@wildo-ai/saas-models 1.1.4 → 1.1.6

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts

@@ -20,7 +20,9 @@ export declare enum SsoConnectionTestOverallStatus {
 }
 /** Evidence source that produced a supported endpoint-discovery result. */
 export declare enum SsoConnectionDiscoverySource {
-    SAML_METADATA = "saml-metadata"
+    SAML_METADATA = "saml-metadata",
+    /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */
+    OIDC_DISCOVERY = "oidc-discovery"
 }
 /**
  * TEST_CONNECTION addresses the connection through the resource URL. It has no
@@ -31,8 +33,10 @@ export declare const SsoConnection_TestConnectionRequestDto: z.ZodObject<{}, z.c
 /**
  * Metadata discovery needs at least one protocol-specific source. The union
  * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
- * runtime; an object with both sources remains valid and SAML metadata takes
- * precedence until OIDC discovery is implemented.
+ * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID
+ * Connect one; an object with both remains valid and SAML metadata takes
+ * precedence, since the two describe different connections and the operation
+ * answers one protocol.
  */
 export declare const SsoConnection_DiscoverEndpointsRequestDto: z.ZodUnion<readonly [z.ZodObject<{
     metadataUrl: z.ZodURL;
@@ -50,7 +54,14 @@ export declare const SsoConnection_TestConnectionResponseDto: z.ZodDiscriminated
     protocol: z.ZodLiteral<SsoProtocol.SAML>;
     supported: z.ZodLiteral<true>;
     entityIdConfigured: z.ZodBoolean;
-    ssoUrlReachable: z.ZodBoolean;
+    /**
+     * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
+     * outbound-target guard refused the destination (a private address the operator has not declared in
+     * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement
+     * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
+     * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
+     */
+    ssoUrlReachable: z.ZodOptional<z.ZodBoolean>;
     ssoUrlStatus: z.ZodOptional<z.ZodNumber>;
     certificates: z.ZodArray<z.ZodObject<{
         index: z.ZodNumber;
@@ -61,6 +72,7 @@ export declare const SsoConnection_TestConnectionResponseDto: z.ZodDiscriminated
         fingerprint: z.ZodString;
         warnings: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
+    /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
     sloUrlReachable: z.ZodOptional<z.ZodBoolean>;
     sloUrlStatus: z.ZodOptional<z.ZodNumber>;
     spMetadataValid: z.ZodBoolean;
@@ -84,11 +96,18 @@ export declare const SsoConnection_DiscoverEndpointsResponseDto: z.ZodDiscrimina
     sloUrl: z.ZodOptional<z.ZodURL>;
     x509Certificates: z.ZodArray<z.ZodString>;
     nameIdFormat: z.ZodOptional<z.ZodString>;
-    source: z.ZodLiteral<SsoConnectionDiscoverySource>;
+    source: z.ZodLiteral<SsoConnectionDiscoverySource.SAML_METADATA>;
 }, z.core.$strict>, z.ZodObject<{
     protocol: z.ZodLiteral<SsoProtocol.OIDC>;
-    supported: z.ZodLiteral<false>;
-    message: z.ZodString;
+    supported: z.ZodLiteral<true>;
+    issuer: z.ZodURL;
+    authorizationEndpoint: z.ZodURL;
+    tokenEndpoint: z.ZodURL;
+    userInfoEndpoint: z.ZodOptional<z.ZodURL>;
+    jwksUri: z.ZodURL;
+    endSessionEndpoint: z.ZodOptional<z.ZodURL>;
+    scopesSupported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    source: z.ZodLiteral<SsoConnectionDiscoverySource.OIDC_DISCOVERY>;
 }, z.core.$strict>], "protocol">;
 export declare const ssoConnectionPolymorphicFactories: Record<string, import("../../..").ResourceConfiguration_InitializationFactory<typeof SsoConnection_Operations, CoreResourceOperation.READ | CoreResourceOperation.UPDATE | CoreResourceOperation.DELETE | CoreResourceOperation.CREATE | CoreResourceOperation.LIST, any>>;
 //# sourceMappingURL=sso-connection.shared.resources-config.schemas.d.ts.map

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;CAChC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBASpD,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;gCAoBlD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;gCAgBrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAoB,MAAM,sDAAsD,CAAC;AAQ/G,OAAO,EAAE,WAAW,EAAuC,MAAM,iCAAiC,CAAC;AAInG,oBAAY,wBAAwB;IAClC,eAAe,mBAAmB;IAClC,kBAAkB,sBAAsB;CACzC;AAED,0EAA0E;AAC1E,oBAAY,8BAA8B;IACxC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,IAAI,SAAS;CACd;AAED,2EAA2E;AAC3E,oBAAY,4BAA4B;IACtC,aAAa,kBAAkB;IAC/B,iGAAiG;IACjG,cAAc,mBAAmB;CAClC;AAID;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,iCAAqB,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,yCAAyC;;;;;;oBAgBpD,CAAC;AAiBH;;;;GAIG;AACH,eAAO,MAAM,uCAAuC;;;;IAKhD;;;;;;OAMG;;;;;;;;;;;;IAWH,uEAAuE;;;;;;;;;;;gCAwBzE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;gCAoCrD,CAAC;AAIH,eAAO,MAAM,iCAAiC,4QA0J7C,CAAC"}

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js

@@ -29,6 +29,8 @@ export var SsoConnectionTestOverallStatus;
 export var SsoConnectionDiscoverySource;
 (function (SsoConnectionDiscoverySource) {
     SsoConnectionDiscoverySource["SAML_METADATA"] = "saml-metadata";
+    /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */
+    SsoConnectionDiscoverySource["OIDC_DISCOVERY"] = "oidc-discovery";
 })(SsoConnectionDiscoverySource || (SsoConnectionDiscoverySource = {}));
 // ── Request DTOs ─────────────────────────────────────────────────────
 /**
@@ -40,27 +42,41 @@ export const SsoConnection_TestConnectionRequestDto = z.strictObject({});
 /**
  * Metadata discovery needs at least one protocol-specific source. The union
  * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at
- * runtime; an object with both sources remains valid and SAML metadata takes
- * precedence until OIDC discovery is implemented.
+ * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID
+ * Connect one; an object with both remains valid and SAML metadata takes
+ * precedence, since the two describe different connections and the operation
+ * answers one protocol.
  */
 export const SsoConnection_DiscoverEndpointsRequestDto = z.union([
     z.strictObject({
-        metadataUrl: z.url(),
-        issuerUrl: z.url().optional(),
+        metadataUrl: z
+            .url()
+            .describe("The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection."),
+        issuerUrl: z.url().optional().describe("An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given."),
     }),
     z.strictObject({
-        issuerUrl: z.url(),
-        metadataUrl: z.url().optional(),
+        issuerUrl: z
+            .url()
+            .describe("An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection."),
+        metadataUrl: z
+            .url()
+            .optional()
+            .describe("The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection."),
     }),
 ]);
 const SsoConnection_CertificateTestResultDto = z.strictObject({
-    index: z.number().int().nonnegative(),
-    valid: z.boolean(),
-    expiresAt: z.string(),
-    daysRemaining: z.number().int(),
-    algorithm: z.string(),
-    fingerprint: z.string(),
-    warnings: z.array(z.string()),
+    index: z.number().int().nonnegative().describe("The certificate's position in the connection's certificate list, starting at 0."),
+    valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),
+    expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),
+    daysRemaining: z
+        .number()
+        .int()
+        .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),
+    algorithm: z.string().describe("The certificate's signature algorithm, or `unknown` when it is not recognised."),
+    fingerprint: z.string().describe("The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read."),
+    warnings: z
+        .array(z.string())
+        .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),
 });
 /**
  * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a
@@ -70,22 +86,46 @@ const SsoConnection_CertificateTestResultDto = z.strictObject({
 export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityIdConfigured: z.boolean(),
-        ssoUrlReachable: z.boolean(),
-        ssoUrlStatus: z.number().int().optional(),
-        certificates: z.array(SsoConnection_CertificateTestResultDto),
-        sloUrlReachable: z.boolean().optional(),
-        sloUrlStatus: z.number().int().optional(),
-        spMetadataValid: z.boolean(),
-        overallStatus: z.enum(SsoConnectionTestOverallStatus),
-        errors: z.array(z.string()),
-        warnings: z.array(z.string()),
+        supported: z.literal(true).describe('`true`: the connection was tested.'),
+        entityIdConfigured: z.boolean().describe("Whether the identity provider's entity ID is set on the connection."),
+        /**
+         * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the
+         * outbound-target guard refused the destination (a private address the operator has not declared in
+         * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement
+         * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the
+         * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).
+         */
+        ssoUrlReachable: z
+            .boolean()
+            .optional()
+            .describe("Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why."),
+        ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),
+        certificates: z
+            .array(SsoConnection_CertificateTestResultDto)
+            .describe("One result per X.509 certificate configured for the identity provider, in the connection's order."),
+        /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */
+        sloUrlReachable: z
+            .boolean()
+            .optional()
+            .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),
+        sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),
+        spMetadataValid: z
+            .boolean()
+            .describe("Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning."),
+        overallStatus: z
+            .enum(SsoConnectionTestOverallStatus)
+            .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),
+        errors: z
+            .array(z.string())
+            .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),
+        warnings: z
+            .array(z.string())
+            .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),
     }),
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),
+        message: z.string().min(1).describe('Explains why no test was run.'),
     }),
 ]);
 /**
@@ -95,18 +135,38 @@ export const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('pro
 export const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [
     z.strictObject({
         protocol: z.literal(SsoProtocol.SAML),
-        supported: z.literal(true),
-        entityId: z.string().min(1),
-        ssoUrl: z.url(),
-        sloUrl: z.url().optional(),
-        x509Certificates: z.array(z.string()),
-        nameIdFormat: z.string().optional(),
-        source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),
+        supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),
+        entityId: z.string().min(1).describe("The identity provider's entity ID, from the metadata."),
+        ssoUrl: z.url().describe("The identity provider's single sign-on URL, from the metadata."),
+        sloUrl: z.url().optional().describe("The identity provider's single-logout URL, when the metadata declares one."),
+        x509Certificates: z.array(z.string()).describe("The identity provider's X.509 certificates, from the metadata."),
+        nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.SAML_METADATA)
+            .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),
     }),
+    /*
+     * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered
+     * `supported: false` whatever it said. The field names are the connection's own `oidc.*` names, so a
+     * form can merge the result straight into a connection, as the SAML wizard does with `saml.*`.
+     *
+     * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,
+     * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather
+     * than a response member, exactly as a SAML metadata failure is.
+     */
     z.strictObject({
         protocol: z.literal(SsoProtocol.OIDC),
-        supported: z.literal(false),
-        message: z.string().min(1),
+        supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),
+        issuer: z.url().describe("The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged."),
+        authorizationEndpoint: z.url().describe("The provider's authorization endpoint."),
+        tokenEndpoint: z.url().describe("The provider's token endpoint."),
+        userInfoEndpoint: z.url().optional().describe("The provider's userinfo endpoint, when the document declares one."),
+        jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),
+        endSessionEndpoint: z.url().optional().describe("The provider's logout endpoint, when the document declares one."),
+        scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),
+        source: z
+            .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)
+            .describe("Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`."),
     }),
 ]);
 // ── Polymorphic Factory ──────────────────────────────────────────────
@@ -169,7 +229,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.LOW,
@@ -234,7 +294,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,
@@ -250,7 +310,7 @@ export const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfig
                     variantType: ResourceOperationVariantType.API_CALL,
                     isDefault: true,
                     polymorphicRole: {
-                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],
+                        [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],
                         [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],
                     },
                     riskLevel: ResourceOperationRiskLevel.MEDIUM,

package/dist/esm/security/authentications/sso/sso-connection.shared.resources-config.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAEX;AAFD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;AACjC,CAAC,EAFW,4BAA4B,KAA5B,4BAA4B,QAEvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE;QAClB,WAAW,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;QAC7D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC9B,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE;QACf,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QAC1B,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;KAC9D,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Connection Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConnectionPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n  TEST_CONNECTION = 'testConnection',\n  DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/** Final SAML diagnostic posture after all configured checks complete. */\nexport enum SsoConnectionTestOverallStatus {\n  PASS = 'pass',\n  WARNING = 'warning',\n  FAIL = 'fail',\n}\n\n/** Evidence source that produced a supported endpoint-discovery result. */\nexport enum SsoConnectionDiscoverySource {\n  SAML_METADATA = 'saml-metadata',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/**\n * TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n */\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/**\n * Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime; an object with both sources remains valid and SAML metadata takes\n * precedence until OIDC discovery is implemented.\n */\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n  z.strictObject({\n    metadataUrl: z.url(),\n    issuerUrl: z.url().optional(),\n  }),\n  z.strictObject({\n    issuerUrl: z.url(),\n    metadataUrl: z.url().optional(),\n  }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n  index: z.number().int().nonnegative(),\n  valid: z.boolean(),\n  expiresAt: z.string(),\n  daysRemaining: z.number().int(),\n  algorithm: z.string(),\n  fingerprint: z.string(),\n  warnings: z.array(z.string()),\n});\n\n/**\n * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n */\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityIdConfigured: z.boolean(),\n    ssoUrlReachable: z.boolean(),\n    ssoUrlStatus: z.number().int().optional(),\n    certificates: z.array(SsoConnection_CertificateTestResultDto),\n    sloUrlReachable: z.boolean().optional(),\n    sloUrlStatus: z.number().int().optional(),\n    spMetadataValid: z.boolean(),\n    overallStatus: z.enum(SsoConnectionTestOverallStatus),\n    errors: z.array(z.string()),\n    warnings: z.array(z.string()),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n/**\n * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n */\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true),\n    entityId: z.string().min(1),\n    ssoUrl: z.url(),\n    sloUrl: z.url().optional(),\n    x509Certificates: z.array(z.string()),\n    nameIdFormat: z.string().optional(),\n    source: z.literal(SsoConnectionDiscoverySource.SAML_METADATA),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false),\n    message: z.string().min(1),\n  }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConnectionPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n    // the target connection BEFORE any user is authenticated, so the caller holds\n    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n    // reads the connection through the sanctioned request-triggered ACL-bypass\n    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n    // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n    //\n    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    customOperation: SsoConnection_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            // Service-transport default. The enterprise SSO login-initiation\n            // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n            // which resolves the READ path through `getServiceOperationPathDefault`\n            // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n            // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n            // public HTTP surface — admins list connections via the API_CALL LIST)\n            // gives the system read a resolvable service-transport path. Gated by\n            // `systemAccessPolicy.read = ALLOWED` above.\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n      // service transport is the only tier that carries the connection's write\n      // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`\n      // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n      //\n      // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n      // write could resolve a service op-path, AND `doOperation` throws outright on a\n      // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n      // write semantics never ran — `connectionId` minting, SAML\n      // `x509CertificatePem` → `x509Certificates` normalization, nested\n      // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n      // last-connection / in-use guards. They are now reachable.\n      //\n      // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n      // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n      // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n      //\n      // The `onParentDelete` cascade is unaffected — it deletes through\n      // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n      // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n      // That path still bypasses the service tier and the DELETE custom impl by design.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SsoConnection_Operations.TEST_CONNECTION]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: SsoConnection_TestConnectionRequestDto,\n          // Borrows READ for its route/verb but returns protocol-discriminated\n          // diagnostics, not the SSO-connection row.\n          customResponseDto: SsoConnection_TestConnectionResponseDto,\n        }],\n      },\n      [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n          // Borrows CREATE for its route/verb but returns discovered metadata,\n          // not a created or updated SSO-connection row.\n          customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}
+{"version":3,"file":"sso-connection.shared.resources-config.schemas.js","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.resources-config.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC/G,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oDAAoD,CAAC;AAC9F,OAAO,EAAE,uCAAuC,EAAE,MAAM,wDAAwD,CAAC;AACjH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAC3F,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,MAAM,iCAAiC,CAAC;AAEnG,wEAAwE;AAExE,MAAM,CAAN,IAAY,wBAGX;AAHD,WAAY,wBAAwB;IAClC,8DAAkC,CAAA;IAClC,oEAAwC,CAAA;AAC1C,CAAC,EAHW,wBAAwB,KAAxB,wBAAwB,QAGnC;AAED,0EAA0E;AAC1E,MAAM,CAAN,IAAY,8BAIX;AAJD,WAAY,8BAA8B;IACxC,+CAAa,CAAA;IACb,qDAAmB,CAAA;IACnB,+CAAa,CAAA;AACf,CAAC,EAJW,8BAA8B,KAA9B,8BAA8B,QAIzC;AAED,2EAA2E;AAC3E,MAAM,CAAN,IAAY,4BAIX;AAJD,WAAY,4BAA4B;IACtC,+DAA+B,CAAA;IAC/B,iGAAiG;IACjG,iEAAiC,CAAA;AACnC,CAAC,EAJW,4BAA4B,KAA5B,4BAA4B,QAIvC;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,YAAY,CAAC;QACb,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,CAAC,iIAAiI,CAAC;QAC9I,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;KACpH,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,SAAS,EAAE,CAAC;aACT,GAAG,EAAE;aACL,QAAQ,CAAC,uJAAuJ,CAAC;QACpK,WAAW,EAAE,CAAC;aACX,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,QAAQ,CAAC,6IAA6I,CAAC;KAC3J,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,sCAAsC,GAAG,CAAC,CAAC,YAAY,CAAC;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,iFAAiF,CAAC;IACjI,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IACpH,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,uGAAuG,CAAC;IACvI,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,CAAC,sHAAsH,CAAC;IACnI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gFAAgF,CAAC;IAChH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8GAA8G,CAAC;IAChJ,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,QAAQ,CAAC,4HAA4H,CAAC;CAC1I,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACtF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,oCAAoC,CAAC;QACzE,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,qEAAqE,CAAC;QAC/G;;;;;;WAMG;QACH,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CACP,yQAAyQ,CAC1Q;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2EAA2E,CAAC;QAC/H,YAAY,EAAE,CAAC;aACZ,KAAK,CAAC,sCAAsC,CAAC;aAC7C,QAAQ,CAAC,mGAAmG,CAAC;QAChH,uEAAuE;QACvE,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,8IAA8I,CAAC;QAC3J,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;QACxJ,eAAe,EAAE,CAAC;aACf,OAAO,EAAE;aACT,QAAQ,CAAC,oLAAoL,CAAC;QACjM,aAAa,EAAE,CAAC;aACb,IAAI,CAAC,8BAA8B,CAAC;aACpC,QAAQ,CAAC,iHAAiH,CAAC;QAC9H,MAAM,EAAE,CAAC;aACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,mIAAmI,CAAC;QAChJ,QAAQ,EAAE,CAAC;aACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,QAAQ,CAAC,wIAAwI,CAAC;KACtJ,CAAC;IACF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,sFAAsF,CAAC;QAC5H,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,+BAA+B,CAAC;KACrE,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,kBAAkB,CAAC,UAAU,EAAE;IACzF,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,4CAA4C,CAAC;QACjF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,uDAAuD,CAAC;QAC7F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAC1F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4EAA4E,CAAC;QACjH,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,gEAAgE,CAAC;QAChH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2FAA2F,CAAC;QACzI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,aAAa,CAAC;aACnD,QAAQ,CAAC,4EAA4E,CAAC;KAC1F,CAAC;IACF;;;;;;;;OAQG;IACH,CAAC,CAAC,YAAY,CAAC;QACb,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC3F,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,iKAAiK,CAAC;QAC3L,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,wCAAwC,CAAC;QACjF,aAAa,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QACjE,gBAAgB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;QAClH,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,sEAAsE,CAAC;QACjG,kBAAkB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iEAAiE,CAAC;QAClH,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yEAAyE,CAAC;QACnI,MAAM,EAAE,CAAC;aACN,OAAO,CAAC,4BAA4B,CAAC,cAAc,CAAC;aACpD,QAAQ,CAAC,yGAAyG,CAAC;KACvH,CAAC;CACH,CAAC,CAAC;AAEH,wEAAwE;AAExE,MAAM,CAAC,MAAM,iCAAiC,GAAG,uCAAuC,CACtF,mCAAmC,EACnC;IACE,gBAAgB,EAAE,IAAI;IACtB,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,mFAAmF;IACnF,2EAA2E;IAC3E,mEAAmE;IACnE,EAAE;IACF,sFAAsF;IACtF,2FAA2F;IAC3F,oFAAoF;IACpF,qFAAqF;IACrF,gFAAgF;IAChF,uFAAuF;IACvF,6FAA6F;IAC7F,kBAAkB,EAAE;QAClB,IAAI,EAAE,wBAAwB,CAAC,OAAO;QACtC,IAAI,EAAE,wBAAwB,CAAC,OAAO;KACvC;IACD,eAAe,EAAE,wBAAwB;IACzC,cAAc,EAAE;QACd,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,IAAI;QAC1B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;QAC5B,qBAAqB,CAAC,MAAM;KAC7B;IACD,uBAAuB,EAAE;QACvB,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE;gBACR;oBACE,iEAAiE;oBACjE,kEAAkE;oBAClE,wEAAwE;oBACxE,sEAAsE;oBACtE,kEAAkE;oBAClE,uEAAuE;oBACvE,sEAAsE;oBACtE,6CAA6C;oBAC7C,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C;aAAC;SACL;QACD,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE;YAC5B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,GAAG;iBAC1C,CAAC;SACH;QACD,8EAA8E;QAC9E,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,kEAAkE;QAClE,qEAAqE;QACrE,2DAA2D;QAC3D,EAAE;QACF,gFAAgF;QAChF,gFAAgF;QAChF,wEAAwE;QACxE,EAAE;QACF,kEAAkE;QAClE,kFAAkF;QAClF,6EAA6E;QAC7E,kFAAkF;QAClF,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE;YAC9B,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,aAAa;oBACvD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC;wBAC5D,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,IAAI;iBAC3C,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,eAAe,CAAC,EAAE;YAC1C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,IAAI;oBACjD,UAAU,EAAE,sCAAsC;oBAClD,qEAAqE;oBACrE,2CAA2C;oBAC3C,iBAAiB,EAAE,uCAAuC;iBAC3D,CAAC;SACH;QACD,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,EAAE;YAC7C,QAAQ,EAAE,CAAC;oBACT,WAAW,EAAE,4BAA4B,CAAC,QAAQ;oBAClD,SAAS,EAAE,IAAI;oBACf,eAAe,EAAE;wBACf,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,6BAA6B,CAAC;wBAC1G,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,qBAAqB,CAAC;qBACvE;oBACD,SAAS,EAAE,0BAA0B,CAAC,MAAM;oBAC5C,qBAAqB,EAAE,qBAAqB,CAAC,MAAM;oBACnD,UAAU,EAAE,yCAAyC;oBACrD,qEAAqE;oBACrE,+CAA+C;oBAC/C,iBAAiB,EAAE,0CAA0C;iBAC9D,CAAC;SACH;KACF;CACF,CACF,CAAC","sourcesContent":["/**\n * SSO Connection Resource Configuration — Polymorphic\n *\n * Produces 2 factory functions (ORG + APP) via the polymorphic factory.\n * Spread into the registry factory map:\n *   ...ssoConnectionPolymorphicFactories\n */\n\nimport { z } from 'zod';\nimport { CoreResourceOperation, CoreResourceType } from '../../../resources/resources.shared.core.definitions';\nimport {\n  ResourceOperationRiskLevel,\n  ResourceOperationVariantType,\n} from '../../../resources/resources.shared.schemas';\nimport { ResourceSystemAccessMode } from '../../../resources/resources-config.shared.schemas';\nimport { createPolymorphicResourceConfigurations } from '../../../resources/utils/resource-polymorphism.factory';\nimport { CORE_ORG_ROLES, CORE_APP_ROLES } from '../../authorizations/roles.shared.schemas';\nimport { SsoProtocol, ssoConnectionPolymorphicDeclaration } from './sso-connection.shared.schemas';\n\n// ── Custom Operations ────────────────────────────────────────────────\n\nexport enum SsoConnection_Operations {\n  TEST_CONNECTION = 'testConnection',\n  DISCOVER_ENDPOINTS = 'discoverEndpoints',\n}\n\n/** Final SAML diagnostic posture after all configured checks complete. */\nexport enum SsoConnectionTestOverallStatus {\n  PASS = 'pass',\n  WARNING = 'warning',\n  FAIL = 'fail',\n}\n\n/** Evidence source that produced a supported endpoint-discovery result. */\nexport enum SsoConnectionDiscoverySource {\n  SAML_METADATA = 'saml-metadata',\n  /** The OpenID Provider's `/.well-known/openid-configuration` document at `issuerUrl` (#1800). */\n  OIDC_DISCOVERY = 'oidc-discovery',\n}\n\n// ── Request DTOs ─────────────────────────────────────────────────────\n\n/**\n * TEST_CONNECTION addresses the connection through the resource URL. It has no\n * independent query/body input: accepting a second `connectionId` let callers\n * provide two identities while the service always used `utils.currentObject`.\n */\nexport const SsoConnection_TestConnectionRequestDto = z.strictObject({});\n\n/**\n * Metadata discovery needs at least one protocol-specific source. The union\n * makes that invariant visible in generated JSON Schema (`anyOf`) as well as at\n * runtime. `metadataUrl` discovers a SAML provider and `issuerUrl` an OpenID\n * Connect one; an object with both remains valid and SAML metadata takes\n * precedence, since the two describe different connections and the operation\n * answers one protocol.\n */\nexport const SsoConnection_DiscoverEndpointsRequestDto = z.union([\n  z.strictObject({\n    metadataUrl: z\n      .url()\n      .describe(\"The URL of the identity provider's SAML metadata document. The server fetches and reads it; nothing is saved to the connection.\"),\n    issuerUrl: z.url().optional().describe(\"An OpenID Connect provider's issuer. Ignored when `metadataUrl` is given.\"),\n  }),\n  z.strictObject({\n    issuerUrl: z\n      .url()\n      .describe(\"An OpenID Connect provider's issuer. The server fetches `<issuer>/.well-known/openid-configuration` and reads it; nothing is saved to the connection.\"),\n    metadataUrl: z\n      .url()\n      .optional()\n      .describe(\"The URL of the identity provider's SAML metadata document. When given, the server fetches and reads it; nothing is saved to the connection.\"),\n  }),\n]);\n\nconst SsoConnection_CertificateTestResultDto = z.strictObject({\n  index: z.number().int().nonnegative().describe(\"The certificate's position in the connection's certificate list, starting at 0.\"),\n  valid: z.boolean().describe('`true` when the certificate could be read and today falls within its validity period.'),\n  expiresAt: z.string().describe('When the certificate expires, as an ISO 8601 date-time. Empty when the certificate could not be read.'),\n  daysRemaining: z\n    .number()\n    .int()\n    .describe('Whole days until the certificate expires; negative once it has expired. `-1` when the certificate could not be read.'),\n  algorithm: z.string().describe(\"The certificate's signature algorithm, or `unknown` when it is not recognised.\"),\n  fingerprint: z.string().describe(\"The certificate's SHA-256 fingerprint, as colon-separated hex. Empty when the certificate could not be read.\"),\n  warnings: z\n    .array(z.string())\n    .describe('Problems found with this certificate: expired or not yet valid, expiring within 30 days, a SHA-1 signature, or unreadable.'),\n});\n\n/**\n * Protocol-discriminated result for TEST_CONNECTION. SAML diagnostics are a\n * real implementation; OIDC deliberately reports its unavailable test path as\n * data instead of returning an ambiguous `{ message }` success payload.\n */\nexport const SsoConnection_TestConnectionResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true).describe('`true`: the connection was tested.'),\n    entityIdConfigured: z.boolean().describe(\"Whether the identity provider's entity ID is set on the connection.\"),\n    /**\n     * Did the server's probe reach the SSO URL? ABSENT when the server was not allowed to probe it — the\n     * outbound-target guard refused the destination (a private address the operator has not declared in\n     * `auth.federatedIdentityProviderPrivateNetworks`). Neither `true` nor `false` would be a statement\n     * about the endpoint then: SAML sign-in reaches it through the user's browser, so a private IdP the\n     * server may not address can still be a working SSO URL. The reason is carried in `warnings` (#516).\n     */\n    ssoUrlReachable: z\n      .boolean()\n      .optional()\n      .describe(\n        \"Whether the server got an HTTP response from the SSO URL, whatever its status. `false` when it did not answer or no SSO URL is set. Absent when the server may not connect to that address, because sign-in reaches it through the user's browser; `warnings` says why.\",\n      ),\n    ssoUrlStatus: z.number().int().optional().describe('The HTTP status the SSO URL answered with. Absent when it did not answer.'),\n    certificates: z\n      .array(SsoConnection_CertificateTestResultDto)\n      .describe(\"One result per X.509 certificate configured for the identity provider, in the connection's order.\"),\n    /** As `ssoUrlReachable`; also absent when no SLO URL is configured. */\n    sloUrlReachable: z\n      .boolean()\n      .optional()\n      .describe('Whether the server got an HTTP response from the single-logout URL, checked like `ssoUrlReachable`. Absent when no single-logout URL is set.'),\n    sloUrlStatus: z.number().int().optional().describe('The HTTP status the single-logout URL answered with. Absent when it did not answer or none is set.'),\n    spMetadataValid: z\n      .boolean()\n      .describe(\"Whether this application can generate valid service-provider metadata for the connection. `false` means the application's own SAML settings are incomplete, reported as a warning.\"),\n    overallStatus: z\n      .enum(SsoConnectionTestOverallStatus)\n      .describe('The verdict: `fail` when there is at least one error, `warning` when there are only warnings, `pass` otherwise.'),\n    errors: z\n      .array(z.string())\n      .describe('Problems that stop sign-in from working, such as a missing entity ID or SSO URL, an unreachable SSO URL, or no valid certificate.'),\n    warnings: z\n      .array(z.string())\n      .describe('Problems worth fixing that do not by themselves stop sign-in, such as a certificate expiring soon or an unreachable single-logout URL.'),\n  }),\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(false).describe('`false`: OpenID Connect connections cannot be tested yet, and nothing was attempted.'),\n    message: z.string().min(1).describe('Explains why no test was run.'),\n  }),\n]);\n\n/**\n * Protocol-discriminated result for DISCOVER_ENDPOINTS. The operation returns\n * discovered metadata only; it never persists or enriches a connection row.\n */\nexport const SsoConnection_DiscoverEndpointsResponseDto = z.discriminatedUnion('protocol', [\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.SAML),\n    supported: z.literal(true).describe('`true`: the metadata was fetched and read.'),\n    entityId: z.string().min(1).describe(\"The identity provider's entity ID, from the metadata.\"),\n    ssoUrl: z.url().describe(\"The identity provider's single sign-on URL, from the metadata.\"),\n    sloUrl: z.url().optional().describe(\"The identity provider's single-logout URL, when the metadata declares one.\"),\n    x509Certificates: z.array(z.string()).describe(\"The identity provider's X.509 certificates, from the metadata.\"),\n    nameIdFormat: z.string().optional().describe('The name identifier format the identity provider declares, when the metadata carries one.'),\n    source: z\n      .literal(SsoConnectionDiscoverySource.SAML_METADATA)\n      .describe('Where these values came from: the SAML metadata document at `metadataUrl`.'),\n  }),\n  /*\n   * OpenID Connect discovery (#1800). `issuerUrl` was accepted and never read: the operation answered\n   * `supported: false` whatever it said. The field names are the connection's own `oidc.*` names, so a\n   * form can merge the result straight into a connection, as the SAML wizard does with `saml.*`.\n   *\n   * A failed discovery is a 400 (`oidc_discovery_failed`) naming why — not an HTTPS issuer, unreachable,\n   * not a JSON object, a required endpoint missing, or an issuer the document does not assert — rather\n   * than a response member, exactly as a SAML metadata failure is.\n   */\n  z.strictObject({\n    protocol: z.literal(SsoProtocol.OIDC),\n    supported: z.literal(true).describe('`true`: the discovery document was fetched and read.'),\n    issuer: z.url().describe(\"The provider's issuer exactly as its discovery document publishes it. An ID token's `iss` claim must equal this string, so store it as `oidc.issuer` unchanged.\"),\n    authorizationEndpoint: z.url().describe(\"The provider's authorization endpoint.\"),\n    tokenEndpoint: z.url().describe(\"The provider's token endpoint.\"),\n    userInfoEndpoint: z.url().optional().describe(\"The provider's userinfo endpoint, when the document declares one.\"),\n    jwksUri: z.url().describe('Where the provider publishes the keys its ID tokens are signed with.'),\n    endSessionEndpoint: z.url().optional().describe(\"The provider's logout endpoint, when the document declares one.\"),\n    scopesSupported: z.array(z.string()).optional().describe('The scopes the provider says it supports, when the document lists them.'),\n    source: z\n      .literal(SsoConnectionDiscoverySource.OIDC_DISCOVERY)\n      .describe(\"Where these values came from: the discovery document at `<issuerUrl>/.well-known/openid-configuration`.\"),\n  }),\n]);\n\n// ── Polymorphic Factory ──────────────────────────────────────────────\n\nexport const ssoConnectionPolymorphicFactories = createPolymorphicResourceConfigurations(\n  ssoConnectionPolymorphicDeclaration,\n  {\n    isSystemResource: true,\n    // Enterprise SSO login initiation is a PRE-AUTH flow: the enterprise OIDC\n    // authorize route (`/auth/enterprise/authorize/:orgId/:connectionId`) resolves\n    // the target connection BEFORE any user is authenticated, so the caller holds\n    // no ORG_ADMIN / APP_ADMIN role the READ ACL demands. The resolver therefore\n    // reads the connection through the sanctioned request-triggered ACL-bypass\n    // primitive (`AuthOrganizationConfigurationService.loadSsoConnectionAsSystem`\n    // → `SystemAccessService.readAsSystem`), which is fail-closed on this opt-in\n    // and audited (`SYSTEM_CONTEXT_READ`). READ and LIST are exposed to system access;\n    // connection mutation stays admin-gated over the HTTP surface. Mirrors the\n    // ORGANIZATION_MEMBERS opt-in read by `resolveActiveMemberOrgIds`.\n    //\n    // LIST is exposed for the SAME pre-auth reason as READ, one flow later. IdP-INITIATED\n    // SAML (an unsolicited assertion, or a LogoutRequest, arriving with no prior AuthnRequest)\n    // must resolve the tenant by the assertion's `<Issuer>` entityId BEFORE any user is\n    // authenticated — a cross-scope LIST over `saml.entityId`. The resolver reads it via\n    // `AuthOrganizationConfigurationService.listSsoConnectionsByEntityIdAsSystem` →\n    // `SystemAccessService.listAsSystem`. Without this opt-in, IdP-initiated login AND SLO\n    // fail closed (`SAML_UNKNOWN_IDP`) exactly as SP-initiated login did before the READ opt-in.\n    systemAccessPolicy: {\n      read: ResourceSystemAccessMode.ALLOWED,\n      list: ResourceSystemAccessMode.ALLOWED,\n    },\n    customOperation: SsoConnection_Operations,\n    coreOperations: [\n      CoreResourceOperation.READ,\n      CoreResourceOperation.LIST,\n      CoreResourceOperation.CREATE,\n      CoreResourceOperation.UPDATE,\n      CoreResourceOperation.DELETE,\n    ],\n    operationsConfiguration: {\n      [CoreResourceOperation.READ]: {\n        variants: [\n          {\n            // Service-transport default. The enterprise SSO login-initiation\n            // resolver reads a single connection PRE-AUTH via `readAsSystem`,\n            // which resolves the READ path through `getServiceOperationPathDefault`\n            // — that resolver honours INTERNAL_CALL / API_CALL defaults but NOT a\n            // REPOSITORY_ONLY-only op. Declaring an INTERNAL_CALL default (no\n            // public HTTP surface — admins list connections via the API_CALL LIST)\n            // gives the system read a resolvable service-transport path. Gated by\n            // `systemAccessPolicy.read = ALLOWED` above.\n            variantType: ResourceOperationVariantType.INTERNAL_CALL,\n            isDefault: true,\n            polymorphicRole: {\n              [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n              [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n            },\n            riskLevel: ResourceOperationRiskLevel.LOW,\n          }],\n      },\n      [CoreResourceOperation.LIST]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.LOW,\n        }],\n      },\n      // Writes are INTERNAL_CALL for the SAME reason the READ default above is: the\n      // service transport is the only tier that carries the connection's write\n      // semantics, and `getServiceOperationPathDefault` (behind every `*AsSystem`\n      // call) honours INTERNAL_CALL / API_CALL but NOT a REPOSITORY_ONLY-only op.\n      //\n      // As REPOSITORY_ONLY these three were unreachable in both directions: no system\n      // write could resolve a service op-path, AND `doOperation` throws outright on a\n      // REPOSITORY_ONLY operation, so the custom implementations carrying the actual\n      // write semantics never ran — `connectionId` minting, SAML\n      // `x509CertificatePem` → `x509Certificates` normalization, nested\n      // `oidc.clientSecret` write-only-secret preservation, and the DELETE\n      // last-connection / in-use guards. They are now reachable.\n      //\n      // Still NO public HTTP surface: only API_CALL / API_CALL_WITH_CALLBACK register\n      // routes, so the external exposure is identical to REPOSITORY_ONLY. Admins list\n      // via the API_CALL LIST and drive discovery through DISCOVER_ENDPOINTS.\n      //\n      // The `onParentDelete` cascade is unaffected — it deletes through\n      // `childRepository.delete(...)` after a `supportsOperation` check that matches on\n      // `operationIdentifier` + `isOperationDefault` only, never on `variantType`.\n      // That path still bypasses the service tier and the DELETE custom impl by design.\n      [CoreResourceOperation.CREATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.UPDATE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [CoreResourceOperation.DELETE]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.INTERNAL_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.HIGH,\n        }],\n      },\n      [SsoConnection_Operations.TEST_CONNECTION]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.READ,\n          requestDto: SsoConnection_TestConnectionRequestDto,\n          // Borrows READ for its route/verb but returns protocol-discriminated\n          // diagnostics, not the SSO-connection row.\n          customResponseDto: SsoConnection_TestConnectionResponseDto,\n        }],\n      },\n      [SsoConnection_Operations.DISCOVER_ENDPOINTS]: {\n        variants: [{\n          variantType: ResourceOperationVariantType.API_CALL,\n          isDefault: true,\n          polymorphicRole: {\n            [CoreResourceType.ORGANIZATIONS]: [CORE_ORG_ROLES.ORG_ADMIN, CORE_ORG_ROLES.ORG_DELEGATED_MANAGE_SSO_SCIM],\n            [CoreResourceType.APPLICATION]: [CORE_APP_ROLES.APP_ADMIN_SUPER_ADMIN],\n          },\n          riskLevel: ResourceOperationRiskLevel.MEDIUM,\n          resourceOperationLike: CoreResourceOperation.CREATE,\n          requestDto: SsoConnection_DiscoverEndpointsRequestDto,\n          // Borrows CREATE for its route/verb but returns discovered metadata,\n          // not a created or updated SSO-connection row.\n          customResponseDto: SsoConnection_DiscoverEndpointsResponseDto,\n        }],\n      },\n    },\n  },\n);\n"]}

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts

@@ -72,6 +72,7 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
         allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
@@ -79,11 +80,6 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -131,23 +127,17 @@ export declare const SsoConnectionBaseSchema: z.ZodObject<{
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
         }>>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
     groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;
@@ -181,6 +171,7 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
         allowedClockDrift: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodNumber>>;
         forceAuthn: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         maxAuthAge: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodNumber>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         nameIdFormat: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly UNSPECIFIED: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified";
             readonly EMAIL_ADDRESS: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress";
@@ -188,11 +179,6 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly TRANSIENT: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient";
         }>>>;
         allowIdpInitiated: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logAttributeMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     oidc: z.ZodOptional<z.ZodObject<{
         templateMode: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
@@ -240,23 +226,17 @@ export declare const ssoConnectionPolymorphicDeclaration: import("../../..").Pol
             readonly CONSENT: "consent";
             readonly SELECT_ACCOUNT: "select_account";
         }>>>;
+        reAuthenticationEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceEnabled: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
         pkceMethod: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodEnum<{
             readonly S256: "S256";
             readonly PLAIN: "plain";
         }>>>;
-        auditSettings: z.ZodObject<{
-            logAuthAttempts: z.ZodDefault<z.ZodBoolean>;
-            logTokenExchange: z.ZodDefault<z.ZodBoolean>;
-            logClaimsMapping: z.ZodDefault<z.ZodBoolean>;
-            retentionDays: z.ZodDefault<z.ZodNumber>;
-        }, z.core.$strip>;
     }, z.core.$strip>>;
     autoCreateUsers: z.ZodDefault<z.ZodBoolean>;
-    autoVerifyEmail: z.ZodDefault<z.ZodBoolean>;
-    bypassAppMFA: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodBoolean>>;
     defaultRole: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodString>>;
     allowedDomains: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>>;
+    allowedDirectoryIds: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodArray<z.ZodString>>>;
     roleMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>>;
     groupMapping: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>>;
     createdAt: import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<import("@wildo-ai/zod-decorators").DecoratedPrimitiveZodType<z.ZodDefault<z.ZodDate>>>;

package/dist/esm/security/authentications/sso/sso-connection.shared.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6KlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}
+{"version":3,"file":"sso-connection.shared.schemas.d.ts","sourceRoot":"","sources":["../../../../../../src/security/authentications/sso/sso-connection.shared.schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2EAA2E;AAC3E,oBAAY,WAAW;IACrB,IAAI,SAAS;IACb,IAAI,SAAS;CACd;AAED,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX,eAAO,MAAM,SAAS;;;;;CAKZ,CAAC;AAEX,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAEX,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgQlC,CAAC;AAMH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAQ9C,CAAC"}