@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/authentications/scim/scim-organization-unit-mapping.shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1C,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACtC,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,yCAAyC,CACvD,cAAiC,EACjC,kBAA6D;IAE7D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE5F,OAAO;QACL,eAAe,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnE,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;aACnE,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SCIM directory value → organization-unit assignment (WS-C).\n *\n * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n *\n * ## What this decides, and why it is EXPLICIT rather than inferred\n *\n * An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n *\n * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n *\n * ## Authoritative reconciliation\n *\n * Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n *\n * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n */\n\nimport { z } from 'zod';\n\n/**\n * One declared binding: the directory's own value for a department, and the unit it means.\n *\n * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n */\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n  /** The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. */\n  directoryValue: z.string().min(1).max(200),\n  /** The `ORGANIZATION_UNITS` row this value binds to. */\n  organizationUnitId: z.string().min(1),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */\nexport type ScimOrganizationUnitManagementSignal = {\n  readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;\n  readonly defaultUnitRole?: string | null;\n};\n\n/**\n * Is this organization managing unit assignments through SCIM at all?\n *\n * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n */\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean {\n  return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/**\n * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n *\n * `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n */\nexport function resolveScimOrganizationUnitId(\n  directoryValue: string | undefined | null,\n  mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null,\n): string | undefined {\n  const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n  if (normalizedValue.length === 0) return undefined;\n\n  return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/** An existing assignment row, read structurally. */\nexport type ScimOrganizationUnitAssignment = {\n  readonly _id: string;\n  readonly organizationUnitId: string;\n};\n\n/** The writes a push must perform to make the member's assignments match the directory. */\nexport type ScimOrganizationUnitReconciliation = {\n  /** Units to assign that the member does not already hold. */\n  readonly unitIdsToCreate: string[];\n  /** Assignment rows to delete — everything the directory no longer says. */\n  readonly assignmentIdsToRemove: string[];\n};\n\n/**\n * Compute the exact writes that make a member's unit assignments match the directory.\n *\n * Idempotent by construction: an unchanged department produces no writes at all, so a directory that\n * re-pushes every user nightly does not churn the junction table or its audit trail.\n *\n * A `desiredUnitIds` of `[]` (the directory sent no department, or one nobody mapped) removes every\n * assignment — that is the authoritative half, and it is what makes leaving a department actually\n * revoke its access.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n  desiredUnitIds: readonly string[],\n  currentAssignments: readonly ScimOrganizationUnitAssignment[],\n): ScimOrganizationUnitReconciliation {\n  const desired = new Set(desiredUnitIds);\n  const held = new Set(currentAssignments.map((assignment) => assignment.organizationUnitId));\n\n  return {\n    unitIdsToCreate: [...desired].filter((unitId) => !held.has(unitId)),\n    assignmentIdsToRemove: currentAssignments\n      .filter((assignment) => !desired.has(assignment.organizationUnitId))\n      .map((assignment) => assignment._id),\n  };\n}\n"]}
+{"version":3,"file":"scim-organization-unit-mapping.shared.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-organization-unit-mapping.shared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iLAAiL,CAAC;IACtO,wDAAwD;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qEAAqE,CAAC;CACtH,CAAC,CAAC;AAUH;;;;;;;GAOG;AACH,MAAM,UAAU,uCAAuC,CAAC,MAA+D;IACrH,OAAO,CAAC,CAAC,MAAM,EAAE,eAAe,IAAI,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAC3C,cAAyC,EACzC,OAAuE;IAEvE,MAAM,eAAe,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEnD,OAAO,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,eAAe,CAAC,EAAE,kBAAkB,CAAC;AACvG,CAAC;AAeD;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,sCAKX;AALD,WAAY,sCAAsC;IAChD,kGAAkG;IAClG,uEAA6B,CAAA;IAC7B,uGAAuG;IACvG,uEAA6B,CAAA;AAC/B,CAAC,EALW,sCAAsC,KAAtC,sCAAsC,QAKjD;AAmCD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yCAAyC,CACvD,qBAAwC,EACxC,kBAA6D,EAC7D,OAAmD;IAEnD,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,IAAI,sCAAsC,CAAC,YAAY,CAAC;IAClF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,8BAA8B,IAAI,EAAE,CAAC,CAAC;IAEhF,MAAM,eAAe,GAAG,CAAC,UAA0C,EAAU,EAAE;QAC7E,IAAI,IAAI,KAAK,sCAAsC,CAAC,YAAY;YAAE,OAAO,UAAU,CAAC,kBAAkB,CAAC;QACvG,6FAA6F;QAC7F,8FAA8F;QAC9F,wEAAwE;QACxE,IAAI,UAAU,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,yDAAyD,UAAU,CAAC,GAAG,gCAAgC;kBACrG,SAAS,sCAAsC,CAAC,YAAY,YAAY,CAC3E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,oBAAoB,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,sBAAsB,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/F,qBAAqB,EAAE,kBAAkB;aACtC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;YACrB,MAAM,aAAa,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YAClD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;KACvC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * SCIM directory value → organization-unit assignment (WS-C).\n *\n * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — binds a directory-declared department to\n * an organization unit, and keeps that binding authoritative rather than accumulating.\n *\n * ## What this decides, and why it is EXPLICIT rather than inferred\n *\n * An IdP pushes a flat string (`department: \"Sales\"`). Units live in a TREE where `code` is unique\n * only among siblings and `name` is freeform, so \"Sales\" can legitimately match several nodes. Since\n * units became an authorization axis, resolving that string to the wrong node does not mislabel a\n * user — it grants them the wrong data.\n *\n * So there is no fuzzy matching, no name/code search, and no auto-creation. An organization admin\n * declares the binding explicitly, unit id by unit id, and a directory value with no declared binding\n * is IGNORED. The person who owns the org chart is the one who says what \"Sales\" means; nothing here\n * guesses on their behalf.\n *\n * ## Authoritative reconciliation\n *\n * Each push replaces the member's unit assignments with exactly what the directory currently says\n * (approved decision). A user who moves Sales → Legal LOSES Sales: keeping it would be privilege\n * accretion, where access only ever grows and an offboarded department is never actually left.\n *\n * ⚠️ The consequence, stated because it is not obvious: assignments made by hand in the application\n * are ALSO removed on the next push, because SCIM is authoritative over the whole set rather than\n * over a subset it can distinguish as its own. An organization that wants manual unit assignments\n * should not enable this mapping. This is why {@link isScimOrganizationUnitManagementEnabled}\n * requires an explicit, non-empty declaration before ANY reconciliation runs — an organization that\n * never opted in can never have its assignments deleted by a push.\n */\n\nimport { z } from 'zod';\n\n/**\n * One declared binding: the directory's own value for a department, and the unit it means.\n *\n * `directoryValue` is matched EXACTLY (after trimming) against what the IdP sends. It is deliberately\n * not normalised beyond whitespace — case and punctuation are part of what a directory actually\n * pushes, and silently folding them would make two distinct departments collide onto one unit.\n */\nexport const ScimOrganizationUnitMappingEntrySchema = z.object({\n  /** The value the directory pushes, e.g. `\"Sales\"`. Matched exactly, whitespace-trimmed. */\n  directoryValue: z.string().min(1).max(200).describe(\"A department value the directory sends, such as `Sales`, up to 200 characters. It must match exactly, apart from surrounding whitespace; a department with no entry is ignored.\"),\n  /** The `ORGANIZATION_UNITS` row this value binds to. */\n  organizationUnitId: z.string().min(1).describe(\"The organization unit a member with this department is assigned to.\"),\n});\n\nexport type ScimOrganizationUnitMappingEntry = z.infer<typeof ScimOrganizationUnitMappingEntrySchema>;\n\n/** The provisioning-config surface this module reads, kept structural so callers pass their row as-is. */\nexport type ScimOrganizationUnitManagementSignal = {\n  readonly organizationUnitMapping?: readonly ScimOrganizationUnitMappingEntry[] | null;\n  readonly defaultUnitRole?: string | null;\n};\n\n/**\n * Is this organization managing unit assignments through SCIM at all?\n *\n * Requires BOTH a non-empty mapping and a role to grant — an assignment cannot be created without a\n * role, so a mapping without one could only ever delete. That is exactly the failure mode this gate\n * exists to prevent: a half-configured row must never make a push authoritative over assignments it\n * has no way to recreate.\n */\nexport function isScimOrganizationUnitManagementEnabled(config: ScimOrganizationUnitManagementSignal | undefined | null): boolean {\n  return !!config?.defaultUnitRole && (config.organizationUnitMapping?.length ?? 0) > 0;\n}\n\n/**\n * Resolve one directory value to the unit it was declared to mean, or `undefined` when nothing\n * declares it.\n *\n * `undefined` means UNMAPPED, not \"no unit\": the caller treats an unmapped value as \"the directory\n * says nothing about units for this user\", which under authoritative reconciliation removes their\n * directory-managed assignments rather than inventing one.\n */\nexport function resolveScimOrganizationUnitId(\n  directoryValue: string | undefined | null,\n  mapping: readonly ScimOrganizationUnitMappingEntry[] | undefined | null,\n): string | undefined {\n  const normalizedValue = typeof directoryValue === 'string' ? directoryValue.trim() : '';\n  if (normalizedValue.length === 0) return undefined;\n\n  return mapping?.find((entry) => entry.directoryValue.trim() === normalizedValue)?.organizationUnitId;\n}\n\n/** An existing assignment row, read structurally. */\nexport type ScimOrganizationUnitAssignment = {\n  readonly _id: string;\n  readonly organizationUnitId: string;\n  /**\n   * The membership side of the edge. A real junction row ALWAYS carries it; it is optional here only\n   * because the department axis never projects it, and requiring it would make every caller and pin\n   * on that axis supply a value nothing reads. Required in practice on\n   * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} — see the contract check there.\n   */\n  readonly organizationMemberId?: string;\n};\n\n/**\n * Which side of the (member, unit) edge the directory is currently speaking about.\n *\n * Both SCIM paths reconcile the SAME junction and the same way — \"make the edges incident to ONE\n * anchor match exactly what the directory says\" — and differ only in which node is the anchor. That\n * is one concept seen from two sides, not two concepts, so it is one function; the axis names the\n * side so neither call site has to re-derive the transposition.\n */\nexport enum ScimOrganizationUnitReconciliationAxis {\n  /** Anchored on ONE member; the units vary. The `/Users` department push (`department` → unit). */\n  MEMBER_UNITS = 'member_units',\n  /** Anchored on ONE unit; the members vary. The `/Groups` membership push (`members` → memberships). */\n  UNIT_MEMBERS = 'unit_members',\n}\n\n/** The writes a push must perform to make the anchor's assignments match the directory. */\nexport type ScimOrganizationUnitReconciliation = {\n  /**\n   * Counterparts to assign that the anchor does not already hold — unit ids on\n   * {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, organization-member ids on\n   * {@link ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS}.\n   */\n  readonly counterpartIdsToCreate: string[];\n  /** Assignment rows to delete — everything the directory no longer says, minus what it cannot speak for. */\n  readonly assignmentIdsToRemove: string[];\n};\n\nexport type ScimOrganizationUnitReconciliationOptions = {\n  /** Defaults to {@link ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS}, the department push. */\n  readonly axis?: ScimOrganizationUnitReconciliationAxis;\n  /**\n   * Counterparts this push has NO authority over: neither created nor removed, whatever the directory\n   * says about them.\n   *\n   * The department push supplies the member's units that a `/Groups` push owns\n   * (`OrganizationUnit.externalSource === SCIM`). Without it the two directory paths silently fight:\n   * department reconciliation is authoritative over the member's WHOLE set, so every `/Users` push\n   * would delete the assignments `/Groups` made — and Entra sends group membership as DELTAS\n   * (`PATCH … op: Add|Remove`), so nothing would ever restore them. The member would quietly lose the\n   * group's access on their next attribute sync, which is under-privilege nobody is told about.\n   *\n   * It is NOT a general \"leave this alone\" hatch: an id belongs here only when ANOTHER directory-owned\n   * path is authoritative for it. A hand-made assignment is still removed, which is the documented\n   * cost of opting an organization into `organizationUnitMapping`.\n   */\n  readonly counterpartIdsOutsideAuthority?: readonly string[];\n};\n\n/**\n * Compute the exact writes that make one anchor's unit assignments match the directory.\n *\n * Idempotent by construction: an unchanged department — or an unchanged group membership — produces\n * no writes at all, so a directory that re-pushes everything nightly does not churn the junction\n * table or its audit trail.\n *\n * A `desiredCounterpartIds` of `[]` removes every assignment the caller has authority over. That is\n * the authoritative half, and it is what makes leaving a department (or a group) actually revoke its\n * access rather than accumulate it.\n */\nexport function resolveScimOrganizationUnitReconciliation(\n  desiredCounterpartIds: readonly string[],\n  currentAssignments: readonly ScimOrganizationUnitAssignment[],\n  options?: ScimOrganizationUnitReconciliationOptions,\n): ScimOrganizationUnitReconciliation {\n  const axis = options?.axis ?? ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS;\n  const outsideAuthority = new Set(options?.counterpartIdsOutsideAuthority ?? []);\n\n  const counterpartIdOf = (assignment: ScimOrganizationUnitAssignment): string => {\n    if (axis === ScimOrganizationUnitReconciliationAxis.MEMBER_UNITS) return assignment.organizationUnitId;\n    // A junction row without its membership FK cannot be placed on this axis, and GUESSING would\n    // silently withhold a revocation — the one outcome this reconciliation exists to guarantee. A\n    // contract violation by the caller, so it is loud rather than absorbed.\n    if (assignment.organizationMemberId === undefined) {\n      throw new Error(\n        `resolveScimOrganizationUnitReconciliation: assignment ${assignment._id} has no organizationMemberId, `\n        + `which ${ScimOrganizationUnitReconciliationAxis.UNIT_MEMBERS} requires.`,\n      );\n    }\n    return assignment.organizationMemberId;\n  };\n\n  const desired = new Set(desiredCounterpartIds);\n  const held = new Set(currentAssignments.map(counterpartIdOf));\n\n  return {\n    counterpartIdsToCreate: [...desired].filter((id) => !held.has(id) && !outsideAuthority.has(id)),\n    assignmentIdsToRemove: currentAssignments\n      .filter((assignment) => {\n        const counterpartId = counterpartIdOf(assignment);\n        return !desired.has(counterpartId) && !outsideAuthority.has(counterpartId);\n      })\n      .map((assignment) => assignment._id),\n  };\n}\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts

@@ -6,5 +6,16 @@
  *   ...scimProvisioningConfigPolymorphicFactories
  */
 import { CoreResourceOperation } from '../../../resources/resources.shared.core.definitions';
+import { ResourceOperationVariantType } from '../../../resources/resources.shared.schemas';
+/**
+ * The variant each SCIM configuration WRITE is declared with — the one source the resource configuration and the
+ * custom-implementation prefix (the writer's role ceiling, #1631) both read, because the implementation registry keys
+ * on the full operation path. CREATE is INTERNAL_CALL (materialised by the framework), UPDATE is API_CALL (the
+ * administrator's settings door).
+ */
+export declare const SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE: {
+    readonly create: ResourceOperationVariantType.INTERNAL_CALL;
+    readonly update: ResourceOperationVariantType.API_CALL;
+};
 export declare const scimProvisioningConfigPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<undefined, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE, any>>;
 //# sourceMappingURL=scim-provisioning-config.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,eAAO,MAAM,0CAA0C,yNA6FtD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EAEL,4BAA4B,EAC7B,MAAM,6CAA6C,CAAC;AAMrD;;;;;GAKG;AACH,eAAO,MAAM,2CAA2C;;;CAG9C,CAAC;AAIX,eAAO,MAAM,0CAA0C,yNA2GtD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js

@@ -11,6 +11,16 @@ import { createPolymorphicResourceConfigurations } from '../../../resources/util
 import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas.js';
 import { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas.js';
+/**
+ * The variant each SCIM configuration WRITE is declared with — the one source the resource configuration and the
+ * custom-implementation prefix (the writer's role ceiling, #1631) both read, because the implementation registry keys
+ * on the full operation path. CREATE is INTERNAL_CALL (materialised by the framework), UPDATE is API_CALL (the
+ * administrator's settings door).
+ */
+export const SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE = {
+    [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,
+    [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,
+};
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(scimProvisioningConfigPolymorphicDeclaration, {
     isSystemResource: true,
@@ -32,7 +42,7 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
@@ -51,7 +61,7 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
         // READ/UPDATE. Admin tier / HIGH.
         [CoreResourceOperation.CREATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],
                     isDefault: true,
                     polymorphicRole: {
                         [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
@@ -60,10 +70,11 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                 }],
         },
-        // Internal-only (INTERNAL_CALL, NO HTTP route): SCIM provisioning edits reach this through
-        // the config service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig`
-        // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving
-        // admin audit attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
+        // Two kinds of caller reach this write and both resolve the SAME default: an administrator
+        // editing the settings pane, over the HTTP route this variant now carries; and the config
+        // service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig` dispatching
+        // via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving admin audit
+        // attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via
         // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT
         // REPOSITORY_ONLY — a repository-only UPDATE throws
         // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save
@@ -72,14 +83,27 @@ export const scimProvisioningConfigPolymorphicFactories = createPolymorphicResou
         // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.
         // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-
         // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)
-        // No public HTTP update surface (config is admin-service-owned, never self-serve). Same
-        // fix as the CREATE above + the SSO/SIEM UPDATE precedent. Admin tier / HIGH.
+        //
+        // API_CALL — the administrator's edit door, flipped from INTERNAL_CALL alongside SSO config and
+        // following SIEM export config (#953). Route-less, this policy was something only a backend
+        // service could change, which contradicts the plainest reading of a settings pane: the four
+        // decisions on this row — create users, verify their email, deactivate on deprovision, and the
+        // role they land with — are exactly what an operator opens SCIM settings to set. The comment
+        // that stood here said the config was "admin-service-owned, never self-serve"; the door is
+        // gated on ORG_ADMIN / APP super-admin, so it is not self-serve, it is admin-served.
+        //
+        // One thing moves in lockstep since #1631: CREATE and UPDATE carry a custom-implementation prefix (the
+        // writer's role ceiling over `defaultRole` / `defaultUnitRole`), and the custom-implementation registry
+        // keys on the FULL operation path, variantType included. So both variants are read from
+        // `SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE`, the one source the prefix registers against; a
+        // variant changed here without it would silently skip the ceiling.
+        // Admin tier / HIGH.
         [CoreResourceOperation.UPDATE]: {
             variants: [{
-                    variantType: ResourceOperationVariantType.INTERNAL_CALL,
+                    variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,0DAA0D;IAC1D,8EAA8E;IAC9E,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,kCAAkC;QAClC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,4FAA4F;QAC5F,wFAAwF;QACxF,mFAAmF;QACnF,oDAAoD;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,wFAAwF;QACxF,8EAA8E;QAC9E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,sEAAsE;QACtE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...scimProvisioningConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas';\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimProvisioningConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // SCIM provisioning loads its config via `readAsSystem` on the directory-sync\n    // path (system-driven, no end user in context) (READ). When the row is absent\n    // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`\n    // default-seed — the userless load path lazily materialises the\n    // disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are\n    // system-context, so the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction). No public HTTP create surface (config\n      // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens\n      // READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): SCIM provisioning edits reach this through\n      // the config service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig`\n      // dispatches the write via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving\n      // admin audit attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save\n      // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when\n      // their `save*` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less\n      // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.\n      // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-\n      // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)\n      // No public HTTP update surface (config is admin-service-owned, never self-serve). Same\n      // fix as the CREATE above + the SSO/SIEM UPDATE precedent. Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is\n      // physically removed when its owning org/app is deleted. Without a DELETE op the\n      // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope\n      // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"scim-provisioning-config.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,4CAA4C,EAAE,MAAM,2CAA2C,CAAC;AAEzG;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,aAAa;IAC1E,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,4BAA4B,CAAC,QAAQ;CAC7D,CAAC;AAEX,wEAAwE;AAExE,MAAM,CAAC,MAAM,0CAA0C,GAAG,uCAAuC,CAC/F,4CAA4C,EAC5C;IACE,gBAAgB,EAAE,IAAI;IACtB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,gEAAgE;IAChE,0DAA0D;IAC1D,8EAA8E;IAC9E,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,MAAM,EAAE,wBAAwB,CAAC,OAAO;KACzC;IACD,cAAc,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC;IACtI,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,4EAA4E;QAC5E,8EAA8E;QAC9E,uEAAuE;QACvE,4EAA4E;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,wDAAwD;QACxD,0EAA0E;QAC1E,6EAA6E;QAC7E,yEAAyE;QACzE,kCAAkC;QAClC,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,2FAA2F;QAC3F,0FAA0F;QAC1F,+FAA+F;QAC/F,mFAAmF;QACnF,4EAA4E;QAC5E,mFAAmF;QACnF,oDAAoD;QACpD,wFAAwF;QACxF,yFAAyF;QACzF,sFAAsF;QACtF,0FAA0F;QAC1F,2FAA2F;QAC3F,uFAAuF;QACvF,EAAE;QACF,gGAAgG;QAChG,4FAA4F;QAC5F,4FAA4F;QAC5F,+FAA+F;QAC/F,6FAA6F;QAC7F,2FAA2F;QAC3F,qFAAqF;QACrF,EAAE;QACF,uGAAuG;QACvG,wGAAwG;QACxG,wFAAwF;QACxF,gGAAgG;QAChG,mEAAmE;QACnE,qBAAqB;QACrB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,2CAA2C,CAAC,qBAAqB,CAAC,MAAM,CAAC;oBACtF,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,yEAAyE;QACzE,+EAA+E;QAC/E,iFAAiF;QACjF,gFAAgF;QAChF,sEAAsE;QACtE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...scimProvisioningConfigPolymorphicFactories\n */\n\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimProvisioningConfigPolymorphicDeclaration } from './scim-provisioning-config.shared.schemas';\n\n/**\n * The variant each SCIM configuration WRITE is declared with — the one source the resource configuration and the\n * custom-implementation prefix (the writer's role ceiling, #1631) both read, because the implementation registry keys\n * on the full operation path. CREATE is INTERNAL_CALL (materialised by the framework), UPDATE is API_CALL (the\n * administrator's settings door).\n */\nexport const SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE = {\n  [CoreResourceOperation.CREATE]: ResourceOperationVariantType.INTERNAL_CALL,\n  [CoreResourceOperation.UPDATE]: ResourceOperationVariantType.API_CALL,\n} as const;\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimProvisioningConfigPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimProvisioningConfigPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // SCIM provisioning loads its config via `readAsSystem` on the directory-sync\n    // path (system-driven, no end user in context) (READ). When the row is absent\n    // — a provisioned / migrated / pre-seed org that bypassed the `afterCreate`\n    // default-seed — the userless load path lazily materialises the\n    // disabled-default row via `createAsSystem` (CREATE); see\n    // `AuthOrganizationConfigurationService.loadScimProvisioningConfig`. Both are\n    // system-context, so the resource opts BOTH verbs in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      create: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [CoreResourceOperation.READ, CoreResourceOperation.CREATE, CoreResourceOperation.UPDATE, CoreResourceOperation.DELETE],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Internal-only (INTERNAL_CALL, NO HTTP route): the per-scope config row is\n      // materialised by the framework default-seed (repository tier) OR — when that\n      // was bypassed (provisioned / migrated / pre-seed org) — lazily by the\n      // userless load path via `createAsSystem` (`systemAccessPolicy.create` opts\n      // it in). Must NOT be REPOSITORY_ONLY: `createAsSystem` resolves CREATE via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but\n      // NOT REPOSITORY_ONLY — a repository-only CREATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical, and\n      // self-alerting on mere construction). No public HTTP create surface (config\n      // is seeded/bootstrapped, never self-serve). Same fix as the SCIM-tokens\n      // READ/UPDATE. Admin tier / HIGH.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.CREATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Two kinds of caller reach this write and both resolve the SAME default: an administrator\n      // editing the settings pane, over the HTTP route this variant now carries; and the config\n      // service path — `AuthOrganizationConfigurationService.saveScimProvisioningConfig` dispatching\n      // via `ServicesRegistryHandler.update` with the ADMIN's EC, preserving admin audit\n      // attribution. Must NOT be REPOSITORY_ONLY: `.update()` resolves the op via\n      // `getServiceOperationPathDefault`, which honours INTERNAL_CALL / API_CALL but NOT\n      // REPOSITORY_ONLY — a repository-only UPDATE throws\n      // `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND` (INTERNAL / critical) whenever the save\n      // method runs. This completes the enterprise-config trio: SSO and SIEM were flipped when\n      // their `save*` helpers were fixed, leaving SCIM the last REPOSITORY_ONLY writer-less\n      // config — a latent copy of the same FATAL, armed for whoever wrote the save method next.\n      // (No UPDATE custom-impl to keep in lockstep: the read-only computed fields are framework-\n      // driven via `.isVirtual()` on the schema, which is variant-agnostic by construction.)\n      //\n      // API_CALL — the administrator's edit door, flipped from INTERNAL_CALL alongside SSO config and\n      // following SIEM export config (#953). Route-less, this policy was something only a backend\n      // service could change, which contradicts the plainest reading of a settings pane: the four\n      // decisions on this row — create users, verify their email, deactivate on deprovision, and the\n      // role they land with — are exactly what an operator opens SCIM settings to set. The comment\n      // that stood here said the config was \"admin-service-owned, never self-serve\"; the door is\n      // gated on ORG_ADMIN / APP super-admin, so it is not self-serve, it is admin-served.\n      //\n      // One thing moves in lockstep since #1631: CREATE and UPDATE carry a custom-implementation prefix (the\n      // writer's role ceiling over `defaultRole` / `defaultUnitRole`), and the custom-implementation registry\n      // keys on the FULL operation path, variantType included. So both variants are read from\n      // `SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE`, the one source the prefix registers against; a\n      // variant changed here without it would silently skip the ceiling.\n      // Admin tier / HIGH.\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: SCIM_PROVISIONING_CONFIG_WRITE_VARIANT_TYPE[CoreResourceOperation.UPDATE],\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      // Internal-only (REPOSITORY_ONLY, no HTTP route): powers the composition\n      // onParentDelete cascade so this one-per-scope SCIM-provisioning-config row is\n      // physically removed when its owning org/app is deleted. Without a DELETE op the\n      // cascade (deleteChildrenImmediate) throws ErrorType.CONFIGURATION on any scope\n      // with a config row. Admin tier (ORG_ADMIN / APP super-admin) / HIGH.\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts

@@ -2,8 +2,22 @@
  * SCIM Provisioning Config Schema (Shared) — Polymorphic
  *
  * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.
- * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a
- * separate provisioning channel triggered by IdP push.
+ *
+ * ONE of the two provisioning authorities, and the boundary is the TRIGGER rather than the feature.
+ * This row governs a DIRECTORY PUSH — the IdP calling `/scim/v2`, read by
+ * `scim.backend.controller._getProvisioningConfig`. Per organization, because a tenant has one
+ * directory relationship.
+ *
+ * The other is the CONNECTION: an interactive sign-in through OIDC or SAML reads
+ * `SsoConnection.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`. Per
+ * connection, because two IdPs bound to one tenant may legitimately differ. Both funnel into
+ * `provisionEnterpriseUser`, which is why the two configurations look alike and are not
+ * interchangeable — an organization can run either without the other.
+ *
+ * This comment used to point at `SsoConfig.provisioning` as the JIT half. That block existed, was
+ * rendered on the SSO settings pane, and had no readers at all; it has been removed. Nothing here
+ * changed with it.
+ *
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
  * @see auth-data-model-audit.md §2G

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsJ3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAa9E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAwC,CAAC;AAE9E,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;iBAsK3C,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE1F,eAAO,MAAM,4CAA4C;;;;;;;;;;;;;;;;;;;;;kBAMvD,CAAC"}

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js

@@ -2,8 +2,22 @@
  * SCIM Provisioning Config Schema (Shared) — Polymorphic
  *
  * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.
- * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a
- * separate provisioning channel triggered by IdP push.
+ *
+ * ONE of the two provisioning authorities, and the boundary is the TRIGGER rather than the feature.
+ * This row governs a DIRECTORY PUSH — the IdP calling `/scim/v2`, read by
+ * `scim.backend.controller._getProvisioningConfig`. Per organization, because a tenant has one
+ * directory relationship.
+ *
+ * The other is the CONNECTION: an interactive sign-in through OIDC or SAML reads
+ * `SsoConnection.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`. Per
+ * connection, because two IdPs bound to one tenant may legitimately differ. Both funnel into
+ * `provisionEnterpriseUser`, which is why the two configurations look alike and are not
+ * interchangeable — an organization can run either without the other.
+ *
+ * This comment used to point at `SsoConfig.provisioning` as the JIT half. That block existed, was
+ * rendered on the SSO settings pane, and had no readers at all; it has been removed. Nothing here
+ * changed with it.
+ *
  * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.
  *
  * @see auth-data-model-audit.md §2G
@@ -30,10 +44,10 @@ import { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit
  *   also `emails[type eq "work"].value`) — the SCIM-style selector the spec examples use.
  */
 export const ScimAttributeMappingSchema = z.object({
-    email: z.string().default('emails[0].value'),
-    firstName: z.string().default('name.givenName'),
-    lastName: z.string().default('name.familyName'),
-    displayName: z.string().default('displayName'),
+    email: z.string().default('emails[0].value').describe("Where to read the member's email in a pushed SCIM User, as a path such as `emails[type eq \"work\"].value`. Defaults to `emails[0].value`; when the path finds nothing, `userName` and then the primary email are used instead."),
+    firstName: z.string().default('name.givenName').describe("Where to read the member's first name in a pushed SCIM User. Defaults to `name.givenName`."),
+    lastName: z.string().default('name.familyName').describe("Where to read the member's last name in a pushed SCIM User. Defaults to `name.familyName`."),
+    displayName: z.string().default('displayName').describe("Where to read the member's display name in a pushed SCIM User. Defaults to `displayName`."),
 });
 /**
  * The scope FKs the polymorphism engine injects onto the two variants. Declared here
@@ -117,6 +131,22 @@ export const ScimProvisioningConfigBaseSchema = z.object({
      * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a
      * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which
      * is organization-admin-gated. Treat configuring it as granting the role.
+     *
+     * ⚠️ **On its own it now ENABLES `/scim/v2/Groups` (#1378), and that is a change from what this
+     * field used to mean.** It is required by BOTH directory paths, and they need different companions:
+     *
+     * - the `department` path needs it AND a non-empty
+     *   {@link ScimProvisioningConfigBaseSchema.shape.organizationUnitMapping} — see
+     *   `isScimOrganizationUnitManagementEnabled`, which is why this field alone used to do nothing;
+     * - the GROUPS path needs only this. A directory group carries its own identity, so there is no
+     *   mapping to declare — the group becomes a unit and its members become assignments carrying this
+     *   role.
+     *
+     * So setting it "ready for later", which was harmless before, now lets the directory create units
+     * and grant this role in them. It also gates every `/Groups` verb INCLUDING READS: with no value
+     * here, all six answer `403` naming this field, because an assignment cannot exist without a role
+     * and a directory that could create groups it can never populate is the half-configured state the
+     * department path already refuses.
      */
     // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the
     // JSDoc above says it plainly: treat configuring it as granting the role.

package/dist/esm/security/authentications/scim/scim-provisioning-config.shared.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;CAC/C,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;OAWG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n * Independent from SSO JIT provisioning (SsoConfig.provisioning) — SCIM is a\n * separate provisioning channel triggered by IdP push.\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value'),\n  firstName: z.string().default('name.givenName'),\n  lastName: z.string().default('name.familyName'),\n  displayName: z.string().default('displayName'),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/**\n * The API-relative base an external identity provider pushes SCIM traffic to.\n *\n * ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n *\n * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n */\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => SCIM_SERVICE_BASE_PATH,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n        // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n        // \"which are verified\", and only the caller knows whether the config was readable at all.\n        return resolveVerifiedDomains(domains);\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}
+{"version":3,"file":"scim-provisioning-config.shared.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-provisioning-config.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kDAAkD,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC1E,OAAO,EAAE,sCAAsC,EAAE,MAAM,yCAAyC,CAAC;AAEjG;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,iOAAiO,CAAC;IACxR,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,4FAA4F,CAAC;IACtJ,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,2FAA2F,CAAC;CACrJ,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,2BAA2B,GAA4E;IAC3G,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,uBAAuB,CAAC;IAC5D,CAAC,eAAe,EAAE,gBAAgB,CAAC,sBAAsB,CAAC;CAClD,CAAC;AAGX;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAW,GAAG,kBAAkB,UAAU,CAAC;AAE9E,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,cAAc,EAAE;IAEtD,gGAAgG;IAChG,kGAAkG;IAClG,4EAA4E;IAC5E,gGAAgG;IAChG,mFAAmF;IACnF,6FAA6F;IAC7F,4FAA4F;IAC5F,gGAAgG;IAChG,4FAA4F;IAC5F,iGAAiG;IACjG,+FAA+F;IAC/F,8FAA8F;IAC9F,+FAA+F;IAC/F,+FAA+F;IAC/F,+FAA+F;IAC/F,6FAA6F;IAC7F,4FAA4F;IAC5F,mGAAmG;IACnG,sBAAsB;IACtB,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE;IAC7E,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IACpD,gBAAgB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IAEvD;;;;;;;;;;;;;;;;;OAiBG;IACH,4FAA4F;IAC5F,6FAA6F;IAC7F,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAErG;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,gGAAgG;IAChG,0EAA0E;IAC1E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,eAAe,EAAE;IAExD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QAC/C,SAAS,EAAE,GAAG,EAAE,CAAC,sBAAsB;KACxC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC;QACvD,YAAY,EAAE,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,EAAE;YAC5C,MAAM,GAAG,GAAG,aAAoD,CAAC;YAEjE,MAAM,KAAK,GAAG,2BAA2B;iBACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;iBAC3E,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC1F,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC;YAE7B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YAClF,IAAI,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC,0BAA0B,KAAK,UAAU;gBAAE,OAAO,SAAS,CAAC;YAEvG,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,aAAa,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnF,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAEzC,CAAC;gBACd,IAAI,CAAC,OAAO;oBAAE,OAAO,SAAS,CAAC;gBAE/B,uFAAuF;gBACvF,yFAAyF;gBACzF,0FAA0F;gBAC1F,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CACnB,sEAAsE,KAAK,CAAC,EAAE,IAAI,OAAO,0BAA0B,EACnH,KAAK,CACN,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;KACF,CAAC;IAEF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;IACrF,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC,iBAAiB,EAAE;CACtF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,4CAA4C,GAAG,yBAAyB,CAAC;IACpF,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,0BAA0B;IAC/C,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE,gCAAgC;IAC5C,QAAQ,EAAE,mBAAmB;CAC9B,CAAC,CAAC","sourcesContent":["/**\n * SCIM Provisioning Config Schema (Shared) — Polymorphic\n *\n * SCIM provisioning settings: auto-create, auto-deactivate, attribute mapping.\n *\n * ONE of the two provisioning authorities, and the boundary is the TRIGGER rather than the feature.\n * This row governs a DIRECTORY PUSH — the IdP calling `/scim/v2`, read by\n * `scim.backend.controller._getProvisioningConfig`. Per organization, because a tenant has one\n * directory relationship.\n *\n * The other is the CONNECTION: an interactive sign-in through OIDC or SAML reads\n * `SsoConnection.{autoCreateUsers, defaultRole, roleMapping, groupMapping}`. Per\n * connection, because two IdPs bound to one tenant may legitimately differ. Both funnel into\n * `provisionEnterpriseUser`, which is why the two configurations look alike and are not\n * interchangeable — an organization can run either without the other.\n *\n * This comment used to point at `SsoConfig.provisioning` as the JIT half. That block existed, was\n * rendered on the SSO settings pane, and had no readers at all; it has been removed. Nothing here\n * changed with it.\n *\n * Scope FK (organizationId / applicationId) is injected by the polymorphism engine.\n *\n * @see auth-data-model-audit.md §2G\n */\n\nimport { z } from 'zod';\nimport { AUTH_SCOPE_VARIANTS } from '../authentication.shared.schemas';\nimport { declarePolymorphicSchemas } from '../../../resources/utils/resource-polymorphism.schemas';\nimport { CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport { MAIN_API_BASE_PATH } from '../../../requests/manual-controllers-routes-urls';\nimport { resolveVerifiedDomains } from '../sso/sso-config.shared.schemas';\nimport { ScimOrganizationUnitMappingEntrySchema } from './scim-organization-unit-mapping.shared';\n\n/**\n * Maps a Wildo profile field to a PATH into the inbound SCIM User JSON. Each value is a\n * path expression resolved against the SCIM body at push time by the backend\n * `resolveScimAttributePath` — the row's authoritative source for how a directory's payload\n * shape translates to Wildo's `{email, firstName, lastName, displayName}` (Okta, Azure AD, etc.\n * differ). The defaults reproduce the framework's built-in mapping exactly, so an org that never\n * customises this behaves identically to the hardcoded normalisation it replaces.\n *\n * Supported path grammar (what `resolveScimAttributePath` understands):\n * - dotted traversal — `name.givenName`\n * - array index — `emails[0].value`\n * - array filter — `emails[primary eq true].value` (first element whose `primary` equals `true`;\n *   also `emails[type eq \"work\"].value`) — the SCIM-style selector the spec examples use.\n */\nexport const ScimAttributeMappingSchema = z.object({\n  email: z.string().default('emails[0].value').describe(\"Where to read the member's email in a pushed SCIM User, as a path such as `emails[type eq \\\"work\\\"].value`. Defaults to `emails[0].value`; when the path finds nothing, `userName` and then the primary email are used instead.\"),\n  firstName: z.string().default('name.givenName').describe(\"Where to read the member's first name in a pushed SCIM User. Defaults to `name.givenName`.\"),\n  lastName: z.string().default('name.familyName').describe(\"Where to read the member's last name in a pushed SCIM User. Defaults to `name.familyName`.\"),\n  displayName: z.string().default('displayName').describe(\"Where to read the member's display name in a pushed SCIM User. Defaults to `displayName`.\"),\n});\nexport type ScimAttributeMapping = z.infer<typeof ScimAttributeMappingSchema>;\n\n/**\n * The scope FKs the polymorphism engine injects onto the two variants. Declared here\n * (rather than read off a variant schema) because this BASE schema's virtual fields run\n * for both variants and must discover which scope the row belongs to at read time.\n */\nconst SCIM_SCOPE_FK_TO_SSO_CONFIG: ReadonlyArray<readonly [fk: string, ssoResourceType: CoreResourceType]> = [\n  ['organizationId', CoreResourceType.ORGANIZATION_SSO_CONFIG],\n  ['applicationId', CoreResourceType.APPLICATION_SSO_CONFIG],\n] as const;\n\n\n/**\n * The API-relative base an external identity provider pushes SCIM traffic to.\n *\n * ONE named source for a path that four different surfaces need to agree on: the virtual\n * `scimEndpointUrl` below, the SCIM controller's own mount, the specification that documents the\n * field, and the customer documentation that tells an administrator what to paste into their IdP.\n * Before this existed the documentation's worked example was `https://api.example.com/api/v1/scim/v2`\n * — a real path under a host that does not exist, which an administrator cannot tell from a value\n * they are meant to use.\n *\n * Built from {@link MAIN_API_BASE_PATH}, so a mount change moves every consumer with it rather than\n * stranding a literal. That is not hypothetical here: this field replaced a dead custom\n * implementation that hardcoded `/api/scim/v2` and was simply wrong for missing the version prefix.\n */\nexport const SCIM_SERVICE_BASE_PATH: string = `${MAIN_API_BASE_PATH}/scim/v2`;\n\nexport const ScimProvisioningConfigBaseSchema = z.object({\n  _id: z.string().min(1).isPrimaryKey().isSummaryField(),\n\n  // NOTE: there is deliberately NO `scimEnabled` field. Whether SCIM is AVAILABLE for an org is a\n  // per-ORG-TYPE decision at `organizationTypes[type].scimProvisioning.enabled` in the app config —\n  // the authority the app-global MOUNT gate and the SCIM controller auth gate\n  // (`isScimProvisioningEnabledForOrg`) consult. NB: the invitation `managementMode` resolver and\n  // the invite-accept credential block key instead on per-org ACTIVE management (the\n  // DIRECTORY_PROVISIONING feature + a live SCIM token — see `isOrgActivelyDirectoryManaged` /\n  // AUTH-23), so a SCIM-capable type does not by itself forbid local credentials. A per-scope\n  // `scimEnabled` on this row would duplicate the type-level authority, could silently drift from\n  // it, and was read by nothing. This row governs only WHAT HAPPENS to users once SCIM is on.\n  // `.isAuditEvidence()` on the four below — every one decides what the DIRECTORY is allowed to do\n  // to member accounts and with what standing. `defaultRole` in particular is a role GRANT: SCIM\n  // provisions through an internal execution context, so it is NOT bounded by any caller's role\n  // ceiling (see `defaultUnitRole`'s note below) — configuring it IS granting the role, which is\n  // exactly the class of change an auditor must be able to reconstruct with before/after values.\n  // `autoDeactivateUsers` is the deprovisioning switch; flipping it off silently strands access.\n  // None of these is personal data — they are flags and role names — so recording their values\n  // does not conflict with the minimisation rule that keeps user-identifying fields unmarked.\n  // assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the switches that create accounts and\n  // deprovision access.\n  autoCreateUsers: z.boolean().default(true).isSummaryField().isAuditEvidence(),\n  autoVerifyEmail: z.boolean().default(true),\n  autoDeactivateUsers: z.boolean().default(true).isAuditEvidence(),\n  defaultRole: z.string().optional().isAuditEvidence(),\n  attributeMapping: ScimAttributeMappingSchema.optional(),\n\n  /**\n   * Declared bindings from the directory's `department` value to an ORGANIZATION UNIT.\n   *\n   * assurance-control: WILDO.IDENTITY.DIRECTORY_PROVISIONING — the directory becomes the authority\n   * for which unit a member belongs to.\n   *\n   * Explicit and unit-id-addressed on purpose. Since units are an authorization axis, resolving a\n   * flat directory string to the wrong node in the tree grants the wrong DATA — and `code` is unique\n   * only among siblings while `name` is freeform, so a search-based match is genuinely ambiguous.\n   * Nothing here guesses: a value with no declared binding is ignored, and no unit is ever created.\n   *\n   * ⚠️ **Declaring this makes SCIM AUTHORITATIVE over the member's unit assignments.** Every push\n   * replaces the member's assignments with exactly what the directory says, so leaving a department\n   * actually revokes its access — and assignments made BY HAND in the application are removed too.\n   * An organization that wants manual unit assignments should leave this empty. Reconciliation only\n   * runs when this list is non-empty AND {@link ScimProvisioningConfigBaseSchema.shape.defaultUnitRole}\n   * is set, so an organization that never opted in can never have assignments deleted by a push.\n   */\n  // `.isAuditEvidence()` — declaring a binding makes SCIM AUTHORITATIVE over unit assignments\n  // (see the warning above), so the mapping list is an authorization surface, not preferences.\n  organizationUnitMapping: z.array(ScimOrganizationUnitMappingEntrySchema).optional().isAuditEvidence(),\n\n  /**\n   * The role every SCIM-created unit assignment carries.\n   *\n   * Deliberately SEPARATE from {@link ScimProvisioningConfigBaseSchema.shape.defaultRole}, which is the\n   * ORGANIZATION-wide role. A unit grant and an organization grant are different authority over\n   * different row sets; one field meaning both would merge two scopes that the whole narrowing model\n   * exists to keep apart.\n   *\n   * ⚠️ SCIM provisions through an internal execution context, so this value is NOT bounded by a\n   * caller's role ceiling — exactly as `defaultRole` is not. The gate is the write to THIS row, which\n   * is organization-admin-gated. Treat configuring it as granting the role.\n   *\n   * ⚠️ **On its own it now ENABLES `/scim/v2/Groups` (#1378), and that is a change from what this\n   * field used to mean.** It is required by BOTH directory paths, and they need different companions:\n   *\n   * - the `department` path needs it AND a non-empty\n   *   {@link ScimProvisioningConfigBaseSchema.shape.organizationUnitMapping} — see\n   *   `isScimOrganizationUnitManagementEnabled`, which is why this field alone used to do nothing;\n   * - the GROUPS path needs only this. A directory group carries its own identity, so there is no\n   *   mapping to declare — the group becomes a unit and its members become assignments carrying this\n   *   role.\n   *\n   * So setting it \"ready for later\", which was harmless before, now lets the directory create units\n   * and grant this role in them. It also gates every `/Groups` verb INCLUDING READS: with no value\n   * here, all six answer `403` naming this field, because an assignment cannot exist without a role\n   * and a directory that could create groups it can never populate is the half-configured state the\n   * department path already refuses.\n   */\n  // `.isAuditEvidence()` — a role grant on a DIFFERENT authority axis than `defaultRole`, and the\n  // JSDoc above says it plainly: treat configuring it as granting the role.\n  defaultUnitRole: z.string().optional().isAuditEvidence(),\n\n  /**\n   * The API-relative path an external IdP pushes SCIM traffic to, e.g. `/api/v1/scim/v2`.\n   *\n   * VIRTUAL (computed per read, never persisted, never accepted on write) because it is\n   * derived deployment routing — not tenant data. Storing it would let a row drift from the\n   * route the server actually mounts, which is precisely the class of lie this field replaces:\n   * it supersedes a dead custom-implementation that injected a hardcoded `/api/scim/v2`,\n   * **missing the `/api/v1` mount prefix and therefore simply wrong**. Built from\n   * {@link MAIN_API_BASE_PATH} — the documented single source of truth for the prefix — so a\n   * future mount change moves this field with it instead of stranding a literal.\n   *\n   * PATH, not an absolute URL: the host lives in `runtime.endPoints.main_backend_api.publicUrl`,\n   * reachable only through `AppConfigService`, whose DI symbol lives in `saas-backend-lib` —\n   * unreachable from this shared package without inverting the dependency direction. `publicUrl`\n   * is also optional, so an absolute form would frequently resolve to nothing. Callers that need\n   * the absolute endpoint compose it against their own API base (the frontend already knows it).\n   *\n   * Identical on both scope variants: the SCIM controller mounts ONE app-global router and\n   * separates tenants by bearer token, not by path.\n   */\n  scimEndpointUrl: z.string().optional().isVirtual({\n    calculate: () => SCIM_SERVICE_BASE_PATH,\n  }),\n\n  /**\n   * The email domains SCIM provisioning will accept, mirroring the gate actually enforced at\n   * push time — `EnterpriseUserProvisioningBackendService.provisionEnterpriseUser` rejects an IdP profile\n   * whose email domain is absent from this list.\n   *\n   * VIRTUAL and read live from the scope's SSO config rather than stored here: the domains are\n   * OWNED by `SsoConfig.domains` (verified via DNS there), so persisting a copy on this row\n   * would denormalize a security-relevant allow-list and let it go stale against the owner —\n   * exactly the drift `forwardedLabel` exists to avoid. Same predicate as the enforcement path\n   * (`SCIMControllerBackendService._getProvisioningConfig`): a domain counts only once DNS\n   * verification has actually passed, so `verifiedDomains` is filtered by\n   * `domainVerificationStatus`. Deliberately NOT the looser `verifiedDomains || ssoEnabledDomains`\n   * union used by domain→org lookup — widening this list would widen a security gate.\n   *\n   * `[]` and `undefined` are DISTINCT and both meaningful:\n   * - `[]` — the SSO config exists and has no verified domain ⇒ **unrestricted** (the enforcement\n   *   check is skipped entirely when the list is empty). This is the honest reading of the value.\n   * - `undefined` — the SSO config could not be read ⇒ **undetermined**. Degrading to `[]` here\n   *   would render an unread config as \"unrestricted\", overstating what we know.\n   *\n   * Fail-safe: never throws — this is a display mirror, not the enforcement point.\n   */\n  allowedDomains: z.array(z.string()).optional().isVirtual({\n    dependencies: SCIM_SCOPE_FK_TO_SSO_CONFIG.map(([fk]) => fk),\n    calculate: async ({ currentObject, utils }) => {\n      const row = currentObject as Record<string, unknown> | undefined;\n\n      const scope = SCIM_SCOPE_FK_TO_SSO_CONFIG\n        .map(([fk, ssoResourceType]) => ({ fk, ssoResourceType, value: row?.[fk] }))\n        .find(({ value }) => value !== null && value !== undefined && String(value).length > 0);\n      if (!scope) return undefined;\n\n      const scopeId = String(scope.value);\n      const ssoRepository = utils?.repositories?.getRepository?.(scope.ssoResourceType);\n      if (!ssoRepository || typeof ssoRepository.findFieldValuesByJoinField !== 'function') return undefined;\n\n      try {\n        const rowsByScopeId: Map<string, Record<string, unknown>> =\n          await ssoRepository.findFieldValuesByJoinField(scope.fk, [scopeId], ['domains']);\n        const domains = rowsByScopeId.get(scopeId)?.['domains'] as\n          | { verifiedDomains?: string[]; domainVerificationStatus?: Record<string, string> }\n          | undefined;\n        if (!domains) return undefined;\n\n        // The one derivation (#457), not a sixth hand-written join. `undefined` above is still\n        // DISTINCT from the `[]` this can return — see the field's docstring; the helper answers\n        // \"which are verified\", and only the caller knows whether the config was readable at all.\n        return resolveVerifiedDomains(domains);\n      } catch (error) {\n        utils?.logger?.warn?.(\n          `[scimProvisioningConfig.allowedDomains] SSO config read failed for ${scope.fk}=${scopeId}; reporting undetermined`,\n          error,\n        );\n        return undefined;\n      }\n    },\n  }),\n\n  createdAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n  updatedAt: z.date().default(() => new Date()).excludeFromCreate().excludeFromUpdate(),\n});\n\nexport type ScimProvisioningConfigBase = z.infer<typeof ScimProvisioningConfigBaseSchema>;\n\nexport const scimProvisioningConfigPolymorphicDeclaration = declarePolymorphicSchemas({\n  baseResourceType: 'scimProvisioningConfig',\n  baseFieldIdentifier: 'scimProvisioningConfigId',\n  baseEnumKey: 'SCIM_PROVISIONING_CONFIG',\n  baseSchema: ScimProvisioningConfigBaseSchema,\n  variants: AUTH_SCOPE_VARIANTS,\n});\n"]}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAY/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQA8J1C,CAAC"}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAa/G,oBAAY,qBAAqB;IAC/B,cAAc,kBAAkB;IAChC,YAAY,gBAAgB;IAC5B,YAAY,gBAAgB;CAC7B;AAID,eAAO,MAAM,kCAAkC;;;kBAG7C,CAAC;AAEH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,gCAAgC,iCAAqB,CAAC;AAEnE,eAAO,MAAM,iCAAiC;;;;kBAI5C,CAAC;AAEH,eAAO,MAAM,iCAAiC;;;;;kBAK5C,CAAC;AAIH,eAAO,MAAM,8BAA8B,yQAoK1C,CAAC"}

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js

@@ -7,7 +7,7 @@
  */
 import { z } from 'zod';
 import { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions.js';
-import { ResourceOperationRiskLevel, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
+import { ResourceOperationRiskLevel, ResourceOperationReversibility, ResourceOperationVariantType, } from '../../../resources/resources.shared.schemas.js';
 import { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas.js';
 import { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory.js';
 import { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas.js';
@@ -32,14 +32,14 @@ export const ScimTokens_RevokeTokenRequestDto = z.strictObject({});
 export const ScimTokens_RotateTokenRequestDto = z.strictObject({});
 export const ScimTokens_RevokeTokenResponseDto = z.strictObject({
     isActive: z.boolean(),
-    revokedAt: z.date(),
-    message: z.string(),
+    revokedAt: z.date().describe("When this request revoked the token. The time is not stored on the token, so later reads do not show it."),
+    message: z.string().describe("A fixed confirmation: `Token revoked`."),
 });
 export const ScimTokens_RotateTokenResponseDto = z.strictObject({
-    newToken: z.string().isEphemeral(),
-    newTokenId: z.string(),
-    newTokenHash: z.string(),
-    message: z.string(),
+    newToken: z.string().isEphemeral().describe("The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead."),
+    newTokenId: z.string().describe("The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id."),
+    newTokenHash: z.string().describe("The SHA-256 hash of the new token value, in hex: the form in which it is stored."),
+    message: z.string().describe("A fixed confirmation: `Token rotated`."),
 });
 // ── Polymorphic Factory ──────────────────────────────────────────────
 export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(scimTokensPolymorphicDeclaration, {
@@ -83,7 +83,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
                 }],
@@ -129,7 +129,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
                     resourceOperationLike: CoreResourceOperation.CREATE,
@@ -145,7 +145,7 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     // `token` is `.isEphemeral()` (secret display, revealed once, not
                     // persisted — same decorator api-key `plainKey` uses).
                     customResponseDto: ScimTokenBaseSchema.extend({
-                        token: z.string().isEphemeral(),
+                        token: z.string().isEphemeral().describe("The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests."),
                     }),
                 }],
         },
@@ -154,9 +154,12 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: ScimTokens_RevokeTokenRequestDto,
                     // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for
@@ -175,9 +178,12 @@ export const scimTokensPolymorphicFactories = createPolymorphicResourceConfigura
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                     },
                     riskLevel: ResourceOperationRiskLevel.HIGH,
+                    // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.
+                    // This is what admits it to the danger zone; risk alone no longer does.
+                    reversibility: ResourceOperationReversibility.IRREVERSIBLE,
                     resourceOperationLike: CoreResourceOperation.UPDATE,
                     requestDto: ScimTokens_RotateTokenRequestDto,
                     // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's

package/dist/esm/security/authentications/scim/scim-tokens.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;qBAChC,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Tokens Resource Configuration — Polymorphic\n *\n * Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n *   ...scimTokensPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n  GENERATE_TOKEN = 'generateToken',\n  REVOKE_TOKEN = 'revokeToken',\n  ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n  displayName: z.string().min(1),\n  expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/**\n * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n */\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n  isActive: z.boolean(),\n  revokedAt: z.date(),\n  message: z.string(),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n  newToken: z.string().isEphemeral(),\n  newTokenId: z.string(),\n  newTokenHash: z.string(),\n  message: z.string(),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimTokensPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: ScimTokens_Operations,\n    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n    // on EVERY /scim/v2/* request via a system-context read (see\n    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n    // enterprise SSO-connection resolver's pre-auth read.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The bearer-auth token lookup reads this through the service layer\n          // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n          // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n          // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // and 500s every SCIM request. Same fix as the SSO-connection READ.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n          // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n          // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n          // internal-only; operators rotate/revoke via the dedicated custom ops.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [ScimTokens_Operations.GENERATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: ScimTokens_GenerateTokenRequestDto,\n          // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n          // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n          // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n          // This mirrors the api-key mint contract exactly: the response DTO is the\n          // resource schema extended with an ephemeral secret field — NOT a bespoke\n          // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n          // `createdByUserId` so the core create persists) + postfix (attaches the\n          // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n          // `token` is `.isEphemeral()` (secret display, revealed once, not\n          // persisted — same decorator api-key `plainKey` uses).\n          customResponseDto: ScimTokenBaseSchema.extend({\n            token: z.string().isEphemeral(),\n          }),\n        }],\n      },\n      [ScimTokens_Operations.REVOKE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RevokeTokenRequestDto,\n          // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n          // audit and merely flips `isActive` to false — so the borrowed core op must be a\n          // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n          // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n          // DELETE deleted the token before the handler could intervene — the same\n          // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n          // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n          // revocation acknowledgement, NOT the SCIM-token resource row.\n          customResponseDto: ScimTokens_RevokeTokenResponseDto,\n        }],\n      },\n      [ScimTokens_Operations.ROTATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RotateTokenRequestDto,\n          // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n          // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n          // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n          // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n          // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n          // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n          // revealed, not editable), mirroring api-key `plainKey`.\n          //\n          // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n          // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n          // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n          // authenticating at once. Do not expose a migration-window request or response until a\n          // real persisted grace-slot contract exists.\n          customResponseDto: ScimTokens_RotateTokenResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"scim-tokens.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/scim/scim-tokens.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3E,OAAO,EAAE,gCAAgC,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAErG,wEAAwE;AAExE,MAAM,CAAN,IAAY,qBAIX;AAJD,WAAY,qBAAqB;IAC/B,yDAAgC,CAAA;IAChC,qDAA4B,CAAA;IAC5B,qDAA4B,CAAA;AAC9B,CAAC,EAJW,qBAAqB,KAArB,qBAAqB,QAIhC;AAED,wEAAwE;AAExE,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE;;;GAGG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,0GAA0G,CAAC;IACxI,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iNAAiN,CAAC;IAC9P,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4GAA4G,CAAC;IAC7I,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kFAAkF,CAAC;IACrH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;CACvE,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,8BAA8B,GAAG,uCAAuC,CACnF,gCAAgC,EAChC;IACE,gBAAgB,EAAE,IAAI;IACtB,eAAe,EAAE,qBAAqB;IACtC,+EAA+E;IAC/E,6DAA6D;IAC7D,sFAAsF;IACtF,mFAAmF;IACnF,qFAAqF;IACrF,sDAAsD;IACtD,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,oEAAoE;oBACpE,6EAA6E;oBAC7E,yEAAyE;oBACzE,iFAAiF;oBACjF,oEAAoE;oBACpE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,8EAA8E;oBAC9E,+EAA+E;oBAC/E,kFAAkF;oBAClF,uFAAuF;oBACvF,kFAAkF;oBAClF,uEAAuE;oBACvE,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,eAAe;oBACzD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;qBAC7D;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,cAAc,CAAC,EAAE;YACtC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,kCAAkC;oBAC9C,wEAAwE;oBACxE,yEAAyE;oBACzE,2EAA2E;oBAC3E,0EAA0E;oBAC1E,0EAA0E;oBAC1E,iEAAiE;oBACjE,yEAAyE;oBACzE,uEAAuE;oBACvE,kEAAkE;oBAClE,uDAAuD;oBACvD,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;wBAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,oMAAoM,CAAC;qBAC/O,CAAC;iBACH,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,mGAAmG;oBACnG,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,iFAAiF;oBACjF,iFAAiF;oBACjF,qFAAqF;oBACrF,oFAAoF;oBACpF,yEAAyE;oBACzE,qFAAqF;oBACrF,mFAAmF;oBACnF,+DAA+D;oBAC/D,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,YAAY,CAAC,EAAE;YACpC,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;qBAC3G;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;oBAC1C,4FAA4F;oBAC5F,wEAAwE;oBACxE,aAAa,EAAE,8BAA8B,CAAC,YAAY;oBAC1D,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,gCAAgC;oBAC5C,qFAAqF;oBACrF,qFAAqF;oBACrF,0EAA0E;oBAC1E,mFAAmF;oBACnF,uFAAuF;oBACvF,kFAAkF;oBAClF,yDAAyD;oBACzD,EAAE;oBACF,uFAAuF;oBACvF,mFAAmF;oBACnF,iFAAiF;oBACjF,uFAAuF;oBACvF,6CAA6C;oBAC7C,iBAAiB,EAAE,iCAAiC;iBACrD,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SCIM Tokens Resource Configuration — Polymorphic\n *\n * Produces the organization-scoped factory used by the SCIM bearer protocol.\n * Spread into the registry factory map:\n *   ...scimTokensPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationReversibility,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { scimTokensPolymorphicDeclaration, ScimTokenBaseSchema } from './scim-tokens.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum ScimTokens_Operations {\n  GENERATE_TOKEN = 'generateToken',\n  REVOKE_TOKEN = 'revokeToken',\n  ROTATE_TOKEN = 'rotateToken',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\nexport const ScimTokens_GenerateTokenRequestDto = z.strictObject({\n  displayName: z.string().min(1),\n  expiresAt: z.string().datetime().optional(),\n});\n\nexport const ScimTokens_RevokeTokenRequestDto = z.strictObject({});\n\n/**\n * Rotation is an immediate cutover because the persisted token schema has no previous-hash grace slot.\n * Keep the request strictly empty rather than accepting a migration-window option the runtime cannot honor.\n */\nexport const ScimTokens_RotateTokenRequestDto = z.strictObject({});\n\nexport const ScimTokens_RevokeTokenResponseDto = z.strictObject({\n  isActive: z.boolean(),\n  revokedAt: z.date().describe(\"When this request revoked the token. The time is not stored on the token, so later reads do not show it.\"),\n  message: z.string().describe(\"A fixed confirmation: `Token revoked`.\"),\n});\n\nexport const ScimTokens_RotateTokenResponseDto = z.strictObject({\n  newToken: z.string().isEphemeral().describe(\"The new token value, returned only in this response: only its hash is stored, so it cannot be read again. The previous value stops working immediately; the directory sends this one as a bearer token instead.\"),\n  newTokenId: z.string().describe(\"The id of the rotated token. Rotation replaces the value on the same token, so this is the token's own id.\"),\n  newTokenHash: z.string().describe(\"The SHA-256 hash of the new token value, in hex: the form in which it is stored.\"),\n  message: z.string().describe(\"A fixed confirmation: `Token rotated`.\"),\n});\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const scimTokensPolymorphicFactories = createPolymorphicResourceConfigurations(\n  scimTokensPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    customOperation: ScimTokens_Operations,\n    // The SCIM bearer-auth middleware resolves an inbound token by its `tokenHash`\n    // on EVERY /scim/v2/* request via a system-context read (see\n    // `scim.backend.controller.ts` `_authenticateBearer` → `servicesRegistryHandler.read`\n    // with the `createForSystemAuthOperation` EC). That read is PRE-USER (the token IS\n    // the credential), so it opts into `systemAccessPolicy.read = ALLOWED` — mirrors the\n    // enterprise SSO-connection resolver's pre-auth read.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n    },\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The bearer-auth token lookup reads this through the service layer\n          // (`servicesRegistryHandler.read` → `getServiceOperationPathDefault`), which\n          // honours INTERNAL_CALL / API_CALL defaults but NOT `REPOSITORY_ONLY`; a\n          // repository-only READ here throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // and 500s every SCIM request. Same fix as the SSO-connection READ.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          // Service-transport default (INTERNAL_CALL — internal-only, NO HTTP surface).\n          // The SCIM bearer-auth middleware stamps `lastUsedAt` on the resolved token on\n          // every /scim/v2/* request via a fire-and-forget system-context update. Without a\n          // resolvable UPDATE op that write throws `RESOURCES_REGISTRY_OPERATION_PATH_NOT_FOUND`\n          // (logged FATAL, though swallowed) on every SCIM call. Token metadata mutation is\n          // internal-only; operators rotate/revoke via the dedicated custom ops.\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.REPOSITORY_ONLY,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [ScimTokens_Operations.GENERATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: ScimTokens_GenerateTokenRequestDto,\n          // GENERATE_TOKEN borrows CREATE and PERSISTS a real SCIM-token row (the\n          // SCIM bearer-auth middleware resolves inbound tokens by their persisted\n          // `tokenHash`), then returns that row PLUS the one-time plaintext `token`.\n          // This mirrors the api-key mint contract exactly: the response DTO is the\n          // resource schema extended with an ephemeral secret field — NOT a bespoke\n          // shape. The mint runs as a CREATE prefix (injects `tokenHash` +\n          // `createdByUserId` so the core create persists) + postfix (attaches the\n          // one-time `token`); see `scim-tokens.custom-impl.backend.service.ts`.\n          // `token` is `.isEphemeral()` (secret display, revealed once, not\n          // persisted — same decorator api-key `plainKey` uses).\n          customResponseDto: ScimTokenBaseSchema.extend({\n            token: z.string().isEphemeral().describe(\"The token value, returned only in this response: only its hash is stored, so it cannot be read again. The directory sends it as a bearer token in the `Authorization` header of its SCIM requests.\"),\n          }),\n        }],\n      },\n      [ScimTokens_Operations.REVOKE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: A revoked token can never be un-revoked; the integration must be issued a new one.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RevokeTokenRequestDto,\n          // Borrows UPDATE (NOT DELETE) for its route/verb: revocation RETAINS the row for\n          // audit and merely flips `isActive` to false — so the borrowed core op must be a\n          // persisting UPDATE, not a DELETE. (Borrowing DELETE physically removed the row: the\n          // dispatch runs the borrowed core op FIRST, before any replace/postfix, so the core\n          // DELETE deleted the token before the handler could intervene — the same\n          // `replaceCoreOperations`-runs-after-core antipattern fixed for GENERATE_TOKEN.) The\n          // custom impl marks the row inactive via a CREATE-like UPDATE prefix and returns a\n          // revocation acknowledgement, NOT the SCIM-token resource row.\n          customResponseDto: ScimTokens_RevokeTokenResponseDto,\n        }],\n      },\n      [ScimTokens_Operations.ROTATE_TOKEN]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n          // IRREVERSIBLE: Replaces the token value. The previous one is gone the moment this returns.\n          // This is what admits it to the danger zone; risk alone no longer does.\n          reversibility: ResourceOperationReversibility.IRREVERSIBLE,\n          resourceOperationLike: CoreResourceOperation.UPDATE,\n          requestDto: ScimTokens_RotateTokenRequestDto,\n          // Borrows UPDATE and re-mints the secret IN PLACE on the same row: the custom impl's\n          // UPDATE prefix injects a fresh `tokenHash` (mirroring the api-key rotate contract —\n          // `tokenHash` is `.excludeFromUpdate()`, carried past the strict parse by\n          // `preserveServerInjectedFields`) and the postfix surfaces the one-time plaintext.\n          // Returns the newly-rotated token (plaintext + hash), NOT the SCIM-token resource row.\n          // `newToken` is the one-time secret → `.isEphemeral()` (secret display, initially\n          // revealed, not editable), mirroring api-key `plainKey`.\n          //\n          // Unlike api-keys (which keep the outgoing secret alive in a `previousHashedKey` grace\n          // slot), the SCIM-token schema has NO previous-hash slot. Rotation is therefore an\n          // IMMEDIATE cutover: the new hash replaces the old and the prior plaintext stops\n          // authenticating at once. Do not expose a migration-window request or response until a\n          // real persisted grace-slot contract exists.\n          customResponseDto: ScimTokens_RotateTokenResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}