidence(),\n\n sessionSettings: z.object({\n ssoSessionDurationMinutes: z.number().min(15).max(1440).default(480),\n requireReauthForSensitive: z.boolean().default(true),\n singleLogoutEnabled: z.boolean().default(true),\n maxConcurrentSessions: z.number().min(1).max(50).default(5),\n }).isAuditEvidence(),\n\n // Marked because this block governs the AUDIT TRAIL ITSELF — disabling `logAllSSOEvents` or\n // shortening `retentionDays` is the classic pre-incident tampering move, and it must not be the\n // one change the trail cannot evidence.\n // assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself.\n auditConfig: z.object({\n logAllSSOEvents: z.boolean().default(true),\n logProviderSwitching: z.boolean().default(true),\n logRoleMapping: z.boolean().default(true),\n complianceReporting: z.boolean().default(false),\n retentionDays: z.number().min(1).max(2555).default(365),\n }).isAuditEvidence(),\n\n /\n Break-glass: the named accounts that may still sign in with a password when the identity\n * provider cannot be reached.\n \n Every field here is READ at runtime. It carried three more — `requireApproval`,\n * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n * #423) rather than implemented, for reasons worth keeping:\n \n - `requireApproval` cannot exist on this path. Break-glass is the door for the case where\n * nobody can act; an approval step means the approver may be locked out too, which is the\n * deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n * after each use, never for prior approval.\n * - `maxDurationHours` describes a bounded break-glass SESSION, which is a real control and\n * is not built. A field that names a control nobody enforces is exactly what this issue was\n * about, so it is absent until the session cap exists.\n * - `auditLevel` could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n * `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n * privileged-access record is not a setting a tenant should have.\n \n ## What a listed account gets, and what it does not\n \n A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n * nothing else. It authenticates with the same password, against the same lockout counters and\n * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n \n ## Why the whole TENANT keeps a password field when this list is non-empty\n \n The sign-in surface must not depend on the account, or the offered methods become an oracle for\n * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n * password field that only two accounts can use; the alternative discloses who they are.\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n * own authentication requirement.\n /\n emergencyAccess: z.object({\n /* Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. /\n enabled: z.boolean().default(true),\n /\n The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n * a standing password path into a tenant that has otherwise required SSO.\n \n Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n * stored apart from any individual, and a validation drill every 90 days; none of that is\n * enforceable from here, and all of it is what makes this list safe to have.\n /\n breakGlassAccounts: z.array(z.email()).default([]),\n }).isAuditEvidence(),\n\n oauth2ProviderRestrictions: z.object({\n allowedProviders: z.array(z.string()).default([]),\n blockedProviders: z.array(z.string()).default([]),\n requireEnterpriseSSOOnly: z.boolean().default(false),\n }).isAuditEvidence(),\n\n /\n Per-scope social provider credential overrides (P3).\n \n By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n * those with their own registered OAuth2 app at the identity provider.\n \n Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n * endpoints, scopes, and profile mapping still come from the provider catalog.\n \n `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n * short-lived JWT signed with a private key). These correspond to the Apple\n * Developer Team ID and Key ID that are bound to the private key.\n * When omitted, the app-level values from the secrets store are used.\n \n Secret handling (two distinct contracts, on purpose):\n * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n * stays writable AND stays in the response DTO where the framework redacts it to\n * `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n * via `readAsSystem`) keep the real value.\n * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n * frontend at all (stripped from every client DTO).\n \n Because these secrets live inside an ARRAY, neither the central write-only-secret\n * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n * matches each incoming override to the stored record by `providerRef` and\n * re-injects any secret that arrived absent or as the `••••••••` mask.\n \n @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n /\n socialCredentialOverrides: z.array(z.object({\n providerRef: z.string().min(1),\n clientId: z.string().min(1),\n clientSecret: z.string().min(1).isWriteOnlySecret(),\n signedJwtKeyId: z.string().optional().isBackendOnly(),\n signedJwtTeamId: z.string().optional().isBackendOnly(),\n })).default([]).refine(\n (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n { message: 'Duplicate providerRef in socialCredentialOverrides' },\n ),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/\n The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n \n ## Why this exists rather than five correct joins\n \n The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, five reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n \n That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n \n So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n \n Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n /\nexport function resolveVerifiedDomains(domains: {\n readonly verifiedDomains?: readonly string[];\n readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} \| undefined): string[] {\n const status = domains?.domainVerificationStatus ?? {};\n return (domains?.verifiedDomains ?? []).filter(\n domain => status[domain] === DomainVerificationStatus.VERIFIED,\n );\n}\n\n/* Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n domains: {\n readonly verifiedDomains?: readonly string[];\n readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n } \| undefined,\n domain: string,\n): boolean {\n return (domains?.verifiedDomains ?? []).includes(domain)\n && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'ssoConfig',\n baseFieldIdentifier: 'ssoConfigId',\n baseEnumKey: 'SSO_CONFIG',\n baseSchema: SsoConfigBaseSchema,\n variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
1	+ {"version":3,"file":"sso-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AAEnG,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;CACV,CAAC;AAEX,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,+FAA+F;IAC/F,gGAAgG;IAChG,6FAA6F;IAC7F,oFAAoF;IACpF,EAAE;IACF,iGAAiG;IACjG,6FAA6F;IAC7F,+FAA+F;IAC/F,aAAa;IACb,EAAE;IACF,mGAAmG;IACnG,oCAAoC;IACpC,EAAE;IACF,gGAAgG;IAChG,6FAA6F;IAC7F,2FAA2F;IAC3F,EAAE;IACF,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,kGAAkG;IAClG,+FAA+F;IAC/F,kGAAkG;IAClG,8DAA8D;IAC9D,EAAE;IACF,2EAA2E;IAC3E,0GAA0G;IAC1G,kGAAkG;IAClG,6FAA6F;IAC7F,iCAAiC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE;QACvD,qBAAqB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAChD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACzD,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAErC,oFAAoF;IACpF,kGAAkG;IAClG,8FAA8F;IAC9F,6FAA6F;IAC7F,iGAAiG;IACjG,yFAAyF;IACzF,EAAE;IACF,+FAA+F;IAC/F,qDAAqD;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB;;;;;;;;;;;;;;;;WAgBG;QACH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAClE,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QACpE;;;;;;;;;;;;;WAaG;QACH;;;;;;;;;;;;WAYG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,eAAe,EAAE;QAC9G;;;;;;;WAOG;QACH,wBAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,EAAE;KACvF,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IAEH;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAC/C,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;QACxB,kGAAkG;QAClG,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC;;;;;;;WAOG;QACH,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KACnD,CAAC,CAAC,eAAe,EAAE;IAEpB,0BAA0B,EAAE,CAAC,CAAC,MAAM,CAAC;QACnC,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACrD,CAAC,CAAC,eAAe,EAAE;IAEpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACH,yBAAyB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE;QACnD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;QACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE;KACvD,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,EACjE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAClE;IAED,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAG1B;IACX,MAAM,MAAM,GAAG,OAAO,EAAE,wBAAwB,IAAI,EAAE,CAAC;IACvD,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAC/D,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAGa,EACb,MAAc;IAEd,OAAO,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;WACnD,OAAO,EAAE,wBAAwB,EAAE,CAAC,MAAM,CAAC,KAAK,wBAAwB,CAAC,QAAQ,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAyB,CAAC;IACvE,gBAAgB,EAAE,WAAW;IAC7B,mBAAmB,EAAE,aAAa;IAClC,WAAW,EAAE,YAAY;IACzB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/*\n SSO Config Schema (Shared) — Polymorphic\n \n SSO enforcement, domain verification, provider restrictions, provisioning,\n * session settings, emergency access. Policy/settings layer only —\n * provider connections are a separate resource (SsoConnection).\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n \n @see auth-data-model-audit.md §2A\n /\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\n\nexport const DomainVerificationStatus = {\n PENDING: 'pending',\n VERIFIED: 'verified',\n FAILED: 'failed',\n EXPIRED: 'expired',\n} as const;\n\nexport const SsoConfigBaseSchema = z.object({\n _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n // ── `.isAuditEvidence()` on the authentication-authority blocks ──────────────────────────────\n // Every block below decides WHO may authenticate into this tenant and with what standing, so a\n // change to one is an authorization change even though no role is named: weakening `requireSSO`,\n // re-enabling `allowPasswordFallback`, granting a `defaultRole` on auto-provision, or adding a\n // break-glass account each widen access tenant-wide. The generic resource-operation audit event\n // records the changed field NAMES for free; the marker is what makes the before/after VALUES\n // survive, and without values \"someone changed the SSO enforcement\" proves nothing.\n //\n // These are configuration flags, domains and role names — NOT personal data — so recording their\n // values does not conflict with the Art. 5(1)(c) / Art. 17 minimisation reasoning that keeps\n // user-identifying fields unmarked (audit rows replicate to an immutable ledger that cannot be\n // scrubbed).\n //\n // assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — SSO enforcement decides how principals are\n // permitted to authenticate at all.\n //\n // `enforceForAdmins` was REMOVED here (#481). It said \"this tenant's SSO requirement also binds\n // its administrators\", defaulted `true`, and was read by nothing — so an operator who set it\n // `false` believed their administrators had a way in when the IdP broke, and they did not.\n //\n // It was not reimplemented, because a ROLE is the wrong unit for an authentication bypass. Role\n // membership changes, and a standing exemption for \"whoever is an admin\" means compromising one\n // administrator and promoting an account silently grants an SSO bypass to the promoted one.\n // Microsoft Entra's emergency-access guidance is explicit about the alternative — exclude a small\n // NAMED set through a dedicated group, never a role — and that is what `emergencyAccess` below\n // now does. Google Workspace does take the role-shaped route for its super administrators; it was\n // considered and rejected here for the escalation path above.\n //\n // spec-cite: Microsoft Entra ID — \"Manage emergency access admin accounts\"\n // (https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access),\n // \"Conditional Access considerations\": create a dedicated security group for the emergency access\n // accounts and exclude THAT from policies. The reading that a role is the wrong unit is this\n // repository's, not a quotation.\n enforcement: z.object({\n requireSSO: z.boolean().default(false).isSummaryField(),\n allowPasswordFallback: z.boolean().default(true),\n graceLoginAttempts: z.number().min(0).max(10).default(3),\n }).isSummaryField().isAuditEvidence(),\n\n // NOT marked, deliberately: this block carries `domainVerificationTokens`, which is\n // `.isBackendOnly()` — a SECRET. `.isAuditEvidence()` on a parent object records the WHOLE object\n // before/after, so marking `domains` would copy live verification tokens into audit rows that\n // replicate to the immutable ledger and to every configured SIEM sink. The security-relevant\n // sub-fields (`ssoEnabledDomains`, and `domainVerificationStatus` below) are marked individually\n // instead, which keeps the secret out by construction rather than by reviewer vigilance.\n //\n // Read this before marking any other container: a block is safe to mark WHOLESALE only when no\n // descendant is `.isBackendOnly()` or personal data.\n domains: z.object({\n /\n Every domain this organization has CLAIMED — verified and unverified alike.\n \n ⚠️ The name asserts more than the field holds. `initiateDomainVerification` pushes a domain\n * here at CLAIM time with `domainVerificationStatus[domain] = 'pending'`, so membership means\n * \"somebody asked\", never \"we checked\". The real answer is the join with that map, and\n * `resolveVerifiedDomains` below is the only place it should be computed (#457).\n \n Do not read this array directly. A reader that does gets pending, failed and expired\n * domains under a name that says otherwise — which `AuthOrganizationConfigurationService\n * .getDomains` did, returning them as `verified`, with no consumer to notice.\n \n The field was NOT renamed to `claimedDomains`, and that is a decision rather than an\n * omission: it is persisted on every SSO config row of both dogfood applications, so the rename\n * is a schema change plus a data migration for a field whose every reader now goes through the\n * helper. The name is no longer what a new reader reaches.\n /\n verifiedDomains: z.array(z.string()).default([]).isAuditEvidence(),\n ssoEnabledDomains: z.array(z.string()).default([]).isAuditEvidence(),\n /\n * `domainHinting` and `allowExternalDomains` were REMOVED here, and both were read by nothing.\n \n `domainHinting` promised the sign-in form would route a person to their IdP from their email\n * domain — a real and common feature, and one this engine implements from `ssoEnabledDomains`\n * plus the verification map, never from this flag. Turning it off changed no routing.\n \n `allowExternalDomains` carried `.isAuditEvidence()` and read as an admission control on who\n * may join through SSO. Nothing consulted it, so an operator who left it `false` — the default —\n * believed they had closed a door that was never fitted. What actually restricts admission is\n * the connection's `allowedDomains`, and on the SCIM lane the verified-domain projection.\n \n Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n /\n /\n The half of the join that decides routing authority — and therefore the audit evidence.\n \n Marked individually rather than through the containing `domains` block, for the reason that\n * block's own comment gives: a whole-object mark would copy `domainVerificationTokens` into the\n * immutable ledger. This map holds domain names and one of four statuses — no secret, no\n * personal data — and it is the only field that answers the question an auditor asks about a\n * domain workflow: WHICH domain became verified, and when did it stop being verified.\n \n Without it the trail records `domains` as a changed field name and nothing more, which cannot\n * distinguish \"a tenant claimed a domain\" from \"a tenant gained SSO routing control over every\n * address at it\".\n /\n domainVerificationStatus: z.record(z.string(), z.enum(DomainVerificationStatus)).default({}).isAuditEvidence(),\n /\n The DNS-TXT challenge nonce per claimed domain. `.isBackendOnly()` — never leaves the backend\n * through a resource READ, and never enters the audit trail (see the block comment above).\n \n The one place its value is disclosed is the response to `claimDomain`, which returns it once\n * as an `.isEphemeral()` field, because the operator cannot publish a record they cannot see.\n * A lost token is recovered by claiming again, which mints a new one — there is no re-read.\n /\n domainVerificationTokens: z.record(z.string(), z.string()).default({}).isBackendOnly(),\n }),\n\n /\n * `provisioning` was REMOVED here, and the reason is that it decided NOTHING.\n \n It declared six fields — `autoCreateUsers`, `autoUpdateUsers`, `autoDeactivateUsers`,\n * `defaultRole`, `requiredAttributes`, `syncFrequencyHours` — carried `.isAuditEvidence()`, was\n * written by the default seed, was rendered as a section of the SSO settings pane, and had ZERO\n * production readers. An administrator set \"create users automatically\" there and nothing\n * anywhere consulted it.\n \n ## What actually decides, and why there are two of them rather than three\n \n Just-in-time provisioning on an INTERACTIVE sign-in reads the CONNECTION, not this row:\n * `SsoConnectionSchema.{autoCreateUsers, autoVerifyEmail, defaultRole, roleMapping, groupMapping}`,\n * assembled once per connection by `oauth2-connection-resolver` and `saml-authentication` and\n * carried into `provisionEnterpriseUser`. Per connection is the right grain — two IdPs bound to\n * one tenant may legitimately differ.\n \n A DIRECTORY PUSH reads `ScimProvisioningConfigBaseSchema`, resolved by\n * `scim.backend.controller._getProvisioningConfig`. Per organization is the right grain — there\n * is one directory relationship.\n \n Those two are NOT duplicates of each other. They are different planes (a person signing in\n * versus a directory pushing), on different code paths, and an organization can run either\n * without the other. This block was the duplicate: a third grain, org-wide and inert, whose own\n * documentation described it as \"SSO JIT provisioning\" — the one thing it did not do.\n \n ## What is NOT lost\n \n `autoCreateUsers` / `defaultRole` exist per connection; `autoDeactivateUsers` exists on the SCIM\n * config. `autoUpdateUsers`, `requiredAttributes` and `syncFrequencyHours` existed ONLY here and\n * were never implemented anywhere — removing them removes an advertised capability that was never\n * present, which is the honest state. Wanting any of them back is a feature with a design, not a\n * field to re-add. `syncFrequencyHours` in particular was already removed once for exactly this\n * reason on the org-TYPE side (#1224); this is its twin.\n \n Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n /\n\n /\n Federated logout, and the ONLY thing this block still decides.\n \n `saml-metadata.backend.service` reads it as `spConfig.singleLogoutEnabled` and advertises — or\n * withholds — the SP's SLO endpoint in the published metadata; `saml-authentication` honours the\n * opt-out in both directions, terminating the local session on an SP-initiated logout and\n * answering an IdP-initiated one with a graceful no-op LogoutResponse.\n \n ## Its three former neighbours were removed, and none of them was implemented\n \n - `requireReauthForSensitive` — nothing anywhere asks a session to re-authenticate for a\n * \"sensitive\" operation, and nothing classified one. Step-up authentication is a real mechanism\n * in this engine and it is not reached from here.\n * - `ssoSessionDurationMinutes` — the ONLY mention outside the seed was a comment in\n * `saml-authentication` asserting the app session \"expires on its own `ssoSessionDurationMinutes`\".\n * It does not: session lifetime comes from the token issuer's own configuration. A comment is\n * not an implementation, and one that names a field makes the field look wired.\n * - `maxConcurrentSessions` — a SECOND source of truth for a setting that already has a live one.\n * `userTypes.<type>.auth.maxConcurrentSessions` is what the token issuer enforces (pinned in\n * `auth-token-issuer.rotation-concurrency.redis.test.ts`); the copy here was read by nothing, so\n * an operator could set two different limits and neither the lower nor the later would win.\n /\n sessionSettings: z.object({\n singleLogoutEnabled: z.boolean().default(true),\n }).isAuditEvidence(),\n\n /\n * `auditConfig` was REMOVED here — all five fields, and the assurance marker that stood over them.\n \n It declared `logAllSSOEvents`, `logProviderSwitching`, `logRoleMapping`, `complianceReporting`\n * and `retentionDays`, and carried\n * `assurance-control: WILDO.AUDIT.EVIDENCE_INTEGRITY — this block governs the audit trail itself`.\n * Its own comment argued the marker: \"disabling `logAllSSOEvents` or shortening `retentionDays` is\n * the classic pre-incident tampering move, and it must not be the one change the trail cannot\n * evidence.\"\n \n Every word of that is a good argument about a block that governed NOTHING. Zero production\n * readers: the declaration, the default seed, a specification example and the display template\n * were the complete set of mentions. No SSO event consults `logAllSSOEvents` before emitting, and\n * no retention job consults `retentionDays` — which made the marker the worse half of the defect,\n * because a control marker is a CLAIM, and `compliance-is-derived-from-the-product.md` names a\n * marker whose truth nothing checks as the thing to remove rather than the thing to keep.\n \n Audit-trail behaviour is not configurable per SSO policy and was never meant to be: emission is\n * decided by the operation's own risk level against `AUTOMATIC_AUDIT_RISK_FLOOR`, and RETENTION by\n * `ApplicationRetentionSchedule` over `DataRetentionClass` — application-level, derived, and total\n * over that vocabulary. `retentionDays` here was a second, inert answer to a question already\n * answered there.\n \n Absence is pinned in `authentication-knobs-have-readers.test.ts`.\n /\n\n /\n Break-glass: the named accounts that may still sign in with a password when the identity\n * provider cannot be reached.\n \n Every field here is READ at runtime. It carried three more — `requireApproval`,\n * `maxDurationHours` and `auditLevel` — and all three were removed with `enforceForAdmins` (#481,\n * #423) rather than implemented, for reasons worth keeping:\n \n - `requireApproval` cannot exist on this path. Break-glass is the door for the case where\n * nobody can act; an approval step means the approver may be locked out too, which is the\n * deadlock the door exists to break. Entra's guidance asks for monitoring and a post-mortem\n * after each use, never for prior approval.\n * - `maxDurationHours` describes a bounded break-glass SESSION, which is a real control and\n * is not built. A field that names a control nobody enforces is exactly what this issue was\n * about, so it is absent until the session cap exists.\n * - `auditLevel` could not change anything: `EMERGENCY_ACCESS_USED` is CRITICAL in\n * `SECURITY_AUDIT_EVENT_ENVELOPE`, and a per-tenant knob that lowers the severity of a\n * privileged-access record is not a setting a tenant should have.\n \n ## What a listed account gets, and what it does not\n \n A listed account is exempt from the SSO enforcement refusal — including grace exhaustion — and\n * nothing else. It authenticates with the same password, against the same lockout counters and\n * the same rate limits, and every use emits `EMERGENCY_ACCESS_USED` at CRITICAL.\n \n ## Why the whole TENANT keeps a password field when this list is non-empty\n \n The sign-in surface must not depend on the account, or the offered methods become an oracle for\n * \"is this address a break-glass account\". So `requiresEnterpriseSsoOnly` answers false for the\n * whole tenant while this list is non-empty: everyone at the domain sees a password field, and\n * everyone not on the list is refused AFTER presenting a correct credential. The cost is a\n * password field that only two accounts can use; the alternative discloses who they are.\n \n assurance-control: WILDO.IDENTITY.SESSION_ASSURANCE — the authenticated bypass of this tenant's\n * own authentication requirement.\n /\n emergencyAccess: z.object({\n /* Off switch. `true` with an empty list grants nothing — the list is what confers the bypass. /\n enabled: z.boolean().default(true),\n /\n The email addresses that may bypass SSO enforcement. An authority LIST: adding an entry grants\n * a standing password path into a tenant that has otherwise required SSO.\n \n Keep it SMALL and keep it reviewed. Entra asks for at least two (redundancy), credentials\n * stored apart from any individual, and a validation drill every 90 days; none of that is\n * enforceable from here, and all of it is what makes this list safe to have.\n /\n breakGlassAccounts: z.array(z.email()).default([]),\n }).isAuditEvidence(),\n\n oauth2ProviderRestrictions: z.object({\n allowedProviders: z.array(z.string()).default([]),\n blockedProviders: z.array(z.string()).default([]),\n requireEnterpriseSSOOnly: z.boolean().default(false),\n }).isAuditEvidence(),\n\n /\n Per-scope social provider credential overrides (P3).\n \n By default, social providers (Google, GitHub, Apple, etc.) use platform-level\n * OAuth2 credentials from AppConfiguration. This array lets an org/app override\n * those with their own registered OAuth2 app at the identity provider.\n \n Only `clientId` + `clientSecret` are needed for most providers — the OAuth2\n * endpoints, scopes, and profile mapping still come from the provider catalog.\n \n `signedJwtKeyId` / `signedJwtTeamId` are required only for providers that use\n * signed-JWT client secrets (e.g. Apple Sign-In, where the \"client secret\" is a\n * short-lived JWT signed with a private key). These correspond to the Apple\n * Developer Team ID and Key ID that are bound to the private key.\n * When omitted, the app-level values from the secrets store are used.\n \n Secret handling (two distinct contracts, on purpose):\n * - `clientSecret` is `.isWriteOnlySecret()` — the operator sets/rotates it, so it\n * stays writable AND stays in the response DTO where the framework redacts it to\n * `••••••••` at the client boundary. Internal reads (`resolveSocialConnection`\n * via `readAsSystem`) keep the real value.\n * - `signedJwtKeyId` / `signedJwtTeamId` are `.isBackendOnly()` — never sent to the\n * frontend at all (stripped from every client DTO).\n \n Because these secrets live inside an ARRAY, neither the central write-only-secret\n * sentinel-strip NOR a whole-array `$set` preserves them on save: the repository\n * replaces the entire array with no deep merge. The UPDATE custom-impl therefore\n * matches each incoming override to the stored record by `providerRef` and\n * re-injects any secret that arrived absent or as the `••••••••` mask.\n \n @see oauth2-connection-resolver — resolveSocialConnection() steps 5b/5c\n * @see sso-config.custom-impl — prefixCoreOperations UPDATE handler\n /\n socialCredentialOverrides: z.array(z.object({\n providerRef: z.string().min(1),\n clientId: z.string().min(1),\n clientSecret: z.string().min(1).isWriteOnlySecret(),\n signedJwtKeyId: z.string().optional().isBackendOnly(),\n signedJwtTeamId: z.string().optional().isBackendOnly(),\n })).default([]).refine(\n (arr) => new Set(arr.map(o => o.providerRef)).size === arr.length,\n { message: 'Duplicate providerRef in socialCredentialOverrides' },\n ),\n\n createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type SsoConfigBase = z.infer<typeof SsoConfigBaseSchema>;\n\n/\n The domains this organization has actually VERIFIED — the join `verifiedDomains` does not carry.\n \n ## Why this exists rather than five correct joins\n \n The stored list holds CLAIMED domains, so safety depends on every reader filtering it by\n * `domainVerificationStatus`. Measured 2026-09-08, five reader sites did that by hand — the SCIM\n * controller, the SCIM virtual field, the domain-verification service, and the domain-to-org lookup\n * TWICE — and a sixth, `getDomains`, did not. It returned the raw list under the name `verified`.\n \n That is `.claude/rules/invariant-call-site-enumeration.md`'s exact shape: an invariant hand-applied\n * at N sites, where the next site is the one that forgets. It had already happened; it was harmless\n * only because that reader had no consumer — and claiming a domain is now reachable by tenants\n * through `SsoConfig_Operations.CLAIM_DOMAIN` (#424), so the margin that made it harmless is gone.\n \n So the join is computed ONCE, here, beside the field it corrects. A new reader that reaches for\n * the verified set finds this; one that reaches for the raw array finds the warning on the field.\n \n Takes the shape structurally rather than `SsoConfigBase` so a caller holding a partial config, a\n * DTO or a lean document can use it — the three existing shapes at the call sites — without the\n * helper forcing a cast at every one of them.\n /\nexport function resolveVerifiedDomains(domains: {\n readonly verifiedDomains?: readonly string[];\n readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n} \| undefined): string[] {\n const status = domains?.domainVerificationStatus ?? {};\n return (domains?.verifiedDomains ?? []).filter(\n domain => status[domain] === DomainVerificationStatus.VERIFIED,\n );\n}\n\n/* Whether ONE domain is verified for this organization. The single-domain form of the join. */\nexport function isDomainVerified(\n domains: {\n readonly verifiedDomains?: readonly string[];\n readonly domainVerificationStatus?: Readonly<Record<string, string>>;\n } \| undefined,\n domain: string,\n): boolean {\n return (domains?.verifiedDomains ?? []).includes(domain)\n && domains?.domainVerificationStatus?.[domain] === DomainVerificationStatus.VERIFIED;\n}\n\nexport const ssoConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n baseResourceType: 'ssoConfig',\n baseFieldIdentifier: 'ssoConfigId',\n baseEnumKey: 'SSO_CONFIG',\n baseSchema: SsoConfigBaseSchema,\n variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts CHANGED Viewed

@@ -50,7 +50,14 @@ export declare const SsoConnection_TestConnectionResponseDto: z.ZodDiscriminated
     protocol: z.ZodLiteral<SsoProtocol.SAML>;
     supported: z.ZodLiteral<true>;
     entityIdConfigured: z.ZodBoolean;
-    ssoUrlReachable: z.ZodBoolean;
+    /**
+     * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
+     * outbound-target guard refused the destination (a private address the operator has not declared in
+     * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement
+     * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
+     * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
+     */
+    ssoUrlReachable: z.ZodOptional<z.ZodBoolean>;
     ssoUrlStatus: z.ZodOptional<z.ZodNumber>;
     certificates: z.ZodArray<z.ZodObject<{
         index: z.ZodNumber;
@@ -61,6 +68,7 @@ export declare const SsoConnection_TestConnectionResponseDto: z.ZodDiscriminated
         fingerprint: z.ZodString;
         warnings: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
+    /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
     sloUrlReachable: z.ZodOptional<z.ZodBoolean>;
     sloUrlStatus: z.ZodOptional<z.ZodNumber>;
     spMetadataValid: z.ZodBoolean;

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC~~;;;;;;;;;;;;;;;;;;;;;;;;;gCAoBlD~~,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}
1	+ {"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;IAKhD;;;;;;OAMG;;;;;;;;;;;;IAIH,uEAAuE;;;;;;;;;;;gCAazE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js CHANGED Viewed

@@ -72,9 +72,17 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
         protocol: z.literal(SsoProtocol.SAML),
         supported: z.literal(true),
         entityIdConfigured: z.boolean(),
-        ssoUrlReachable: z.boolean(),
+        /**
+         * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
+         * outbound-target guard refused the destination (a private address the operator has not declared in
+         * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement
+         * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
+         * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
+         */
+        ssoUrlReachable: z.boolean().optional(),
         ssoUrlStatus: z.number().int().optional(),
         certificates: z.array(SsoConnection_CertificateTestResultDto),
+        /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
         sloUrlReachable: z.boolean().optional(),
         sloUrlStatus: z.number().int().optional(),
         spMetadataValid: z.boolean(),

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SSO Connection Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...ssoConnectionPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n TEST_CONNECTION = 'testConnection',\n DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/* Final SAML diagnostic posture after all configured checks complete. /\nexport enum SsoConnectionTestOverallStatus {\n PASS = 'pass',\n WARNING = 'warning',\n FAIL = 'fail',\n}\n\n/* Evidence source that produced a supported endpoint-discovery result. /\nexport enum SsoConnectionDiscoverySource {\n SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/\n TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n /\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/\n Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n /\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n z.strictObject({\n metadataUrl: z.url(),\n issuerUrl: z.url().optional(),\n }),\n z.strictObject({\n issuerUrl: z.url(),\n metadataUrl: z.url().optional(),\n }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n index: z.number().int().nonnegative(),\n valid: z.boolean(),\n expiresAt: z.string(),\n daysRemaining: z.number().int(),\n algorithm: z.string(),\n fingerprint: z.string(),\n warnings: z.array(z.string()),\n});\n\n/\n Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n /\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityIdConfigured: z.boolean(),\n ssoUrlReachable: z.boolean(),\n ssoUrlStatus: z.number().int().optional(),\n certificates: z.array(SsoConnection_CertificateTestResultDto),\n sloUrlReachable: z.boolean().optional(),\n sloUrlStatus: z.number().int().optional(),\n spMetadataValid: z.boolean(),\n overallStatus: z.enum(SsoConnectionTestOverallStatus),\n errors: z.array(z.string()),\n warnings: z.array(z.string()),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n/\n Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n /\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityId: z.string().min(1),\n ssoUrl: z.url(),\n sloUrl: z.url().optional(),\n x509Certificates: z.array(z.string()),\n nameIdFormat: z.string().optional(),\n source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n ssoConnectionPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n // the target connection BEFORE any user is authenticated, so the caller holds\n // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n // reads the connection through the sanctioned request-triggered ACL-bypass\n // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n //\n // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n customOperation: SsoConnection_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n // Service-transport default. The enterprise SSO login-initiation\n // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n // which resolves the READ path through `getServiceOperationPathDefault`\n // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n // public HTTP surface — admins list connections via the API_CALL LIST)\n // gives the system read a resolvable service-transport path. Gated by\n // `systemAccessPolicy.read = ALLOWED` above.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n // service transport is the only tier that carries the connection's write\n // semantics, and `getServiceOperationPathDefault` (behind every `AsSystem`\n // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n //\n // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n // write could resolve a service op-path, AND `doOperation` throws outright on a\n // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n // write semantics never ran — `connectionId` minting, SAML\n // `x509CertificatePem` → `x509Certificates` normalization, nested\n // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n // last-connection / in-use guards. They are now reachable.\n //\n // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n //\n // The `onParentDelete` cascade is unaffected — it deletes through\n // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n // That path still bypasses the service tier and the DELETE custom impl by design.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [SsoConnection_Operations.TEST_CONNECTION]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.READ,\n requestDto: SsoConnection_TestConnectionRequestDto,\n // Borrows READ for its route/verb but returns protocol-discriminated\n // diagnostics, not the SSO-connection row.\n customResponseDto: SsoConnection_TestConnectionResponseDto,\n }],\n },\n [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n // Borrows CREATE for its route/verb but returns discovered metadata,\n // not a created or updated SSO-connection row.\n customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n }],\n },\n },\n },\n);\n"]}
1	+ {"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B;;;;;;WAMG;QACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,uEAAuE;QACvE,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/*\n SSO Connection Resource Configuration — Polymorphic\n \n Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n * ...ssoConnectionPolymorphicFactories\n /\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n ResourceOperationRiskLevel,\n ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n TEST_CONNECTION = 'testConnection',\n DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/* Final SAML diagnostic posture after all configured checks complete. /\nexport enum SsoConnectionTestOverallStatus {\n PASS = 'pass',\n WARNING = 'warning',\n FAIL = 'fail',\n}\n\n/* Evidence source that produced a supported endpoint-discovery result. /\nexport enum SsoConnectionDiscoverySource {\n SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/\n TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n /\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/\n Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n /\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n z.strictObject({\n metadataUrl: z.url(),\n issuerUrl: z.url().optional(),\n }),\n z.strictObject({\n issuerUrl: z.url(),\n metadataUrl: z.url().optional(),\n }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n index: z.number().int().nonnegative(),\n valid: z.boolean(),\n expiresAt: z.string(),\n daysRemaining: z.number().int(),\n algorithm: z.string(),\n fingerprint: z.string(),\n warnings: z.array(z.string()),\n});\n\n/\n Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n /\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityIdConfigured: z.boolean(),\n /\n Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n * outbound-target guard refused the destination (a private address the operator has not declared in\n * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n /\n ssoUrlReachable: z.boolean().optional(),\n ssoUrlStatus: z.number().int().optional(),\n certificates: z.array(SsoConnection_CertificateTestResultDto),\n /* As `ssoUrlReachable`; also absent when no SLO URL is configured. /\n sloUrlReachable: z.boolean().optional(),\n sloUrlStatus: z.number().int().optional(),\n spMetadataValid: z.boolean(),\n overallStatus: z.enum(SsoConnectionTestOverallStatus),\n errors: z.array(z.string()),\n warnings: z.array(z.string()),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n/\n Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n /\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n z.strictObject({\n protocol: z.literal(SsoProtocol.SAML),\n supported: z.literal(true),\n entityId: z.string().min(1),\n ssoUrl: z.url(),\n sloUrl: z.url().optional(),\n x509Certificates: z.array(z.string()),\n nameIdFormat: z.string().optional(),\n source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n }),\n z.strictObject({\n protocol: z.literal(SsoProtocol.OIDC),\n supported: z.literal(false),\n message: z.string().min(1),\n }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n ssoConnectionPolymorphicDeclaration,\n {\n isSystemResource: true,\n // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n // the target connection BEFORE any user is authenticated, so the caller holds\n // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n // reads the connection through the sanctioned request-triggered ACL-bypass\n // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n //\n // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n systemAccessPolicy: {\n read: ResourceSystemAccessMode.ALLOWED,\n list: ResourceSystemAccessMode.ALLOWED,\n },\n customOperation: SsoConnection_Operations,\n coreOperations: [\n CoreResourceOperation.READ,\n CoreResourceOperation.LIST,\n CoreResourceOperation.CREATE,\n CoreResourceOperation.UPDATE,\n CoreResourceOperation.DELETE,\n ],\n operationsConfiguration: {\n [CoreResourceOperation.READ]: {\n variants: [\n {\n // Service-transport default. The enterprise SSO login-initiation\n // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n // which resolves the READ path through `getServiceOperationPathDefault`\n // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n // public HTTP surface — admins list connections via the API_CALL LIST)\n // gives the system read a resolvable service-transport path. Gated by\n // `systemAccessPolicy.read = ALLOWED` above.\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n [CoreResourceOperation.LIST]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.LOW,\n }],\n },\n // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n // service transport is the only tier that carries the connection's write\n // semantics, and `getServiceOperationPathDefault` (behind every `AsSystem`\n // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n //\n // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n // write could resolve a service op-path, AND `doOperation` throws outright on a\n // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n // write semantics never ran — `connectionId` minting, SAML\n // `x509CertificatePem` → `x509Certificates` normalization, nested\n // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n // last-connection / in-use guards. They are now reachable.\n //\n // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n //\n // The `onParentDelete` cascade is unaffected — it deletes through\n // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n // That path still bypasses the service tier and the DELETE custom impl by design.\n [CoreResourceOperation.CREATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.UPDATE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [CoreResourceOperation.DELETE]: {\n variants: [{\n variantType: ResourceOperationVariantType.INTERNAL_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.HIGH,\n }],\n },\n [SsoConnection_Operations.TEST_CONNECTION]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.READ,\n requestDto: SsoConnection_TestConnectionRequestDto,\n // Borrows READ for its route/verb but returns protocol-discriminated\n // diagnostics, not the SSO-connection row.\n customResponseDto: SsoConnection_TestConnectionResponseDto,\n }],\n },\n [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n variants: [{\n variantType: ResourceOperationVariantType.API_CALL,\n isDefault: true,\n polymorphicRole: {\n [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n },\n riskLevel: ResourceOperationRiskLevel.MEDIUM,\n resourceOperationLike: CoreResourceOperation.CREATE,\n requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n // Borrows CREATE for its route/verb but returns discovered metadata,\n // not a created or updated SSO-connection row.\n customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n }],\n },\n },\n },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts CHANGED Viewed

@@ -72,6 +72,7 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
         allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
@@ -131,6 +132,7 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
         }>>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
@@ -145,9 +147,9 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
     groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
@@ -181,6 +183,7 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
         allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
@@ -240,6 +243,7 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
         }>>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
@@ -254,9 +258,9 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
     autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
     groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["~~../../../../../~~src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6KlC~~,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~kBAQ9C,CAAC"}
1	+ {"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqPlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.js CHANGED Viewed

@@ -95,6 +95,23 @@ export const SsoConnectionBaseSchema = z.object({
         allowedClockDrift: z.number().min(0).max(300).default(30).isAuditEvidence(),
         forceAuthn: z.boolean().default(false).isAuditEvidence(),
         maxAuthAge: z.number().min(0).optional().isAuditEvidence(),
+        /**
+         * Whether a person linked through this connection may confirm it is them by signing in again here
+         * (#1441), when adding or removing a way to sign in. Off by default, like the OIDC flag.
+         *
+         * The request is sent with `ForceAuthn="true"` whatever `forceAuthn` says, and the assertion's
+         * `AuthnStatement/@AuthnInstant` must be no older than the request: SAML 2.0 Core §3.4.1 says an IdP
+         * receiving `ForceAuthn="true"` MUST authenticate the presenter directly rather than rely on a previous
+         * security context, and the schema makes `AuthnInstant` required on every authentication statement.
+         * Turn it on only for an IdP that honours `ForceAuthn`: one that silently reuses its session answers
+         * with an old `AuthnInstant` and every re-authentication through it is refused.
+         *
+         * spec-cite: OASIS SAML 2.0 Core (saml-core-2.0-os) §3.4.1 `ForceAuthn` ("the identity provider MUST
+         * authenticate the presenter directly rather than rely on a previous security context") and §2.7.2
+         * `AuthnInstant [Required]`, fetched 2026-09-21 from
+         * https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
+         */
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
         nameIdFormat: z.enum(SamlNameIdFormat).default(SamlNameIdFormat.EMAIL_ADDRESS).isAuditEvidence(),
         allowIdpInitiated: z.boolean().default(false).isAuditEvidence(),
         auditSettings: z.object({
@@ -188,6 +205,27 @@ export const SsoConnectionBaseSchema = z.object({
         acrValues: z.array(z.string()).optional().isAuditEvidence(),
         maxAge: z.number().min(0).optional().isAuditEvidence(),
         prompt: z.enum(SSOPrompt).optional().isAuditEvidence(),
+        /**
+         * May an account re-prove who it is through this identity provider (#1441)?
+         *
+         * When on, an account whose link to this provider is an OIDC link can answer a re-authentication
+         * request (adding or removing a sign-in method, or a step-up the policy allows it for) by signing in
+         * again at the provider. The request carries `prompt=login`, `max_age=0` and an essential `auth_time`
+         * claim; the verified ID token must carry an `auth_time` no older than the request itself, or the
+         * proof is refused. So a provider that does not force a fresh sign-in yields an old `auth_time` and is
+         * refused, never trusted.
+         *
+         * OFF by default, and it should be switched on only for a provider that honours those parameters.
+         * OpenID Connect Core 1.0 §3.1.2.1 defines `prompt=login` and `max_age`, and §2 makes `auth_time`
+         * REQUIRED when `max_age` is sent, but providers differ: Google's documentation lists no `login` value
+         * for `prompt` and returns `auth_time` only when that claim is requested and enabled in its security
+         * settings. An account on a provider that cannot re-prove it is not asked for a proof it cannot give.
+         * spec-cite: OpenID Connect Core 1.0 §3.1.2.1 and §2, fetched 2026-09-21 from
+         * https://openid.net/specs/openid-connect-core-1_0.html
+         * spec-cite: Google Identity, OpenID Connect documentation (`prompt` values, `auth_time`), fetched
+         * 2026-09-21 from https://developers.google.com/identity/openid-connect/openid-connect
+         */
+        reAuthenticationEnabled: z.boolean().default(false).isAuditEvidence(),
         pkceEnabled: z.boolean().default(true).isAuditEvidence(),
         pkceMethod: z.enum(SSOPKCEMethod).default(SSOPKCEMethod.S256).isAuditEvidence(),
         auditSettings: z.object({
@@ -199,10 +237,28 @@ export const SsoConnectionBaseSchema = z.object({
     }).optional(),
     autoCreateUsers: z.boolean().default(true),
     autoVerifyEmail: z.boolean().default(true),
-    /** W2.8: if true, users authenticating via this SSO connection skip the application-level MFA policy. */
-    // `.isAuditEvidence()` — an explicit escape from the application MFA policy for everyone who
-    // authenticates through this connection. Flipping it on lowers the assurance level tenant-wide.
-    bypassAppMFA: z.boolean().default(false).isAuditEvidence(),
+    /*
+     * `bypassAppMFA` was REMOVED (#1236), rather than wired.
+     *
+     * It was authorable, `.isAuditEvidence()`, and read by no production code — so a change to it was
+     * recorded in the trail as a change to a security setting that had no runtime effect. That is the
+     * sharp edge: the ledger asserted a posture change that did not happen, and a reviewer reading the
+     * trail would conclude a control had been relaxed.
+     *
+     * Removed rather than implemented because implementing it would re-open what #1223 had just closed.
+     * An application's declared `requireMFA` is now enforced on the federated lane too — the external
+     * assurance default derives from that declaration — and the organization policy merge is
+     * most-restrictive, so a tenant may tighten the application's posture and never loosen it. A
+     * connection-level escape hatch is the one shape that contradicts both.
+     *
+     * The framework's own shipped documentation already told operators "keep it off and do not use it as
+     * evidence that MFA was bypassed or enforced". A field whose documentation says not to use it is a
+     * field to delete.
+     *
+     * If an application ever needs a tenant to lower the application's requirement, that belongs where
+     * the requirement is DECLARED — in the user-type MFA policy — not on a connection, so that the
+     * relaxation is visible beside the thing it relaxes.
+     */
     // `.isAuditEvidence()` on all four — this is the connection's ROLE-GRANT surface. `defaultRole`
     // and the two mappings decide what authority an externally-authenticated identity lands with,
     // and `allowedDomains` decides whose identities the connection will accept at all. A change
@@ -212,6 +268,22 @@ export const SsoConnectionBaseSchema = z.object({
     // externally-authenticated identity lands with, and whose identities are accepted.
     defaultRole: z.string().optional().isAuditEvidence(),
     allowedDomains: z.array(z.string()).default([]).isDBIndexed().isAuditEvidence(),
+    /**
+     * The provider DIRECTORIES this connection admits — for Microsoft, the Entra tenant ids (#1230).
+     *
+     * A separate list from `allowedDomains` because the values are a different KIND. An email domain says
+     * where an address is; a directory id says which organization's directory asserted it, and only the
+     * second is a membership proof — a directory can assert an address in a domain it does not own,
+     * which is the case the whole mechanism exists to separate.
+     *
+     * Empty means no directory restriction, matching `allowedDomains` rather than inventing a second
+     * convention. The two are INDEPENDENT: a connection may restrict the directory and not the domain,
+     * and the directory check does not stop when the domain list is empty.
+     *
+     * `.isAuditEvidence()` for the same reason as its neighbours below — widening the set of directories
+     * a connection accepts is an authorization change, and the field name alone cannot evidence it.
+     */
+    allowedDirectoryIds: z.array(z.string()).default([]).isAuditEvidence(),
     roleMapping: z.record(z.string(), z.string()).optional().isAuditEvidence(),
     groupMapping: z.record(z.string(), z.array(z.string())).optional().isAuditEvidence(),
     createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),